segfault in delete-frame

[Sam Steingold]

GNU Emacs 23.0.50.16 (x86_64-unknown-linux-gnu, GTK+ Version 2.8.20)
 of 2007-10-08 on nyc-qws-005
 '-with-gtk' '-with-gif=no'

after editing an emacsclient file, I type C-x # and the frame is being
deleted:


Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 47273860790064 (LWP 543)]
0x000000320a86d44b in free () from /lib64/libc.so.6
(gdb) where
#0  0x000000320a86d44b in free () from /lib64/libc.so.6
#1  0x0000000000511ff3 in emacs_blocked_free (ptr=0x2e9a465000000, 
ptr2=Variable "ptr2" is not available.
)
    at alloc.c:1216
#2  0x000000320a86d437 in free () from /lib64/libc.so.6
#3  0x000000000050d6d8 in xfree (block=Variable "block" is not available.
) at alloc.c:804
#4  0x0000000000412c0d in free_glyph_matrix (matrix=0x2e9a435) at dispnew.c:567
#5  0x00000000004136ee in free_glyphs (f=0x2a2f860) at dispnew.c:2525
#6  0x000000000041fbd6 in Fdelete_frame (frame=44234852, force=Variable "force" 
is not available.
)
    at frame.c:1502
#7  0x000000000052625b in Ffuncall (nargs=Variable "nargs" is not available.
) at eval.c:3039
#8  0x0000000000551f3b in Fbyte_code (bytestr=Variable "bytestr" is not 
available.
) at bytecode.c:679
#9  0x0000000000525d48 in funcall_lambda (fun=7960604, nargs=1,
    arg_vector=0x7fffdd221178) at eval.c:3223
#10 0x00000000005260f6 in Ffuncall (nargs=Variable "nargs" is not available.
) at eval.c:3093
#11 0x0000000000551f3b in Fbyte_code (bytestr=Variable "bytestr" is not 
available.
) at bytecode.c:679
#12 0x0000000000525d48 in funcall_lambda (fun=39212228, nargs=1,
    arg_vector=0x7fffdd221348) at eval.c:3223
#13 0x00000000005260f6 in Ffuncall (nargs=Variable "nargs" is not available.
) at eval.c:3093
#14 0x00000000005233bf in Fcall_interactively (function=39209889,
    record_flag=9439633, keys=59630292) at callint.c:841
#15 0x00000000004bd47a in Fcommand_execute (cmd=39209889, record_flag=9439633,
    keys=59630292, special=Variable "special" is not available.
) at keyboard.c:10333
#16 0x00000000004c6250 in read_char (commandflag=1, nmaps=2,
    maps=0x7fffdd2218a0, prev_event=9439633, used_mouse_menu=0x7fffdd2219a0,
    end_time=0x0) at keyboard.c:3189
#17 0x00000000004c8902 in read_key_sequence (keybuf=0x7fffdd221a10,
    bufsize=30, prompt=9439633, dont_downcase_last=0,
    can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9382
#18 0x00000000004ca610 in command_loop_1 () at keyboard.c:1689
#19 0x0000000000524b87 in internal_condition_case (
    bfun=0x4ca470 <command_loop_1>, handlers=9554609,
    hfun=0x4c4590 <cmd_error>) at eval.c:1494
#20 0x00000000004c394a in command_loop_2 () at keyboard.c:1403
#21 0x0000000000524c77 in internal_catch (tag=Variable "tag" is not available.
) at eval.c:1229
#22 0x00000000004c43d3 in command_loop () at keyboard.c:1382
#23 0x00000000004c476c in recursive_edit_1 () at keyboard.c:991
#24 0x00000000004c48d1 in Frecursive_edit () at keyboard.c:1053
#25 0x00000000004b8ae5 in main (argc=2, argv=0x7fffdd2222b8) at emacs.c:1778

