bug#59452: 29.0.50; [PGTK] SIGSEV Args out of range: 6, 6

[Po Lu]

German Pacenza <germanp82@hotmail.com> writes:

> Emacs crashes after showing "Args out of range: 6, 6" in the echo area.

Thanks.

> #9  emission_find (instance=0x5649a040e510, detail=670, signal_id=1)
>     at ../glib/gobject/gsignal.c:895
>         emission = 0x2
>         emission_node = <optimized out>
>         accumulator = <optimized out>
> --Type <RET> for more, q to quit, c to continue without paging--c
>         emission = {next = 0x7feadf2b9c20 <type_rw_lock>, instance = 
> 0x7feadf1c1076 <g_rw_lock_reader_lock+54>, ihint = {signal_id = 2682665968, 
> detail = 22089, run_type = (G_SIGNAL_DETAILED | G_SIGNAL_ACTION | 
> G_SIGNAL_NO_HOOKS | G_SIGNAL_MUST_COLLECT | G_SIGNAL_DEPRECATED | 
> G_SIGNAL_ACCUMULATOR_FIRST_RUN | unknown: 0x9fe43a00)}, state = 22089, 
> chain_type = 0x56499fe63af8 [None]}
>         hlist = <optimized out>
>         handler_list = 0x0
>         return_accu = <optimized out>
>         accu = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, 
> v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer 
> = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, 
> v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
>         signal_id = 1
>         max_sequential_handler_number = <optimized out>
>         return_value_altered = 0
> #10 signal_emit_unlocked_R.isra.0 (node=node@entry=0x5649a03aff10, 
> detail=detail@entry=670, instance=instance@entry=0x5649a040e510, 
> emission_return=emission_return@entry=0x0, 
> instance_and_params=instance_and_params@entry=0x7ffe0f9c0a10) at 
> ../glib/gobject/gsignal.c:3680
>         emission_node = <optimized out>
>         accumulator = <optimized out>
>         emission = {next = 0x7feadf2b9c20 <type_rw_lock>, instance = 
> 0x7feadf1c1076 <g_rw_lock_reader_lock+54>, ihint = {signal_id = 2682665968, 
> detail = 22089, run_type = (G_SIGNAL_DETAILED | G_SIGNAL_ACTION | 
> G_SIGNAL_NO_HOOKS | G_SIGNAL_MUST_COLLECT | G_SIGNAL_DEPRECATED | 
> G_SIGNAL_ACCUMULATOR_FIRST_RUN | unknown: 0x9fe43a00)}, state = 22089, 
> chain_type = 0x56499fe63af8 [None]}
>         hlist = <optimized out>
>         handler_list = 0x0
>         return_accu = <optimized out>
>         accu = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, 
> v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer 
> = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, 
> v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
>         signal_id = 1
>         max_sequential_handler_number = <optimized out>
>         return_value_altered = 0
> #11 0x00007feadf28af75 in g_signal_emit_valist (instance=<optimized out>, 
> signal_id=<optimized out>, detail=<optimized out>, 
> var_args=var_args@entry=0x7ffe0f9c0bd0) at ../glib/gobject/gsignal.c:3549
>         instance_and_params = 0x7ffe0f9c0a10
>         signal_return_type = <optimized out>
>         param_values = 0x7ffe0f9c0a28
>         node = <optimized out>
>         i = <optimized out>
>         n_params = <optimized out>
>         __func__ = "g_signal_emit_valist"
> #12 0x00007feadf28b204 in g_signal_emit (instance=<optimized out>, 
> signal_id=<optimized out>, detail=<optimized out>) at 
> ../glib/gobject/gsignal.c:3606
>         var_args = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 
> 0x7ffe0f9c0cb0, reg_save_area = 0x7ffe0f9c0bf0}}
> #13 0x00007feadf277fc6 in g_object_dispatch_properties_changed 
> (object=0x5649a040e510, n_pspecs=<optimized out>, pspecs=<optimized out>) at 
> ../glib/gobject/gobject.c:1428
>         i = <optimized out>
> #14 0x00007feadf27b488 in g_object_notify_by_spec_internal (pspec=<optimized 
> out>, object=0x5649a040e510) at ../glib/gobject/gobject.c:1544
>         nqueue = <optimized out>
>         need_thaw = <optimized out>
>         object_flags = <optimized out>
>         needs_notify = 1
>         in_init = <optimized out>
>         __func__ = "g_object_notify_by_pspec"
> #15 g_object_notify_by_pspec (object=0x5649a040e510, pspec=<optimized out>) 
