bug#11081: 24.0.94; "emacsclient --create-frame" occasionally crashes daemon or causes daemon to hang

[Brad Town]

This bug report will be sent to the Bug-GNU-Emacs mailing list
and the GNU bug tracker at debbugs.gnu.org.  Please check that
the From: line contains a valid email address.  After a delay of up
to one day, you should receive an acknowledgement at that address.

Please write in English if possible, as the Emacs maintainers
usually do not have translators for other languages.

Please describe exactly what actions triggered the bug, and
the precise symptoms of the bug.  If you can, give a recipe
starting from `emacs -Q':

--- recipe ---
* Run /usr/local/bin/emacs -Q --daemon
* Repeat the following until hang or crash:
** Run /usr/local/bin/emacsclient --create-frame
** When the frame appears, C-x C-c to exit

gdb `bt full' output:

--- cut here ---
#0  0x00007fe6caa6b583 in __select_nocancel () at
../sysdeps/unix/syscall-template.S:82
No locals.
#1  0x00000000004ec561 in xg_select (max_fds=4, rfds=0x7fff3103bb40,
wfds=0x7fff3103bac0, efds=0x0, timeout=<optimized out>) at
xgselect.c:100
        all_rfds = {
          fds_bits = {8, 0 <repeats 15 times>}
        }
        all_wfds = {
          fds_bits = {0 <repeats 16 times>}
        }
        tmo = {
          tv_sec = 1332543996,
          tv_usec = 800572
        }
        tmop = 0x7fff3103bc30
        context = 0xe97a40
        have_wfds = 1
        n_gfds = <optimized out>
        our_tmo = 0
        retval = <optimized out>
        our_fds = <optimized out>
        i = <optimized out>
        nfds = <optimized out>
        tmo_in_millisec = -1
#2  0x00000000005b0e44 in wait_reading_process_output
(time_limit=<optimized out>, microsecs=<optimized out>, read_kbd=-1,
do_display=<optimized out>,
    wait_for_cell=<optimized out>, wait_proc=0x0, just_wait_proc=0) at
process.c:4608
        timeout_reduced_for_timers = 0
        channel = -514
        nfds = <optimized out>
        Available = {
          fds_bits = {8, 0 <repeats 15 times>}
        }
        Writeok = {
          fds_bits = {0 <repeats 16 times>}
        }
        check_write = 1
        check_delay = 0
        no_avail = 1
        xerrno = 2
        proc = <optimized out>
        timeout = {
          tv_sec = 99928,
          tv_usec = 160649
        }
        end_time = {
          tv_sec = 0,
          tv_usec = 0
        }
        wait_channel = -1
        got_some_input = 0
#3  0x000000000050735d in kbd_buffer_get_event (end_time=<optimized
out>, used_mouse_menu=<optimized out>, kbp=<optimized out>) at
keyboard.c:3853
        c = <optimized out>
        obj = <optimized out>
#4  read_char (commandflag=<optimized out>, nmaps=<optimized out>,
maps=<optimized out>, prev_event=<optimized out>,
used_mouse_menu=<optimized out>, end_time=0x0)
    at keyboard.c:2799
        kb = <optimized out>
        c = 11995778
        local_getcjmp = {{
            __jmpbuf = {11995778, 7083285557197970914, 1, 1, 12085424,
140734015717488, -7083456576088662558, 7083286322900934114},
            __mask_was_saved = 0,
            __saved_mask = {
              __val = {0, 1, 0, 11065426, 9585369, 11065416, 9893797,
0, 3120373890685015296, 111, 9893744, 9893749, 9893744, 0, 2,
11995778}
            }
          }}
        save_jump = {{
            __jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0},
            __mask_was_saved = 0,
            __saved_mask = {
              __val = {0 <repeats 16 times>}
            }
          }}
        key_already_recorded = 0
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 11995778
        also_record = 11995778
        reread = 0
        polling_stopped_here = 1
        orig_kboard = 0xb7d720
#5  0x0000000000509438 in read_key_sequence (keybuf=<optimized out>,
bufsize=<optimized out>, prompt=<optimized out>,
dont_downcase_last=<optimized out>,
    can_return_switch_frame=<optimized out>,
fix_current_buffer=<optimized out>) at keyboard.c:9326
        interrupted_kboard = 0xb7d720
        key = 1
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 32767
        keys_local_start = 0
        from_string = <optimized out>
        count = 2
        t = <optimized out>
        echo_start = <optimized out>
        keys_start = 0
        nmaps = <optimized out>
        nmaps_allocated = 2
        defs = 0x7fff3103c050
        submaps = <optimized out>
        orig_local_map = 17529222
        orig_keymap = 11995778
        localized_local_map = 0
        first_binding = <optimized out>
        first_unbound = <optimized out>
        mock_input = <optimized out>
        fkey = {
          parent = 12419798,
          map = 12419798,
          start = 0,
          end = 0
        }
        keytran = {
          parent = 11975078,
          map = 11975078,
          start = 0,
          end = 0
        }
        indec = {
          parent = 12419814,
          map = 12419814,
          start = 0,
          end = 0
        }
        shift_translated = 0
        delayed_switch_frame = 11995778
        original_uppercase = 11995778
        original_uppercase_position = -1
        starting_buffer = 0xb77790
        fake_prefixed_keys = 11995778
#6  0x000000000050b76b in command_loop_1 () at keyboard.c:1448
        cmd = 0
        keybuf = {140629218229288, 9192392, 4611686018427404288,
4611686018427389952, 0, 1, 140734015718320, 5712078, 140629320511784,
0, 140629320254704,
          140629320307912, 4233728, 140629218281056, 140629320511784,
0, 140629320254704, 140629320307912, 4232831, 140629218281056,
4214280, 4294967296, 0, 11995778, 64,
          12241542, 140734015719856, 4611686018427518976, 11995778, 5640642}
        i = 822331824
        prev_modiff = 0
        prev_buffer = 0x0
#7  0x00000000005740c1 in internal_condition_case (bfun=<optimized
out>, handlers=<optimized out>, hfun=<optimized out>) at eval.c:1515
        val = -514
        c = {
          tag = 11995778,
          val = 11995778,
          next = 0x7fff3103c570,
          gcpro = 0x0,
          jmp = {{
              __jmpbuf = {12712224, 7083285089474616802, 11995778,
140734015719856, 0, 1, -7083456572643041822, 7083286383632227810},
              __mask_was_saved = 0,
              __saved_mask = {
                __val = {140629320307912, 140734015718528, 4294967295,
140734015718568, 1, 8606112, 0, 0, 1, 0, 140629318338513, 1, 0, 0,
140629218252208, 0}
              }
            }},
          backlist = 0x0,
          handlerlist = 0x0,
          lisp_eval_depth = 0,
          pdlcount = 2,
          poll_suppress_count = 1,
          interrupt_input_blocked = 0,
          byte_stack = 0x0
        }
        h = {
          handler = 12047842,
          var = 11995778,
          chosen_clause = 11995778,
          tag = 0x7fff3103c400,
          next = 0x0
        }
#8  0x0000000000502f2e in command_loop_2 (ignore=<optimized out>) at
keyboard.c:1159
        val = -514
#9  0x00000000005741e8 in internal_catch (tag=<optimized out>,
func=<optimized out>, arg=<optimized out>) at eval.c:1272
        c = {
          tag = 12043634,
          val = 11995778,
          next = 0x0,
          gcpro = 0x0,
          jmp = {{
              __jmpbuf = {12712224, 7083285089474616802, 11995778,
140734015719856, 0, 1, -7083456572592710174, 7083286383603523042},
              __mask_was_saved = 0,
              __saved_mask = {
                __val = {0, 0, 0, 0, 624, 272, 22, 0, 0, 0,
140629221879360, 140734015720184, 344, 12221746, 5710197,
140734015719080}
              }
            }},
          backlist = 0x0,
          handlerlist = 0x0,
          lisp_eval_depth = 0,
          pdlcount = 2,
          poll_suppress_count = 1,
          interrupt_input_blocked = 0,
          byte_stack = 0x0
        }
#10 0x00000000005035fa in command_loop () at keyboard.c:1138
No locals.
#11 recursive_edit_1 () at keyboard.c:758
        val = <optimized out>
#12 0x000000000050370c in Frecursive_edit () at keyboard.c:822
        buffer = 11995778
#13 0x00000000004f7a40 in main (argc=0, argv=0x7fff3103caf8) at emacs.c:1715
        dummy = 140629320309128
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = <optimized out>
        skip_args = 1
        rlim = {
          rlim_cur = 8720000,
          rlim_max = 18446744073709551615
        }
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x7fff3103ca18 "M\254\232\312\346\177"
--- cut here ---