Lisp Backtrace:
"delete-frame" (0xdd220fe8)
"handle-delete-frame" (0xdd221178)
"dframe-handle-delete-frame" (0xdd221348)
"call-interactively" (0xdd221508)
(gdb) up
#1  0x0000000000511ff3 in emacs_blocked_free (ptr=0x2e9a465000000, 
ptr2=Variable "ptr2" is not available.
)
    at alloc.c:1216
1216      free (ptr);
(gdb) list
1211            }
1212        }
1213    #endif /* GC_MALLOC_CHECK */
1214
1215      __free_hook = old_free_hook;
1216      free (ptr);
1217
1218      /* If we released our reserve (due to running out of memory),
1219         and we have a fair amount free once again,
1220         try to set aside another reserve in case we run out once more.  */
(gdb) p *ptr
Attempt to dereference a generic pointer.
(gdb) p *(char*)ptr
Cannot access memory at address 0x2e9a465000000
(gdb) up
#2  0x000000320a86d437 in free () from /lib64/libc.so.6
(gdb)
#3  0x000000000050d6d8 in xfree (block=Variable "block" is not available.
) at alloc.c:804
804       free (block);
(gdb)
#4  0x0000000000412c0d in free_glyph_matrix (matrix=0x2e9a435) at dispnew.c:567
567           xfree (matrix->rows);
(gdb) p matrix
$1 = (struct glyph_matrix *) 0x2e9a435
(gdb) p *matrix
$2 = {
  pool = 0x2e9a455000000,
  rows = 0x2e9a465000000,
  rows_allocated = -1862270976,
  nrows = 36873,
  matrix_x = -251658240,
  matrix_y = 36873,
  matrix_w = -1862270976,
  matrix_h = 36873,
  window_left_col = -2063597568,
  window_top_line = 190884,
  window_height = 620756992,
  window_width = 191519,
  window_vscroll = -1862270976,
  left_margin_glyphs = 38013,
  right_margin_glyphs = 1090519040,
  no_scrolling_p = 0,
  header_line_p = 1,
  method = 
"\224\000\000\000\000\000\341~\002\003\000\000\000\000\245\244\351\002\000\000\000\000\225\246\351\002\000\000\000\000\265\246\351\002\000\000\000\000q\263\232\000\000\000\000\000\221\t\220\000\000\000\000\000\221\f\220\000\000\000\000\000\325\244\351\002\000\000\000\000a\264\232\000\000\000\000\000\345\244\351\002\000\000\000\000A\317\311\000\000\000\000\000\365\244\351\002\000\000\000\000\221\f\220\000\000\000\000\000\305/\354\002\000\000\000\000\241\206\225\000\000\000\000\000\025\245\351\002\000\000\000\000!\n\220\000\000\000\000\000%\245\351\002\000\000\000\000\361\t\220\000\000\000\000\000\221\t\220\000\000\000\000\000\205\247\351\002\000\000\000\000\305\244\351\002\000\000\000\000\221\f\220\000\000\000\000\000U\245\351\002\000\000\000\000\261\262"...,
  buffer = 0x9009f1000000,
  begv = -1862270976,
  zv = 36873
}
(gdb) u[
Function "" not defined.
(gdb) up
#5  0x00000000004136ee in free_glyphs (f=0x2a2f860) at dispnew.c:2525
2525              free_glyph_matrix (w->desired_matrix);
(gdb) p *w
$3 = {
  size = 59803972,
  vec_next = 0x900991,
  frame = 36453658,
  mini_p = 48866069,
  next = 9440401,
  prev = 48865957,
  hchild = 13225697,
  vchild = 48865973,
  parent = 9799329,
  left_col = 48865989,
  top_line = 9439729,
  total_lines = 9439633,
  total_cols = 9799329,
  buffer = 48866053,
  start = 9439729,
  pointm = 9439633,
  force_start = 10515281,
  optional_new_start = 48866021,
  hscroll = 9439729,
  min_hscroll = 9439633,
  use_time = 36453698,
  sequence_number = 48866085,
  temslot = 9439633,
  last_modified = 48866213,
  last_overlay_modified = 9440401,
  last_point = 48866117,
  last_had_star = 13225697,
  vertical_scroll_bar = 48866133,
  left_margin_cols = 9799329,
  right_margin_cols = 48866149,
  left_fringe_width = 9439729,
  right_fringe_width = 9439633,
  fringes_outside_margins = 27845747,
  scroll_bar_width = 299688,
  vertical_scroll_bar_type = 9799329,
  last_mark_x = 48866197,
  last_mark_y = 9439729,
  window_end_pos = 9439633,
  window_end_vpos = 9439633,
  window_end_valid = 44338324,
  update_mode_line = 36453738,
  start_at_line_beg = 48878085,
  display_table = 9440401,
  dedicated = 48866261,
  base_line_number = 13225697,
  base_line_pos = 48877845,
  region_showing = 0,
  column_number_displayed = 48877568,
  redisplay_end_trigger = 7237378198091428961,
  too_small_ok = 48863232,
  orig_total_lines = 9439633,
  orig_top_line = 9439633,
  current_matrix = 0xc9cf41,
  desired_matrix = 0x2e9a435,
