bug#63283: Emacs crash within fontset

[Seppo Ronkainen]

sure, here are captures of gdb and system-configuration-features from two build 
variants of 29.0.90 and one 26.3





/home/user/.local/emacs-29.0.90_minimal/inst/bin/emacs -Q 
~/examplefilewithunicodetext

(describe-variable 'system-configuration-features)



system-configuration-features is a variable defined in ‘src/emacs.c’.

Its value is "GLIB GMP JSON PDUMPER SECCOMP X11 XIM GTK3"

String listing some of the main features this Emacs was compiled with.
An element of the form "FOO" generally means that HAVE_FOO was
defined during the build.

This is mainly intended for diagnostic purposes in bug reports.
Don’t rely on it for testing whether a feature you want to use is available.

  Probably introduced at or before Emacs version 25.1.

[back]















/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs -Q 
~/examplefilewithunicodetext

(describe-variable 'system-configuration-features)



system-configuration-features is a variable defined in ‘C source code’.

Its value is "GLIB GMP JSON PDUMPER SECCOMP X11 XIM GTK3"

String listing some of the main features this Emacs was compiled with.
An element of the form "FOO" generally means that HAVE_FOO was
defined during the build.

This is mainly intended for diagnostic purposes in bug reports.
Don’t rely on it for testing whether a feature you want to use is available.

  Probably introduced at or before Emacs version 25.1.




















/home/user/.local/emacs-29.0.90_minimal/cons/src/config.h:128
/* Summary of some of the main features enabled by configure. */
#define EMACS_CONFIG_FEATURES "GLIB GMP JSON PDUMPER SECCOMP X11 XIM GTK3"

/* Define to the options passed to configure. */
#define EMACS_CONFIG_OPTIONS 
"--prefix=/home/user/.local/emacs-29.0.90_minimal/inst --without-all"


> gdb --args /home/user/.local/emacs-29.0.90_minimal/inst/bin/emacs -Q 
> ~/examplefilewithunicodetext
GNU gdb (Debian 10.1-1.7) 10.1.90.20210103-git
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /home/user/.local/emacs-29.0.90_minimal/inst/bin/emacs...
(gdb) run
Starting program: /home/user/.local/emacs-29.0.90_minimal/inst/bin/emacs -Q 
/home/user/examplefilewithunicodetext
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ff4a6fe80 (LWP 44415)]
[Detaching after vfork from child process 44416]
[Detaching after vfork from child process 44417]
[Detaching after vfork from child process 44418]

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
0x00000055557864c8 in fontset_find_font (fontset=fontset@entry=0x30, 
c=c@entry=12302, face=face@entry=0x555664ee90, 
    charset_id=charset_id@entry=-1, fallback=fallback@entry=false) at 
fontset.c:555
555       struct frame *f = (FRAMEP (FONTSET_FRAME (fontset))
(gdb) thread apply all bt

Thread 2 (Thread 0x7ff4a6fe80 (LWP 44415) "gmain"):
#0  0x0000007ff6fa6ef4 in __GI___poll (fds=0x5555dd25c0, nfds=1, 
timeout=<optimized out>) at ../sysdeps/unix/sysv/linux/poll.c:41
#1  0x0000007ff74b7df8 in  () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#2  0x0000007ff74b7f24 in g_main_context_iteration () at 
/lib/aarch64-linux-gnu/libglib-2.0.so.0
#3  0x0000007ff74b7f7c in  () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#4  0x0000007ff74e18f4 in  () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#5  0x0000007ff71d4648 in start_thread (arg=0x7ff4a6f780) at 
pthread_create.c:477
#6  0x0000007ff6fb0c1c in thread_start () at 
../sysdeps/unix/sysv/linux/aarch64/clone.S:78

Thread 1 (Thread 0x7ff5d6f700 (LWP 44408) "emacs"):
#0  0x00000055557864c8 in fontset_find_font (fontset=fontset@entry=0x30, 
c=c@entry=12302, face=face@entry=0x555664ee90, charset_id=charset_id@entry=-1, 
fallback=fallback@entry=false) at fontset.c:555
#1  0x0000005555787240 in fontset_font (fontset=fontset@entry=0x30, 
c=c@entry=12302, face=face@entry=0x555664ee90, id=-1) at fontset.c:766
#2  0x0000005555787938 in face_for_char (f=0x5556159e50, face=0x555664ee90, 
c=<optimized out>, pos=<optimized out>, object=<optimized out>) at 
fontset.c:995                                                                   
                                                                  