> at ../glib/gobject/gobject.c:1650
>         __func__ = "g_object_notify_by_pspec"
> #16 0x00007feadf9e33bb in gtk_main_do_event (event=<optimized out>) at 
> ../gtk/gtk/gtkmain.c:1875
>         window = 0x5649a040e510
>         grab_widget = 0x5649a040e510
>         window_group = 0x5649a08ff900
>         rewritten_event = <optimized out>
>         device = <optimized out>
>         tmp_list = <optimized out>
>         event_widget = <optimized out>
>         topmost_widget = <optimized out>
>         __func__ = "gtk_main_do_event"
> #17 gtk_main_do_event (event=<optimized out>) at ../gtk/gtk/gtkmain.c:1691
>         __func__ = "gtk_main_do_event"
> #18 0x00007feadf744cc3 in _gdk_event_emit (event=0x5649a03e2700) at 
> ../gtk/gdk/gdkevents.c:73
> #19 _gdk_event_emit (event=0x5649a03e2700) at ../gtk/gdk/gdkevents.c:67
> #20 0x00007feadf7738c8 in gdk_event_source_dispatch (base=<optimized out>, 
> callback=<optimized out>, data=<optimized out>) at 
> ../gtk/gdk/wayland/gdkeventsource.c:124
>         source = <optimized out>
>         display = <optimized out>
>         event = 0x5649a03e2700
> #21 0x00007feadf16f87b in g_main_dispatch (context=0x5649a03cd280) at 
> ../glib/glib/gmain.c:3444
>         dispatch = 0x7feadf7738a0 <gdk_event_source_dispatch>
>         prev_source = 0x5649a03e2830
>         begin_time_nsec = 6352334976965
>         was_in_call = 2
>         user_data = 0x0
>         callback = 0x0
>         cb_funcs = 0x0
>         cb_data = 0x0
>         need_destroy = <optimized out>
>         source = 0x5649a03e2830
>         current = 0x5649a03cd390
>         i = 0
> #22 g_main_context_dispatch (context=0x5649a03cd280) at 
> ../glib/glib/gmain.c:4162
> #23 0x000056499e783f08 in pgtk_read_socket (terminal=<optimized out>, 
> hold_quit=0x7ffe0f9c0ee0) at pgtkterm.c:3839
>         context = 0x5649a03cd280
>         context_acquired = <optimized out>
>         count = <optimized out>
>         count = <optimized out>
> #24 pgtk_read_socket (terminal=<optimized out>, hold_quit=0x7ffe0f9c0ee0) at 
> pgtkterm.c:3818
>         count = <optimized out>
> #25 0x000056499e648d31 in gobble_input () at keyboard.c:7413
>         nr = <optimized out>
>         hold_quit = {kind = NO_EVENT, part = scroll_bar_nowhere, code = 0, 
> modifiers = 0, x = 0x0, y = 0x0, timestamp = 0, frame_or_window = 0x0, arg = 
> 0x0, device = 0x30}
>         next = 0x0
>         nread = 0
>         err = false
>         t = 0x5649a03a4288
> #26 0x000056499e649115 in handle_async_input () at keyboard.c:7644
>         nread = <optimized out>
> #27 process_pending_signals () at keyboard.c:7658
> #28 unblock_input_to (level=0) at keyboard.c:7673
> #29 unblock_input_to (level=<optimized out>) at keyboard.c:7667
> #30 0x000056499e649d5b in unblock_input () at keyboard.c:7692
>         nexttime = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
>         timers = 0x5649a0057e73
>         idle_timers = 0x5649a0057e03
>         tem = 0x0
> #31 timer_check () at keyboard.c:4738
>         nexttime = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
>         timers = 0x5649a0057e73
>         idle_timers = 0x5649a0057e03
>         tem = 0x0
> #32 0x000056499e64a355 in readable_events (flags=flags@entry=1) at 
> keyboard.c:3520
> #33 0x000056499e64a548 in get_input_pending (flags=flags@entry=1) at 
> keyboard.c:7363
> #34 0x000056499e64f408 in detect_input_pending_run_timers 
> (do_display=do_display@entry=true) at keyboard.c:10893
>         old_timers_run = <optimized out>
> #35 0x000056499e72ced8 in wait_reading_process_output 
> (time_limit=time_limit@entry=0, nsecs=nsecs@entry=0, 
> read_kbd=read_kbd@entry=-1, do_display=<optimized out>, 
> wait_for_cell=wait_for_cell@entry=0x0, wait_proc=wait_proc@entry=0x0, 
> just_wait_proc=<optimized out>) at process.c:5779
>         leave = false
>         process_skipped = <optimized out>
>         wrapped = <optimized out>
>         channel_start = <optimized out>
>         child_fd = <optimized out>
>         last_read_channel = 18
>         channel = <optimized out>
