bug#25247: 26.0.50; Concurrency crashes with XLib

[Eli Zaretskii]

> From: Tino Calancha <tino.calancha@gmail.com>
> Cc: raeburn@raeburn.org, 25247@debbugs.gnu.org, tino.calancha@gmail.com
> Date: Thu, 29 Dec 2016 20:37:47 +0900
> 
> It's worth to note that in _any_ case i've seen more than 1 thread with
> context_acquired = true.

You mean, in no case, right?

> Thread 10 (Thread 0x7fffdd151700 (LWP 27549)):
> #0  raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:58
>         set = {__val = {402653184, 0, 18446744073709551615, 
> 18446744073709551615, 0, 0, 18446744073709551615, 18446744073709551615, 0, 0, 
> 0, 0, 0, 0, 30768, 140737251463819}}
>         pid = <optimized out>
>         tid = <optimized out>
> #1  0x000000000058f90f in terminate_due_to_signal (sig=6, backtrace_limit=40) 
> at emacs.c:395
> No locals.
> #2  0x00000000005bdf0e in emacs_abort () at sysdep.c:2364
> No locals.
> #3  0x00000000005a3a38 in unblock_input_to (level=-1) at keyboard.c:7170
> No locals.
> #4  0x00000000005a3a4f in unblock_input () at keyboard.c:7186
> No locals.
> #5  0x0000000000552f34 in XTread_socket (terminal=0x1371e40 
> <bss_sbrk_buffer+5619808>, hold_quit=0x7fffdd14fa80) at xterm.c:8943
>         count = 0
>         event_found = false
>         dpyinfo = 0x2f5ad40
> #6  0x00000000005a343d in gobble_input () at keyboard.c:6883
>         nr = 0
>         hold_quit = {kind = NO_EVENT, part = scroll_bar_nowhere, code = 0, 
> modifiers = 0, x = {i = 0}, y = {i = 0}, timestamp = 0, frame_or_window = {i 
> = 0}, arg = {i = 0}}
>         next = 0x0
>         nread = 0
>         err = false
>         t = 0x1371e40 <bss_sbrk_buffer+5619808>
> #7  0x00000000005a39cc in handle_async_input () at keyboard.c:7138
>         nread = 0
> #8  0x00000000005a39eb in process_pending_signals () at keyboard.c:7152
> No locals.
> #9  0x00000000005a3a2b in unblock_input_to (level=0) at keyboard.c:7167
> No locals.
> #10 0x00000000005a3a4f in unblock_input () at keyboard.c:7186
> No locals.
> #11 0x000000000070c8f3 in xg_select (fds_lim=14, rfds=0x7fffdd150580, 
> wfds=0x7fffdd150500, efds=0x0, timeout=0x7fffdd1504e0, sigmask=0x0) at 
> xgselect.c:162

This is weird.  It seems some other thread called unblock_input while
this thread was in process_pending_signals.  Not sure how that could
happen.

> Thread 10 (Thread 0x7fffdf295700 (LWP 27925)):
> #0  deliver_input_available_signal (sig=1496990316) at keyboard.c:7211
> No locals.
> #1  <signal handler called>
> No locals.
> #2  __lll_lock_wait () at ../sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
> No locals.
> #3  0x00007ffff044abc5 in __GI___pthread_mutex_lock (mutex=0xe15da0 
> <global_lock>) at ../nptl/pthread_mutex_lock.c:80
>         __PRETTY_FUNCTION__ = "__pthread_mutex_lock"
>         type = 0
>         id = <optimized out>
> #4  0x00000000006ddb62 in sys_mutex_lock (mutex=0xe15da0 <global_lock>) at 
> systhread.c:113
> No locals.
> #5  0x00000000006dc11c in acquire_global_lock (self=0x3630038) at thread.c:100
> No locals.
> #6  0x00000000006dcc88 in really_call_select (arg=0x7fffdf294280) at 
> thread.c:524

This thread got a SIGIO signal while waiting to acquire the global
lock.  It then delivered SIGIO to the main thread.

> Thread 1 (Thread 0x7ffff7f16b00 (LWP 27912)):
> #0  raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:58
>         set = {__val = {402653184, 0, 18446744073709551615, 
> 18446744073709551615, 0, 0, 18446744073709551615, 18446744073709551615, 0, 0, 
> 0, 0, 0, 0, 0, 0}}
>         pid = <optimized out>
>         tid = <optimized out>
> #1  0x000000000058f90f in terminate_due_to_signal (sig=6, backtrace_limit=40) 
> at emacs.c:395
> No locals.
> #2  0x00000000005bdf0e in emacs_abort () at sysdep.c:2364
> No locals.
> #3  0x00000000005546c2 in x_connection_closed (dpy=0x2e736f0, 
> error_message=0x7fffffff9a60 "Connection lost to X server ':0'", 
> ioerror=true) at xterm.c:9582
>         dpyinfo = 0x2f94330
>         frame = {i = 21330997}
>         tail = {i = 0}
>         idx = 7
> #4  0x00000000005548be in x_io_error_quitter (display=0x2e736f0) at 
> xterm.c:9685
>         buf = "Connection lost to X server 
> ':0'\000\035\006\365\377\177\000\000\240Jf\003", '\000' <repeats 20 times>, 
> "`\035\006\365\377\177\000\000`Y\\\003", '\000' <repeats 20 times>, 
> "`\035\006\365\377\177\000\000\360\034]\003", '\000' <repeats 44 times>, 
> "@I\347\002\000\000\000\000\000\312[\003", '\000' <repeats 12 times>, 
> "XI\347\002\000\000\000\000\240\233\377\377\377\177\000\000\300L\345\002\000\000\000\000"...
> #5  0x00007ffff48c32de in _XIOError () from 
> /usr/lib/x86_64-linux-gnu/libX11.so.6
> No symbol table info available.
> #6  0x00007ffff48c1323 in _XReply () from 
> /usr/lib/x86_64-linux-gnu/libX11.so.6
> No symbol table info available.
> #7  0x00007ffff48bcb1d in XSync () from /usr/lib/x86_64-linux-gnu/libX11.so.6
> No symbol table info available.
> #8  0x00007ffff66f0a41 in gdk_window_process_all_updates () from 
> /usr/lib/x86_64-linux-gnu/libgdk-3.so.0
> No symbol table info available.
> #9  0x0000000000564beb in x_sync (f=0x1457c30 <bss_sbrk_buffer+6561360>) at 
> xfns.c:5147
> No locals.
> #10 0x000000000057df90 in xg_update_scrollbar_pos (f=0x1457c30 
> <bss_sbrk_buffer+6561360>, scrollbar_id=0, top=0, left=1170, width=16, 
> height=272) at gtkutil.c:3785

The main thread was doing redisplay, and received an X error.  Could
it be that delivering SIGIO to the main thread while it was in XSync
call caused the X error?  Ken, is that possible?

I think there'll be a need to move the code which releases and
acquires the global lock into xgselect.c.

Thanks.