#3  0x00000055555c45d8 in FACE_FOR_CHAR (object=<optimized out>, pos=<optimized 
out>, character=<optimized out>, face=<optimized out>, f=<optimized out>) at 
dispextern.h:1911           
#4  get_next_display_element (it=it@entry=0x7fffff8978) at xdisp.c:8184
#5  0x00000055555c9988 in display_line (it=it@entry=0x7fffff8978, 
cursor_vpos=cursor_vpos@entry=0) at xdisp.c:24708
#6  0x00000055555cda60 in try_window (window=window@entry=0x555615a09d, 
pos=..., flags=flags@entry=1) at xdisp.c:20577
#7  0x00000055555e8cd0 in redisplay_window (window=<optimized out>, 
just_this_one_p=just_this_one_p@entry=false) at xdisp.c:19961
#8  0x00000055555eac14 in redisplay_window_0 (window=window@entry=0x555615a09d) 
at xdisp.c:17446
#9  0x0000005555713234 in internal_condition_case_1 
(bfun=bfun@entry=0x55555eabe0 <redisplay_window_0>, arg=arg@entry=0x555615a09d, 
handlers=<optimized out>, hfun=hfun@entry=0x55555aa300 
<redisplay_window_error>) at eval.c:1498
#10 0x00000055555a7348 in redisplay_windows (window=0x555615a09d) at 
xdisp.c:17416
#11 0x00000055555d6720 in redisplay_internal () at xdisp.c:16866
#12 0x00000055555d7a44 in redisplay () at xdisp.c:16049
#13 0x000000555569b6b0 in read_char (commandflag=commandflag@entry=1, 
map=map@entry=0x55560ddf03, prev_event=0x0, 
used_mouse_menu=used_mouse_menu@entry=0x7fffffe013, 
end_time=end_time@entry=0x0) at keyboard.c:2634
#14 0x000000555569d780 in read_key_sequence (keybuf=keybuf@entry=0x7fffffe140, 
prompt=prompt@entry=0x0, dont_downcase_last=dont_downcase_last@entry=false, 
can_return_switch_frame=can_return_switch_frame@entry=true, 
fix_current_buffer=fix_current_buffer@entry=true, 
prevent_redisplay=prevent_redisplay@entry=false) at keyboard.c:10081
#15 0x000000555569f19c in command_loop_1 () at lisp.h:1165
#16 0x00000055557131a0 in internal_condition_case (bfun=bfun@entry=0x555569f004 
<command_loop_1>, handlers=handlers@entry=0x90, hfun=hfun@entry=0x5555693030 
<cmd_error>) at eval.c:1474           
#17 0x000000555568c378 in command_loop_2 (handlers=handlers@entry=0x90) at 
keyboard.c:1131
#18 0x00000055557130f4 in internal_catch (tag=tag@entry=0xf390, 
func=func@entry=0x555568c344 <command_loop_2>, arg=arg@entry=0x90) at 
eval.c:1197
#19 0x000000555568c310 in command_loop () at lisp.h:1165
#20 0x0000005555692b44 in recursive_edit_1 () at keyboard.c:718
#21 0x0000005555692f54 in Frecursive_edit () at keyboard.c:801
#22 0x000000555558cecc in main (argc=3, argv=0x7fffffe638) at emacs.c:2529
(gdb) q
A debugging session is active.

        Inferior 1 [process 44408] will be killed.

Quit anyway? (y or n) y
> exit
exit

Process terminal finished














/home/user/.local/emacs-29.0.90_debug/cons/src/config.h:128
/* Summary of some of the main features enabled by configure. */
#define EMACS_CONFIG_FEATURES "GLIB GMP JSON PDUMPER SECCOMP X11 XIM GTK3"

/* Define to the options passed to configure. */
#define EMACS_CONFIG_OPTIONS 
"--prefix=/home/user/.local/emacs-29.0.90_debug/inst --without-all 
--enable-checking=yes,glyphs --enable-check-lisp-object-type 'CFLAGS=-O0 -g3'"

