bug#12814: 24.3.50; Emacs crash in event_to_kboard at keyboard.c:3421

[Tassilo Horn]

Tassilo Horn <thorn@fastmail.fm> writes:

> Over the last days (I update my emacs copy daily), I had a few emacs
> crashes.  I think, it always crashed when I hit M-DEL (or at least
> DEL), but not every such keystroke crashes emacs.

The crash occured again.  This time, I think it was during "normal"
typing, i.e., no DEL.  The (almost identical) backtrace is attached.

Program received signal SIGSEGV, Segmentation fault.
0x0000000000544498 in event_to_kboard (event=0xbe9ee0 <kbd_buffer+189056>)
    at keyboard.c:3421
warning: Source file is more recent than executable.
3421      if (WINDOWP (obj))
(gdb) bt full
#0  0x0000000000544498 in event_to_kboard (event=0xbe9ee0 <kbd_buffer+189056>)
    at keyboard.c:3421
        obj = 23475429
#1  0x0000000000544fb1 in kbd_buffer_get_event (kbp=0x7ffffb338fa0, 
    used_mouse_menu=0x7ffffb339577, end_time=0x0) at keyboard.c:3823
        event = 0xbe9ee0 <kbd_buffer+189056>
        obj = 432488194
#2  0x0000000000542b81 in read_char (commandflag=1, nmaps=9, 
maps=0x7ffffb339350, 
    prev_event=12766914, used_mouse_menu=0x7ffffb339577, end_time=0x0)
    at keyboard.c:2768
        kb = 0x7ffffb338fd0
        c = 12766914
        jmpcount = 2
        local_getcjmp = {{
            __jmpbuf = {0, -1730894225911923910, 4290928, 140737407852208, 0, 
0, 
              -1730894225194697926, 1730884259209591610}, 
            __mask_was_saved = 0, 
            __saved_mask = {
              __val = {6569541, 12766914, 127802357, 12799762, 4248, 
                140737407849248, 6062330, 12766914, 33490614, 12766914, 
33602934, 
                140737407848896, 6119764, 0, 12766914, 127802352}
            }
          }}
        save_jump = {{
            __jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, 
            __mask_was_saved = 0, 
            __saved_mask = {
              __val = {0 <repeats 16 times>}
---Type <return> to continue, or q <return> to quit---
            }
          }}
        tem = 33984598
        save = 140737407849136
        previous_echo_area_message = 12766914
        also_record = 12766914
        reread = false
        gcpro1 = {
          next = 0x7ffffb339000, 
          var = 0x63eba3 <find_interval+117>, 
          nvars = 95637904
        }
        gcpro2 = {
          next = 0x7ffffb339490, 
          var = 0x5b35190, 
          nvars = 72057594037927939
        }
        polling_stopped_here = true
        orig_kboard = 0x1b72860
#3  0x000000000054f630 in read_key_sequence (keybuf=0x7ffffb3397f0, bufsize=30, 
    prompt=12766914, dont_downcase_last=false, can_return_switch_frame=true, 
    fix_current_buffer=true) at keyboard.c:9223
        interrupted_kboard = 0x1b72860
        interrupted_frame = 0x1234170
        key = 40
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
---Type <return> to continue, or q <return> to quit---
        keys_local_start = 0
        local_first_binding = 0
        from_string = 12766914
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 9
        nmaps_allocated = 9
        defs = 0x7ffffb3392f0
        submaps = 0x7ffffb339350
        orig_local_map = 35189862
        orig_keymap = 12766914
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
          parent = 19820790, 
          map = 19820790, 
          start = 0, 
          end = 0
        }
        keytran = {
          parent = 12746166, 
          map = 12746166, 
          start = 0, 
          end = 0
---Type <return> to continue, or q <return> to quit---
        }
        indec = {
          parent = 19820774, 
          map = 19820774, 
          start = 0, 
          end = 0
        }
        shift_translated = false
        delayed_switch_frame = 12766914
        original_uppercase = 127802352
        original_uppercase_position = -1
        dummyflag = false
        starting_buffer = 0x79e1bf0
        fake_prefixed_keys = 12766914
        gcpro1 = {
          next = 0x0, 
          var = 0x79e1bf5, 
          nvars = 12953202
        }
#4  0x0000000000540108 in command_loop_1 () at keyboard.c:1458
        cmd = 16198018
        keybuf = {508, 428, 108, 140737407850752, 12766962, 92661894, 
          4316442132495, 27990208, 27714976, 728, 140737407850592, 9345238, 
          12818658, 19087728, 140737407850640, 5167821, 1, 6973741, 
          140737407850192, 12766914, 12766914, 9345249, 140737407850720, 
5503309, 
          140737407850752, 92661894, 12766914, 19087728, 140737407850720, 0}
        i = 1
        prev_modiff = 2493
---Type <return> to continue, or q <return> to quit---
        prev_buffer = 0x79e1bf0
        already_adjusted = false
#5  0x00000000005d7aef in internal_condition_case (bfun=0x53fd21 
<command_loop_1>, 
    handlers=12818562, hfun=0x53f622 <cmd_error>) at eval.c:1288
        val = 1
        c = {
          tag = 12766914, 
          val = 12766914, 
          next = 0x7ffffb339b30, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {0, -1730894225643488454, 4290928, 140737407852208, 0, 
0, 
                -1730894225523950790, 1730884200964209466}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {1730884200964209466, 0, 139913602980736, 4294967295, 
0, 
                  9290408, 0, 0, 0, 0, 139913699142148, 1, 0, 1, 
139913599122032, 0}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
        h = {
---Type <return> to continue, or q <return> to quit---
          handler = 12818562, 
          var = 12766914, 
          chosen_clause = 12766962, 
          tag = 0x7ffffb3399b0, 
          next = 0x0
        }
#6  0x000000000053fa3a in command_loop_2 (ignore=12766914) at keyboard.c:1167
        val = 0
#7  0x00000000005d74c3 in internal_catch (tag=12814402, 
    func=0x53fa14 <command_loop_2>, arg=12766914) at eval.c:1059
        c = {
          tag = 12814402, 
          val = 12766914, 
          next = 0x0, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {0, -1730894225693820102, 4290928, 140737407852208, 0, 
0, 
                -1730894225601545414, 1730884200602975034}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {0, 0, 144, 0, 0, 140737407851568, 6028825, 4294967296, 
                  12766914, 12766914, 12988610, 140737407851664, 0, 12218656, 
                  12793680, 352}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
---Type <return> to continue, or q <return> to quit---
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
#8  0x000000000053f9ec in command_loop () at keyboard.c:1146
No locals.
#9  0x000000000053f16f in recursive_edit_1 () at keyboard.c:778
        count = 1
        val = 12766914
#10 0x000000000053f315 in Frecursive_edit () at keyboard.c:842
        count = 0
        buffer = 12766914
#11 0x000000000053d258 in main (argc=1, argv=0x7ffffb339eb8) at emacs.c:1564
        dummy = 4247287
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = true
        dumping = false
        skip_args = 0
        rlim = {
          rlim_cur = 8720000, 
          rlim_max = 18446744073709551615
        }
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x13c7f10 "\360%9\001"
(gdb) 
(gdb) xbacktrace 
(gdb)

Bye,
Tassilo