  nrows_scale_factor = 10141713,
  ncols_scale_factor = 0,
  last_cursor = {
    x = 48866373,
    y = 0,
    hpos = 9799329,
    vpos = 0
  },
  cursor = {
    x = 48866389,
    y = 0,
---Type <return> to continue, or q <return> to quit---
    hpos = 48866405,
    vpos = 0
  },
  phys_cursor = {
    x = 9439633,
    y = 0,
    hpos = 9439729,
    vpos = 0
  },
  phys_cursor_type = 9439633,
  phys_cursor_width = 0,
  phys_cursor_ascent = 48866437,
  phys_cursor_height = 0,
  phys_cursor_on_p = 1,
  cursor_off_p = 0,
  last_cursor_off_p = 1,
  must_be_updated_p = 0,
  pseudo_window_p = 0,
  vscroll = 0,
  window_end_bytepos = 9731473,
  frozen_window_start_p = 0
}
(gdb) up
#6  0x000000000041fbd6 in Fdelete_frame (frame=44234852, force=Variable "force" 
is not available.
)
    at frame.c:1502
1502      free_glyphs (f);
(gdb) p *f
$4 = {
  size = 4611686018427388949,
  next = 0x38bf190,
  name = 59940595,
  icon_name = 9439633,
  title = 9439633,
  focus_frame = 9439633,
  root_window = 44338324,
  selected_window = 44338324,
  minibuffer_window = 47650292,
  param_alist = 54540805,
  scroll_bars = 59117812,
  condemned_scroll_bars = 9439633,
  menu_bar_items = 48493748,
  face_alist = 60291797,
  menu_bar_vector = 66567348,
  buffer_predicate = 9439633,
  buffer_list = 49799957,
  buried_buffer_list = 9439633,
  menu_bar_window = 48865909,
  tool_bar_window = 9439633,
  tool_bar_items = 9439633,
  desired_tool_bar_string = 9439633,
  current_tool_bar_string = 9439633,
  face_cache = 0x22b70c0,
  menu_bar_items_used = 0,
  namebuf = 0x0,
  current_pool = 0x0,
  desired_pool = 0x0,
  desired_matrix = 0x0,
  current_matrix = 0x0,
  glyphs_initialized_p = 0,
  external_tool_bar = 0,
  tool_bar_lines = 0,
  n_tool_bar_rows = 0,
  n_tool_bar_items = 0,
  decode_mode_spec_buffer = 0x39019f0 '-' <repeats 200 times>...,
  insert_line_cost = 0x0,
  delete_line_cost = 0x0,
  insert_n_lines_cost = 0x0,
  delete_n_lines_cost = 0x0,
  text_lines = 90,
  text_cols = 79,
  total_lines = 0,
  total_cols = 85,
  new_text_lines = 0,
  new_text_cols = 0,
  left_pos = 252,
  top_pos = 2,
  pixel_height = 1195,
  pixel_width = 510,
  x_pixels_diff = 4,
  y_pixels_diff = 46,
  win_gravity = 1,
  size_hint_flags = 8,
  border_width = 0,
  internal_border_width = 0,
  column_width = 6,
  space_width = 6,
  line_height = 13,
  output_method = output_x_window,
  terminal = 0xdfd130,
  output_data = {
    tty = 0x3912230,
    x = 0x3912230,
    w32 = 0x3912230,
---Type <return> to continue, or q <return> to quit---
    mac = 0x3912230,
    nothing = 59843120
  },
  fringe_cols = 3,
  left_fringe_width = 9,
  right_fringe_width = 9,
  want_fullscreen = 0,
  menu_bar_lines = 0,
  external_menu_bar = 1,
  display_preempted = 0 '\0',
  visible = 1 '\001',
  iconified = 0 '\0',
  async_visible = 1 '\001',
  async_iconified = 0 '\0',
  garbaged = 0 '\0',
  has_minibuffer = 1 '\001',
  wants_modeline = 1 '\001',
  can_have_scroll_bars = 1 '\001',
  vertical_scroll_bar_type = vertical_scroll_bar_left,
  desired_cursor = BAR_CURSOR,
  cursor_width = 2,
  blink_off_cursor = DEFAULT_CURSOR,
  blink_off_cursor_width = 0,
  auto_raise = 0 '\0',
  auto_lower = 0 '\0',
  no_split = 0 '\0',
  explicit_name = 0 '\0',
  window_sizes_changed = 0 '\0',
  message_buf = 0x235f160 "\340:\244\n2",
  scroll_bottom_vpos = -1,
  config_scroll_bar_width = 16,
  config_scroll_bar_cols = 3,
  scroll_bar_actual_width = 18,
  cost_calculation_baud_rate = 19200,
  mouse_moved = 1 '\001',
  gamma = 0,
  extra_line_spacing = 0,
  resized_p = 0,
  force_flush_display_p = 0,
  background_pixel = 13882323,
  foreground_pixel = 4734347,
  default_face_done_p = 1,
  already_hscrolled_p = 0,
  updated_p = 1,
  minimize_tool_bar_window_p = 0
}
(gdb) c
Continuing.
Fatal error (11)
Program received signal SIGSEGV, Segmentation fault.
0x000000320a82f2a7 in kill () from /lib64/libc.so.6



-- 
Sam Steingold (http://sds.podval.org/) on Fedora Core release 5 (Bordeaux)
http://pmw.org.il http://iris.org.il http://mideasttruth.com
http://israelunderattack.slide.com http://jihadwatch.org http://memri.org
Shady characters are often very bright.