bug#75199: 30.0.93; Emacs crashes when completing with corfu

[Zhengyi Fu]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Zhengyi Fu <i@fuzy.me>
>> Date: Mon, 30 Dec 2024 21:02:59 +0800
>> 
>> Emacs built without Cairo steadily crashes when trying to complete
>> symbols with Corfu.
>> 
>> Steps to reproduce:
>> 
>> 1. emacs -Q -l path/to/corfu.el
>> 2. M-x corfu-mode
>> 3. Try completing a simple by pressing C-M-i
>> 
>> I got the following backtrace from GDB by reproducing the bug after
>> evaluating (x-synchronize t):
>> 
>> (gdb) br x_error_quitter
>> Breakpoint 1 at 0x550530: file xterm.c, line 27111.
>> (gdb) r
>> Starting program: /home/zhengyi/src/emacs/src/emacs -Q -l 
>> \~/.emacs.d/straight/repos/corfu/corfu.el
>> [Thread debugging using libthread_db enabled]
>> Using host libthread_db library "/lib64/libthread_db.so.1".
>> [New Thread 0x7ffff13fe6c0 (LWP 15400)]
>> [New Thread 0x7ffff0a6e6c0 (LWP 15401)]
>> [New Thread 0x7fffebfff6c0 (LWP 15402)]
>> [New Thread 0x7fffeb66f6c0 (LWP 15403)]
>> 
>> Thread 1 "emacs" hit Breakpoint 1, x_error_quitter (display=0xe19910, 
>> event=0x0) at xterm.c:27111
>> 27111          if (event->error_code == BadName)
>> (gdb) bt full
>> #0  x_error_quitter (display=0xe19910, event=0x0) at xterm.c:27111
>>      buf = '\000' <repeats 255 times>
>>      buf1 = '\000' <repeats 272 times>...
>> #1  0x000000000055076b in x_error_handler (display=0xe19910, 
>> event=0x7fffffffba70) at xterm.c:27090
>>      stack = <optimized out>
>>      dpyinfo = <optimized out>
>>      fail = <optimized out>
>>      last = <optimized out>
>
> I don't understand how 'event', which was 0x7fffffffba70 in
> x_error_handler became a NULL pointer inside x_error_quitter, which
> x_error_handler calls.
>
> Po Lu, any ideas?
>
> Zhengyi Fu, can you configure Emacs 30.0.93 with --enable-checking and
> compile it with -O0, and see if you get more detailed diagnostics?
>
> Also, does disabling the X input method help in any way?  (I see you
> are using fcitx.)

This the backtrace I got after rebuilding Emacs with --enable-checking
and -O0 and disabling fcitx:


(gdb) r
Starting program: /home/zhengyi/src/emacs/src/emacs -Q -l 
\~/.emacs.d/straight/repos/corfu/corfu.el
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7ffff1bfe6c0 (LWP 58332)]
[New Thread 0x7ffff126e6c0 (LWP 58333)]
[New Thread 0x7fffebfff6c0 (LWP 58334)]
[New Thread 0x7fffeb66f6c0 (LWP 58335)]
[Detaching after vfork from child process 58338]
[Detaching after vfork from child process 58343]
[Detaching after vfork from child process 58350]
[Detaching after vfork from child process 58351]
[Detaching after vfork from child process 58352]
[Detaching after vfork from child process 58353]
[Detaching after vfork from child process 58357]
[Detaching after vfork from child process 58361]
[Detaching after vfork from child process 58366]
[Detaching after vfork from child process 58370]
[Detaching after vfork from child process 58374]
[Detaching after vfork from child process 58379]

Thread 1 "emacs" hit Breakpoint 1, x_error_quitter (display=0x104d5d0, 
event=0x7fffffffb8c0) at xterm.c:27111
27111     if (event->error_code == BadName)
(gdb) bt full
#0  x_error_quitter (display=0x104d5d0, event=0x7fffffffb8c0) at xterm.c:27111
        buf = '\000' <repeats 16 times>, 
"P\267\377\377\377\177\000\000\001\000\000\000\000\000\000\000\240\267\377\377\377\177",
 '\000' <repeats 26 times>, "\001\001. \000\000\000\000 ", '\000' <repeats 15 
times>, "/#\305\367\377\177\000\000d\372\004\001\000\000\000\000 ", '\000' 
<repeats 15 times>, "\300\n\005\001", '\000' <repeats 12 times>, 
"\362\321\361\363\377\177\000\000d\372\004\001\000\000\000\000\000-cYwQ6n\240\271\377\377\377\177\000\000\001\000\000\000\000\000\000\000\360\371\004\001",
 '\000' <repeats 20 times>...