> gdb --args /home/user/.local/emacs-29.0.90_debug/inst/bin/emacs -Q 
> ~/examplefilewithunicodetext
GNU gdb (Debian 10.1-1.7) 10.1.90.20210103-git
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /home/user/.local/emacs-29.0.90_debug/inst/bin/emacs...
(gdb) run
Starting program: /home/user/.local/emacs-29.0.90_debug/inst/bin/emacs -Q 
/home/user/examplefilewithunicodetext
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ff4a6fe80 (LWP 44369)]
[Detaching after vfork from child process 44370]
[Detaching after vfork from child process 44371]
[Detaching after vfork from child process 44372]

fontset.c:970: Emacs fatal error: assertion failed: fontset_id_valid_p 
(face->fontset)
Fatal error 6: Aborted
Backtrace:
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x246468)[0x5555796468]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x205cc0)[0x5555755cc0]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x2cba04)[0x555581ba04]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x3d33c4)[0x55559233c4]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x6d308)[0x55555bd308]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x8d054)[0x55555dd054]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0xc1a10)[0x5555611a10]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0xb3424)[0x5555603424]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0xb059c)[0x555560059c]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0xa7740)[0x55555f7740]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x30be18)[0x555585be18]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0xa73b0)[0x55555f73b0]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0xa5b74)[0x55555f5b74]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0xa314c)[0x55555f314c]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x213e58)[0x5555763e58]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x229ba4)[0x5555779ba4]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x20f678)[0x555575f678]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x30bd14)[0x555585bd14]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x20ecfc)[0x555575ecfc]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x30ae0c)[0x555585ae0c]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x20ec7c)[0x555575ec7c]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x20ddbc)[0x555575ddbc]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x20e028)[0x555575e028]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x208d90)[0x5555758d90]
/lib/aarch64-linux-gnu/libc.so.6(__libc_start_main+0xe8)[0x7ff6efee18]
/home/user/.local/emacs-29.0.90_debug/inst/bin/emacs(+0x3b368)[0x555558b368]

Thread 1 "emacs" received signal SIGABRT, Aborted.
raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) thread apply all bt

Thread 2 (Thread 0x7ff4a6fe80 (LWP 44369) "gmain"):
#0  0x0000007ff6fa6ef4 in __GI___poll (fds=0x555611e270, nfds=1, 
timeout=<optimized out>) at ../sysdeps/unix/sysv/linux/poll.c:41
#1  0x0000007ff74b7df8 in  () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#2  0x0000007ff74b7f24 in g_main_context_iteration () at 
/lib/aarch64-linux-gnu/libglib-2.0.so.0
#3  0x0000007ff74b7f7c in  () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#4  0x0000007ff74e18f4 in  () at /lib/aarch64-linux-gnu/libglib-2.0.so.0
#5  0x0000007ff71d4648 in start_thread (arg=0x7ff4a6f780) at 
pthread_create.c:477
#6  0x0000007ff6fb0c1c in thread_start () at 
../sysdeps/unix/sysv/linux/aarch64/clone.S:78

Thread 1 (Thread 0x7ff5d6f700 (LWP 44362) "emacs"):
#0  raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x0000005555755cf0 in terminate_due_to_signal (sig=6, 
backtrace_limit=2147483647) at emacs.c:464
#2  0x000000555581ba04 in die (msg=0x55559f6900 "fontset_id_valid_p 
(face->fontset)", file=0x55559f6608 "fontset.c", line=970) at alloc.c:7707
#3  0x00000055559233c4 in face_for_char (f=0x55564e70f0, face=0x5556ac95e0, 
c=12302, pos=1, object=...) at fontset.c:970
#4  0x00000055555bd308 in FACE_FOR_CHAR (f=0x55564e70f0, face=0x5556ac95e0, 
character=12302, pos=1, object=...) at dispextern.h:1911
#5  0x00000055555dd054 in get_next_display_element (it=0x7fffff8818) at 
xdisp.c:8184
#6  0x0000005555611a10 in display_line (it=0x7fffff8818, cursor_vpos=0) at 
xdisp.c:24708
#7  0x0000005555603424 in try_window (window=..., pos=..., flags=1) at 
xdisp.c:20577
#8  0x000000555560059c in redisplay_window (window=..., just_this_one_p=false) 
at xdisp.c:19961
#9  0x00000055555f7740 in redisplay_window_0 (window=...) at xdisp.c:17446
#10 0x000000555585be18 in internal_condition_case_1 (bfun=0x55555f76fc 
<redisplay_window_0>, arg=..., handlers=..., hfun=0x55555f73e8 
<redisplay_window_error>) at eval.c:1498                       
#11 0x00000055555f73b0 in redisplay_windows (window=...) at xdisp.c:17416
#12 0x00000055555f5b74 in redisplay_internal () at xdisp.c:16866
#13 0x00000055555f314c in redisplay () at xdisp.c:16049
#14 0x0000005555763e58 in read_char (commandflag=1, map=..., prev_event=..., 
used_mouse_menu=0x7fffffdf17, end_time=0x0) at keyboard.c:2634
#15 0x0000005555779ba4 in read_key_sequence (keybuf=0x7fffffe098, prompt=..., 
dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:10081
#16 0x000000555575f678 in command_loop_1 () at keyboard.c:1382
#17 0x000000555585bd14 in internal_condition_case (bfun=0x555575f1dc 
<command_loop_1>, handlers=..., hfun=0x555575e464 <cmd_error>) at eval.c:1474
#18 0x000000555575ecfc in command_loop_2 (handlers=...) at keyboard.c:1131
#19 0x000000555585ae0c in internal_catch (tag=..., func=0x555575ecd4 
<command_loop_2>, arg=...) at eval.c:1197
#20 0x000000555575ec7c in command_loop () at keyboard.c:1109
#21 0x000000555575ddbc in recursive_edit_1 () at keyboard.c:718
#22 0x000000555575e028 in Frecursive_edit () at keyboard.c:801
#23 0x0000005555758d90 in main (argc=3, argv=0x7fffffe638) at emacs.c:2529
(gdb) q
A debugging session is active.