>         nfds = <optimized out>
>         Available = {fds_bits = {16, 0 <repeats 15 times>}}
>         Writeok = {fds_bits = {0 <repeats 16 times>}}
>         check_write = true
>         check_delay = <optimized out>
>         no_avail = false
>         xerrno = 11
>         proc = <optimized out>
>         timeout = {tv_sec = 0, tv_nsec = 0}
>         end_time = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
>         timer_delay = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
>         got_output_end_time = {tv_sec = 1669152744, tv_nsec = 622196508}
>         wait = <optimized out>
>         got_some_output = <optimized out>
>         prev_wait_proc_nbytes_read = <optimized out>
>         retry_for_async = <optimized out>
>         count = {bytes = <optimized out>}
>         now = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
> #36 0x000056499e64aacc in kbd_buffer_get_event (end_time=0x0, 
> used_mouse_menu=0x7ffe0f9c1c4b, kbp=<synthetic pointer>) at keyboard.c:3999
>         do_display = <optimized out>
>         obj = <optimized out>
>         str = <optimized out>
>         c = 0x0
>         save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 
> 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
>         kb = <optimized out>
>         count = {bytes = <optimized out>}
> #37 read_event_from_main_queue (end_time=<optimized out>, 
> local_getcjmp=0x7ffe0f9c1940, used_mouse_menu=0x7ffe0f9c1c4b) at 
> keyboard.c:2266
>         c = 0x0
>         save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 
> 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
>         kb = <optimized out>
>         count = {bytes = <optimized out>}
> #38 0x000056499e650573 in read_decoded_event_from_main_queue 
> (used_mouse_menu=<optimized out>, prev_event=<optimized out>, 
> local_getcjmp=<optimized out>, end_time=<optimized out>) at keyboard.c:2329
>         nextevt = <optimized out>
>         frame = <optimized out>
>         terminal = <optimized out>
>         events = {0x80, 0x56499e6c4c2c <Fget_pos_property+908>, 0x0, 
> 0x5649a0dca958, 0x2, 0x0, 0x300000080, 0x5649a0f7fca3, 0x5649a0dca95d, 
> 0xce10, 0x300000000, 0x5649a0f7fca3, 0x0, 0x9bd0, 0x0, 0x3}
>         n = 0
>         c = <optimized out>
>         local_getcjmp = {{__jmpbuf = {94874197109024, -3563864483271795924, 
> 94874220774629, 0, 94874221143328, 140729160310144, 3564180304290913068, 
> 7068858010357603116}, __mask_was_saved = 0, __saved_mask = {__val = 
> {140729160309264, 94874231158595, 140729160309264, 94874231295328, 
> 94874191034369, 140729160309216, 0, 94874231158595, 140729160309304, 
> 94874231417181, 0, 0, 1, 2, 60, 0}}}}
>         save_jump = {{__jmpbuf = {96, 0, 0, 36624, 94874231417181, 
> 94874190548722, 0, 140646516155144}, __mask_was_saved = 0, __saved_mask = 
> {__val = {94874190469145, 140646523924011, 94874190070880, 36624, 39888, 0, 
> 8589934593, 154, 0, 0, 140729160309552, 0, 94874217241523, 6, 
> 11384601093859441408, 0}}}}
>         tem = <optimized out>
>         save = <optimized out>
>         previous_echo_area_message = 0x0
>         also_record = 0x0
>         reread = false
>         recorded = false
>         polling_stopped_here = true
>         orig_kboard = 0x5649a03fe520
> #39 read_char (commandflag=1, map=0x5649a0030693, prev_event=0x0, 
> used_mouse_menu=0x7ffe0f9c1c4b, end_time=0x0) at keyboard.c:2960
>         c = <optimized out>
>         local_getcjmp = {{__jmpbuf = {94874197109024, -3563864483271795924, 
> 94874220774629, 0, 94874221143328, 140729160310144, 3564180304290913068, 
> 7068858010357603116}, __mask_was_saved = 0, __saved_mask = {__val = 
> {140729160309264, 94874231158595, 140729160309264, 94874231295328, 
> 94874191034369, 140729160309216, 0, 94874231158595, 140729160309304, 
> 94874231417181, 0, 0, 1, 2, 60, 0}}}}
>         save_jump = {{__jmpbuf = {96, 0, 0, 36624, 94874231417181, 
> 94874190548722, 0, 140646516155144}, __mask_was_saved = 0, __saved_mask = 
> {__val = {94874190469145, 140646523924011, 94874190070880, 36624, 39888, 0, 