        buf1 = 
"p\350\004\001\000\000\000\000\300\n\005\001\000\000\000\000\360\371\004\001\000\000\000\000\377\377\377\377\377\377\377\377d\372\004\001\000\000\000\000\000\020",
 '\000' <repeats 22 times>, " 
\264\377\377\377\177\000\000\001\000\000\000\000\000\000\000p\264\377\377\377\177\000\000P",
 '\000' <repeats 15 times>, "\301\031\305\367\377\177\000\000 
\v\005\001\000\000\000\000\360\371\004\001\000\000\000\000$ 
\000\000\000\000\000\000\260\265\377\377\377\177\000\000д\377\377\377\177\000\000\201\035\305\367\377\177\000\000\360\264\377\377\377\177\000\000\277.\305\367\377\177\000\000
 
\265\377\377\377\177\000\000\b\372\004\001\000\000\000\000\002\000\000\000\000\000\000\000\000"...
#1  0x00000000005d32de in x_error_handler (display=0x104d5d0, 
event=0x7fffffffb8c0) at xterm.c:27090
        stack = 0x0
        dpyinfo = 0x105f4d0
        fail = 0x0
        last = 0x104d5d0
#2  0x00007ffff7cc047b in _XError () at /lib64/libX11.so.6
#3  0x00007ffff7cc0577 in ??? () at /lib64/libX11.so.6
#4  0x00007ffff7cc062d in ??? () at /lib64/libX11.so.6
#5  0x00007ffff7cc22dd in _XReply () at /lib64/libX11.so.6
#6  0x00007ffff7cc265b in XSync () at /lib64/libX11.so.6
#7  0x00007ffff7cc26fb in ??? () at /lib64/libX11.so.6
#8  0x00007ffff7c9ae83 in XCreatePixmap () at /lib64/libX11.so.6
#9  0x00007ffff7c9f10b in XCreatePixmapFromBitmapData () at /lib64/libX11.so.6
#10 0x00000000005acef7 in x_draw_fringe_bitmap (w=0x1bf5f80, row=0x1c3c060, 
p=0x7fffffffbe60) at xterm.c:7993
        clipmask = 0
        image_rect = {x = 1, y = 18, width = 8, height = 0}
        px = 0
        pixmap = 4785737
        gcv = {function = -227767256, plane_mask = 140737488338224, foreground 
= 7102373, background = 140737260588072, line_width = -17072, line_style = 
32767, cap_style = 7102479, join_style = 0, fill_style = 7092985, fill_rule = 
0, arc_mode = -227767256, tile = 140737488338560, stipple = 7114578, 
ts_x_origin = 0, ts_y_origin = 0, font = 0, subwindow_mode = 15924032, 
graphics_exposures = 0, clip_x_origin = 0, clip_y_origin = 0, clip_mask = 
15924080, dash_offset = 48, dashes = 10 '\n'}
        bg = {pixel = 4769435, red = 46245, green = 433, blue = 0, flags = 0 
'\000', pad = 0 '\000'}
        picture = 0
        attrs = {repeat = 0, alpha_map = 0, alpha_x_origin = 0, alpha_y_origin 
= 0, clip_x_origin = 0, clip_y_origin = 0, clip_mask = 0, graphics_exposures = 
0, subwindow_mode = 0, poly_edge = 0, poly_mode = 0, dither = 0, 
component_alpha = 0}
        py = 0
        drawable = 13631756
        bits = 0x1bf4120 ""
        depth = 32
        background = 4290834431
        dest = {x = 1, y = 18, width = 8, height = 0}
        pwidth = 8
        pheight = 0
        f = 0x1b1b4a0
        display = 0x104d5d0
        gc = 0x1ad5840
        face = 0x101b720
        clip_rect = {x = 1, y = 1, width = 256, height = 35}
#11 0x00000000007d4009 in draw_fringe_bitmap_1 (w=0x1bf5f80, row=0x1c3c060, 
left_p=1, overlay=0, which=26) at fringe.c:711
        f = 0x1b1b4a0
        p = {which = 26, bits = 0x1bf4120, wd = 8, h = 0, dh = 0, x = 1, y = 
