crash in bidi_pop_it during (idle) redisplay

[Ami Fischman]

>

Emacs 24.2 regularly crashes on me with the backtrace below.  I usually start it with "emacs --daemon" and then run one emacsclient on each of two X servers (a local one on :0 and a remote one through NX).  This setup will be up/stable for anywhere between an hour and a few days, and then the server aborts dumping core like this.  FWIW, emacs-version says:

GNU Emacs 24.2.1 (x86_64-unknown-linux-gnu, X toolkit, Xaw scroll bars) 

and I built it using this this configuration:

--with-x-toolkit=lucid --with-xpm --with-jpeg --with-tiff --with-gif --with-png --with-x --without-dbug --without-gconf

Possibly of note is that this happens when I'm not doing anything with emacs (usually I'll come back to one of my workstations and find the emacs process is gone and a corefile has shown up).  Both of the X servers in question are much longer lived than the emacs processes involved.

Cheers,

-a

(gdb) bt

#0  0x00007fa43b6f1707 in kill () at ../sysdeps/unix/syscall-template.S:82

#1  0x00000000004e93d2 in fatal_error_signal (sig=<optimized out>) at emacs.c:366

#2  <signal handler called>

#3  0x00007fa43b6f1707 in kill () at ../sysdeps/unix/syscall-template.S:82

#4  0x00000000004e7452 in abort () at emacs.c:394

#5  0x00000000004923b5 in bidi_pop_it (bidi_it=<optimized out>) at bidi.c:636

#6  0x0000000000447aa1 in pop_it (it=0x7fff2251f1e0) at xdisp.c:5769

#7  0x0000000000451f23 in next_overlay_string (it=0x7fff2251f1e0) at xdisp.c:5223

#8  0x0000000000426ff7 in set_iterator_to_next (it=0x7fff2251f1e0, reseat_p=<optimized out>) at xdisp.c:7188

#9  0x00000000004311ed in display_line (it=0x7fff2251f1e0) at xdisp.c:19519

#10 0x00000000004302d8 in try_window (window=<optimized out>, flags=1, pos=...) at xdisp.c:16137

#11 0x000000000044ae4a in redisplay_window (window=82406597, just_this_one_p=0) at xdisp.c:15662

#12 0x00000000004514e1 in redisplay_window_0 (window=9054) at xdisp.c:13748

#13 0x000000000055a046 in internal_condition_case_1 (bfun=0x4514c0 <redisplay_window_0>, arg=82406597, handlers=9957798, hfun=<optimized out>) at eval.c:1552

#14 0x0000000000448376 in redisplay_windows (window=<optimized out>) at xdisp.c:13728

#15 0x0000000000448385 in redisplay_windows (window=<optimized out>) at xdisp.c:13720

#16 0x000000000042d3d0 in redisplay_internal () at xdisp.c:13305

#17 0x000000000042fb64 in redisplay_preserve_echo_area (from_where=9054) at xdisp.c:13556

#18 0x00000000004f1a8a in detect_input_pending_run_timers (do_display=<optimized out>) at keyboard.c:10512

#19 0x0000000000596414 in wait_reading_process_output (time_limit=<optimized out>, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=9755602, wait_proc=0x0, just_wait_proc=<optimized out>) at process.c:4738

#20 0x00000000004f0954 in kbd_buffer_get_event (kbp=<optimized out>, end_time=<optimized out>, used_mouse_menu=0x7fff22528354, kbp=<optimized out>, end_time=<optimized out>) at keyboard.c:3855

#21 read_char (commandflag=<optimized out>, nmaps=9, maps=<optimized out>, prev_event=9755602, used_mouse_menu=0x7fff22528354, end_time=<optimized out>) at keyboard.c:2801

#22 0x00000000004ec170 in read_key_sequence (bufsize=30, keybuf=<optimized out>, prompt=<optimized out>, dont_downcase_last=<optimized out>, can_return_switch_frame=<optimized out>, fix_current_buffer=<optimized out>) at keyboard.c:9328

#23 0x00000000004ea909 in command_loop_1 () at keyboard.c:1449

#24 0x000000000055b680 in internal_condition_case (bfun=0x4ea490 <command_loop_1>, handlers=9807890, hfun=<optimized out>) at eval.c:1514

#25 0x00000000004fbf06 in command_loop_2 (ignore=<optimized out>) at keyboard.c:1160

#26 0x000000000055b0dc in internal_catch (tag=<optimized out>, func=0x4fbee0 <command_loop_2>, arg=9755602) at eval.c:1271

#27 0x00000000004e9c39 in command_loop () at keyboard.c:1139

#28 recursive_edit_1 () at keyboard.c:759

#29 0x00000000004e9d55 in Frecursive_edit () at keyboard.c:823

#30 0x00000000004e8acd in main (argc=<error reading variable: Cannot access memory at address 0x0>, argv=<optimized out>) at emacs.c:1715