> 8589934593, 154, 0, 0, 140729160309552, 0, 94874217241523, 6, 
> 11384601093859441408, 0}}}}
>         tem = <optimized out>
>         save = <optimized out>
>         previous_echo_area_message = 0x0
>         also_record = 0x0
>         reread = false
>         recorded = false
>         polling_stopped_here = true
>         orig_kboard = 0x5649a03fe520
> #40 0x000056499e652b63 in read_key_sequence (keybuf=<optimized out>, 
> prompt=0x0, dont_downcase_last=<optimized out>, can_return_switch_frame=true, 
> fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:10070
>         interrupted_kboard = 0x5649a03fe520
>         interrupted_frame = 0x5649a03a44e0
>         key = <optimized out>
>         used_mouse_menu = false
>         echo_local_start = 0
>         last_real_key_start = 0
>         keys_local_start = 0
>         new_binding = <optimized out>
>         t = 0
>         echo_start = 0
>         keys_start = 0
>         current_binding = 0x5649a0030693
>         first_unbound = 31
>         mock_input = 0
>         used_mouse_menu_history = {false <repeats 30 times>}
>         fkey = {parent = 0x5649a02f5d73, map = 0x5649a02f5d73, start = 0, end 
> = 0}
>         keytran = {parent = 0x7fead218457b, map = 0x7fead218457b, start = 0, 
> end = 0}
>         indec = {parent = 0x5649a02f5d63, map = 0x5649a02f5d63, start = 0, 
> end = 0}
>         shift_translated = false
>         delayed_switch_frame = 0x0
>         original_uppercase = 0x0
>         original_uppercase_position = -1
>         dummyflag = false
>         fake_prefixed_keys = 0x0
>         first_event = 0x0
>         second_event = <optimized out>
> #41 0x000056499e654a15 in command_loop_1 () at keyboard.c:1376
>         cmd = <optimized out>
>         keybuf = {0x5649a1410c04, 0x3, 0x10680, 0x9dfe3a606d03fb00, 0xa0, 
> 0x9dfe3a606d03fb00, 0x60, 0x0, 0x0, 0xe940, 0x5649a0dca95d, 0x56499e6d0ef2 
> <unbind_to+514>, 0x7ffe0f9c1e60, 0x0, 0x9, 0xe940, 0x30, 0x5649a0dca95d, 
> 0x7fead19b6fa4, 0x5649a0030ab3, 0x60, 0x7ffe0f9c1e60, 0x56499ff09733, 
> 0x7ffe0f9c1fd8, 0x7ffe0f9c36b2, 0x56499e647a21 <cmd_error+353>, 0x0, 0x0, 
> 0x56499ff09000, 0x9dfe3a606d03fb00}
>         i = <optimized out>
>         prev_modiff = 0
>         prev_buffer = 0x0
> #42 0x000056499e6cfa67 in internal_condition_case 
> (bfun=bfun@entry=0x56499e654850 <command_loop_1>, 
> handlers=handlers@entry=0x90, hfun=hfun@entry=0x56499e6478c0 <cmd_error>) at 
> eval.c:1474
>         val = <optimized out>
>         c = 0x56499ff9df80
> #43 0x000056499e640396 in command_loop_2 (handlers=handlers@entry=0x90) at 
> keyboard.c:1125
>         val = <optimized out>
> #44 0x000056499e6cf9c1 in internal_catch (tag=tag@entry=0xf810, 
> func=func@entry=0x56499e640370 <command_loop_2>, arg=arg@entry=0x90) at 
> eval.c:1197
>         val = <optimized out>
>         c = 0x56499ff95700
> #45 0x000056499e640331 in command_loop () at keyboard.c:1103
> #46 0x000056499e647442 in recursive_edit_1 () at keyboard.c:712
>         val = <optimized out>
> #47 0x000056499e6477d0 in Frecursive_edit () at keyboard.c:795
>         buffer = <optimized out>
> #48 0x000056499e5592d6 in main (argc=<optimized out>, argv=0x7ffe0f9c2228) at 
> emacs.c:2516
>         stack_bottom_variable = 0x6d5834980
>         no_loadup = false
>         junk = 0x0
>         dname_arg = 0x0
>         ch_to_dir = 0x0
>         original_pwd = <optimized out>
>         dump_mode = <optimized out>
>         skip_args = 0
>         temacs = 0x0
>         attempt_load_pdump = <optimized out>
>         only_version = false
>         rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
>         lc_all = <optimized out>
>         sockfd = -1

This looks like a signal happened in pgtk_read_socket, causing a longjmp
outside and GLib to crash the next time pgtk_read_socket happens (as
depicted in the backtrace.)

Unfortunately, this backtrace doesn't help.  Would you please put a
breakpoint on `args_out_of_range', and see what leads to it being called
instead?