18, bx = 1, nx = 8, by = 1, ny = 35, cursor_p = false, overlay_p = false, face 
= 0x101b720}
        fb = 0x1bf4110
        period = 0
        face_id = 21
        offset = 0
        header_line_height = 0
#12 0x00000000007d471d in draw_fringe_bitmap (w=0x1bf5f80, row=0x1c3c060, 
left_p=1) at fringe.c:880
        overlay = 0
#13 0x00000000007d4829 in draw_row_fringe_bitmaps (w=0x1bf5f80, row=0x1c3c060) 
at fringe.c:901
#14 0x00000000007d4a6e in draw_window_fringes (w=0x1bf5f80, no_fringe_p=true) 
at fringe.c:949
        row = 0x1c3c060
        yb = 350
        nrows = 18
        y = 0
        rn = 0
        updated_p = false
        window_buffer = 0xfe567d
        oldbuf = 0x7ffff2856418
#15 0x000000000046dcad in gui_update_window_end (w=0x1bf5f80, cursor_on_p=true, 
mouse_face_overwritten_p=false) at dispnew.c:3948
        f = 0x1b1b4a0
#16 0x000000000046da27 in update_window (w=0x1bf5f80, force_p=true) at 
dispnew.c:3869
        end = 0x1af1820
        tab_line_row = 0x0
        mouse_face_overwritten_p = false
        n_updated = 0
        mode_line_row = 0x1af1820
        changed_p = true
        invisible_rows_marked = true
        row = 0x1af1820
        header_line_row = 0x0
        yb = 350
        desired_matrix = 0x1b191e0
        paused_p = false
        preempt_count = 9
        rif = 0x8df2a0 <x_redisplay_interface>
#17 0x000000000046cc71 in update_window_tree (w=0x1bf5f80, force_p=true) at 
dispnew.c:3491
        paused_p = false
#18 0x000000000046c61b in update_frame (f=0x1b1b4a0, force_p=true, 
inhibit_hairy_id_p=false) at dispnew.c:3326
        paused_p = false
        root_window = 0x1bf5f80
#19 0x00000000004c51b1 in redisplay_internal () at xdisp.c:17468
        gcscrollbars = true
        f_redisplay_flag = true
        f = 0x1b1b4a0
        w = 0x11d1690
        sw = 0x11d1690
        fr = 0x11d13e0
        pending = false
        must_finish = false
        match_p = true
        tlbufpos = {charpos = 180, bytepos = 184}
        tlendpos = {charpos = 0, bytepos = 0}
        number_of_visible_frames = 2
        sf = 0x11d13e0
        polling_stopped_here = true
        tail = 0x1a17043
        frame = 0x1b1b4a5
        hscroll_retries = 0
        garbaged_frame_retries = 0
        consider_all_windows_p = true
        update_miniwindow_p = false
        count = {bytes = 128}
#20 0x00000000004c2bab in redisplay () at xdisp.c:16563
#21 0x0000000000616041 in read_char (commandflag=1, map=0x1ba88f3, 
prev_event=0x0, used_mouse_menu=0x7fffffffd9ef, end_time=0x0) at keyboard.c:2678
        echo_current = true
        c = 0x0
        local_getcjmp = {{__jmpbuf = {140737259281624, 140737259281667, 
140737488345056, 7102846, 48, 140737259281624, 15924032, 0}, __mask_was_saved = 
0, __saved_mask = {__val = {140737488345104, 6496078, 140737267083907, 
140737488345264, 6517891, 15924032, 0, 0, 140737488345168, 7233523, 26984432, 
140737488345264, 7277134, 29001987, 128, 140737488345264}}}}
        save_jump = {{__jmpbuf = {140737488344944, 7120998, 140737262216221, 
12658762781, 0, 44256, 140737488345136, 140737267219456}, __mask_was_saved = 
-226139107, __saved_mask = {__val = {746, 0, 44256, 15968288, 44256, 
