segfault when using XIM with multi-tty on gnu/linux

[David Smith]

This is with git commit 36d10c7d (Aug 13, 2008).

Steps to reproduce:
 1. start emacs -nw
 2. have XIM active for your X session (run scim -d)
 3. start X11-capable emacs frame with emacsclient -c
 4. close the X11 emacs frame
 5. segfault with error

*** glibc detected *** /usr/bin/emacs: corrupted double-linked list: 0x083afdf0 
***
 
Backtrace:
#0  0xb78575c0 in _XSend () from /usr/lib/libX11.so.6
#1  0xb7857792 in _XFlush () from /usr/lib/libX11.so.6
#2  0xb7830a91 in XFlush () from /usr/lib/libX11.so.6
#3  0xb7882160 in ?? () from /usr/lib/libX11.so.6
#4  0xb78818d2 in _XimFlush () from /usr/lib/libX11.so.6
#5  0xb7872618 in ?? () from /usr/lib/libX11.so.6
#6  0xb785d134 in XCloseIM () from /usr/lib/libX11.so.6
#7  0x080d34ed in x_delete_display (dpyinfo=0x942dba0) at xterm.c:8315
#8  0x080d35ea in x_delete_terminal (terminal=0x942dd58) at xterm.c:10650
#9  0x080ca538 in Fdelete_terminal (terminal=155376988, force=137841993) at 
terminal.c:334
#10 0x08063e0f in Fdelete_frame (frame=155892172, force=137841993) at 
frame.c:1512
#11 0x08180d4d in Ffuncall (nargs=1, args=0xbf808ee0) at eval.c:3045
#12 0x0817de71 in Fcall_interactively (function=137877289, 
record_flag=137841945, keys=137880348) at callint.c:857
#13 0x08180d34 in Ffuncall (nargs=4, args=0xbf809090) at eval.c:3048
#14 0x08180e89 in call3 (fn=138006169, arg1=137877289, arg2=137841945, 
arg3=137841945) at eval.c:2872
#15 0x0812743e in command_loop_1 () at keyboard.c:1879
#16 0x0817f5d0 in internal_condition_case (bfun=0x81270e0 <command_loop_1>, 
handlers=137885153,
    hfun=0x8122060 <cmd_error>) at eval.c:1511
#17 0x08121473 in command_loop_2 () at keyboard.c:1338
#18 0x0817f6aa in internal_catch (tag=137881129, func=0x8121450 
<command_loop_2>, arg=137841945) at eval.c:1247
#19 0x08121ec7 in command_loop () at keyboard.c:1317
#20 0x0812223b in recursive_edit_1 () at keyboard.c:942
#21 0x08122371 in Frecursive_edit () at keyboard.c:1004
#22 0x08116ffc in main (argc=2, argv=0xbf809744) at emacs.c:1689

Analysis:

 Is the call to XCloseIM() in xim_close_dpy (xterm.c:8316) necessary?
 Since if we HAVE_X11R6_XIM, xim_destroy_callback is called, and it
 claims there is no need to call XCloseIM (xterm.c:8143). A small patch
 is attached that changes the logic of xim_close_dpy slightly to call
 XCloseIM iff HAVE_XIM && !HAVE_X11R6_XIM. This fixes the segfault here.

Cheers,
- dds

0001-Prevent-double-free-segfault-when-using-XIM-and-mult.patch
Description: prevent double free segfault when using XIM and multi-tty

pgpTRkTNaWrhA.pgp
Description: PGP signature