`xbacktrace' gives no output.

--- recipe ---

If Emacs crashed, and you have the Emacs process in the gdb debugger,
please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
For information about debugging Emacs, please read the file
/usr/local/share/emacs/24.0.94/etc/DEBUG.


In GNU Emacs 24.0.94.2 (x86_64-unknown-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2012-03-23 on torgo.mtv.corp.google.com
Windowing system distributor `The X.Org Foundation', version 11.0.10706000
Configured using:
 `configure '--with-x-toolkit=lucid''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: en_US.UTF-8
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: en_US.UTF-8
  value of $LC_NUMERIC: en_US.UTF-8
  value of $LC_TIME: en_US.UTF-8
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
C-x C-c M-x r e p o r t - <tab> <return>

Recent messages:
("/usr/local/bin/emacs")
Starting Emacs daemon.
When done with this frame, type C-x 5 0
(No files need saving)
When done with this frame, type C-x 5 0

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr emacsbug message format-spec rfc822 mml
easymenu mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail regexp-opt rfc2047 rfc2045
ietf-drums mm-util mail-prsvr mail-utils server time-date tooltip
ediff-hook vc-hooks lisp-float-type mwheel x-win x-dnd tool-bar dnd
fontset image fringe lisp-mode register page menu-bar rfn-eshadow timer
select scroll-bar mouse jit-lock font-lock syntax facemenu font-core
frame cham georgian utf-8-lang misc-lang vietnamese tibetan thai
tai-viet lao korean japanese hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese case-table epa-hook jka-cmpr-hook help
simple abbrev minibuffer loaddefs button faces cus-face files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote make-network-process
dbusbind dynamic-setting system-font-setting font-render-setting
x-toolkit x multi-tty emacs)