140737488344944, 55850543136, 140737262216221, 140737488344960, 7101566, 
140737262216221, 140737488344992, 7101662, 7092985, 140737262216221, 
140737488345056}}}}
        tem = 0x1a77dd0
        save = 0x1ba88f3
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x104f640
        jmpcount = {bytes = 0}
#22 0x000000000062a235 in read_key_sequence (keybuf=0x7fffffffdc10, prompt=0x0, 
dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false, 
disable_text_conversion_p=false) at keyboard.c:10743
        interrupted_kboard = 0x104f640
        interrupted_frame = 0x11d13e0
        key = 0x30
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        new_binding = 0xba
        count = {bytes = 96}
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = 0x1ba88f3
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {parent = 0x7ffff24c7983, map = 0x7ffff24c7983, start = 0, end = 
0}
        keytran = {parent = 0x7ffff2cef743, map = 0x7ffff2cef743, start = 0, 
end = 0}
        indec = {parent = 0x7ffff24c7973, map = 0x7ffff24c7973, start = 0, end 
= 0}
        shift_translated = false
        delayed_switch_frame = 0x0
        original_uppercase = 0x0
        original_uppercase_position = -1
        disabled_conversion = false
        starting_buffer = 0x7ffff2856418
        fake_prefixed_keys = 0x0
        first_event = 0x0
        second_event = 0x0
#23 0x0000000000612514 in command_loop_1 () at keyboard.c:1429
        cmd = 0x7ffff175a428
        keybuf = {0x20000026, 0x16, 0x2ffffdca0, 0x0, 0x0, 0xb2b0, 
0x7ffff3e0b018, 0x7ffff2d1bc30, 0x0, 0xb2b0, 0x7ffff2856418, 0x0, 0x0, 0xf3adf0 
<lispsym+45744>, 0x6c3af9 <builtin_lisp_symbol+44>, 0x0, 0x7fffffffdd20, 
0x6ca866 <set_default_internal+914>, 0x7ffff285641d, 0x2006ed6c1, 0x0, 0xb2b0, 
0x7ffff2d1bc30, 0x7ffff2d1bc30, 0x0, 0x0, 0x7fffffffdd60, 0xb2b0, 0xf3adf0 
<lispsym+45744>, 0xb2b0}
        i = 1
        last_pt = 184
        prev_modiff = 110
        prev_buffer = 0x7ffff2856418
#24 0x00000000006eac73 in internal_condition_case (bfun=0x6120ef 
<command_loop_1>, handlers=0x90, hfun=0x6115f7 <cmd_error>) at eval.c:1613
        val = 0x60e5cf <builtin_lisp_symbol+44>
        c = 0x102b850
#25 0x0000000000611cf7 in command_loop_2 (handlers=0x90) at keyboard.c:1168
        val = 0x90
#26 0x00000000006ea0cb in internal_catch (tag=0x12270, func=0x611cd4 
<command_loop_2>, arg=0x90) at eval.c:1292
        val = 0x7fffffffdf20
        c = 0x102b710
#27 0x0000000000611c90 in command_loop () at keyboard.c:1146
#28 0x00000000006110d0 in recursive_edit_1 () at keyboard.c:754
        count = {bytes = 32}
        val = 0x6f02e8 <record_unwind_protect+114>
#29 0x00000000006112e3 in Frecursive_edit () at keyboard.c:837
        count = {bytes = 0}
        buffer = 0x0
#30 0x000000000060cf48 in main (argc=4, argv=0x7fffffffe238) at emacs.c:2635
        stack_bottom_variable = 0x53
        old_argc = 4
        dump_file = 0x0
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = true
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = 0x0
        sockfd = -1
        module_assertions = false
(gdb)