        Inferior 1 [process 44362] will be killed.

Quit anyway? (y or n) y
> exit
exit

Process terminal finished



















attempts to reproduce the abort within Emacs 26.3 built with the feature 
FREETYPE (was reported in the output):




/home/user/.local/emacs-26.3/inst/bin/emacs-26.3 -Q ~/examplefilewithunicodetext

(describe-variable 'system-configuration-features)


system-configuration-features is a variable defined in ‘C source code’.
Its value is
"XPM PNG SOUND DBUS GSETTINGS GLIB NOTIFY LIBSELINUX GNUTLS LIBXML2 FREETYPE 
XFT ZLIB TOOLKIT_SCROLL_BARS GTK3 X11 XDBE XIM MODULES THREADS"

Documentation:
String listing some of the main features this Emacs was compiled with.
An element of the form "FOO" generally means that HAVE_FOO was
defined during the build.

This is mainly intended for diagnostic purposes in bug reports.
Don’t rely on it for testing whether a feature you want to use is available.




/home/user/.local/emacs-26.3/cons/src/config.h:117
/* Define to the canonical Emacs configuration name. */
#define EMACS_CONFIGURATION "aarch64-unknown-linux-gnu"

/* Summary of some of the main features enabled by configure. */
#define EMACS_CONFIG_FEATURES "XPM PNG SOUND DBUS GSETTINGS GLIB NOTIFY 
LIBSELINUX GNUTLS LIBXML2 FREETYPE XFT ZLIB TOOLKIT_SCROLL_BARS GTK3 X11 XDBE 
XIM MODULES THREADS"

/* Define to the options passed to configure. */
#define EMACS_CONFIG_OPTIONS "--prefix=/home/user/.local/emacs-26.3/inst 
--with-gif=no --with-included-regex --with-jpeg=no --with-json=yes 
--with-mailutils=yes --with-makeinfo=no --with-modules --with-rsvg=no 
--with-threads --with-tiff=no --with-xml2=yes"




I rescale the buffer back and forth several times with


C-x C-0, C-x C-=, C-x C--, C-x C-+.

(text-scale-adjust INC)


to both limits which where indicated in the mode line

(Fundamental -15)
(Fundamental +29)





> gdb --args /home/user/.local/emacs-26.3/inst/bin/emacs-26.3 -Q 
> ~/examplefilewithunicodetext
GNU gdb (Debian 10.1-1.7) 10.1.90.20210103-git
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /home/user/.local/emacs-26.3/inst/bin/emacs-26.3...
(gdb) run
Starting program: /home/user/.local/emacs-26.3/inst/bin/emacs-26.3 -Q 
/home/user/examplefilewithunicodetext
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ff3354c40 (LWP 45101)]
[Detaching after vfork from child process 45102]
[Detaching after vfork from child process 45103]
[Detaching after vfork from child process 45104]
[New Thread 0x7ff2890c40 (LWP 45105)]
[New Thread 0x7ff1f00c40 (LWP 45106)]
[Thread 0x7ff1f00c40 (LWP 45106) exited]
[Thread 0x7ff3354c40 (LWP 45101) exited]
[Thread 0x7ff3681040 (LWP 45094) exited]
[Inferior 1 (process 45094) exited normally]
(gdb) q
> exit
exit

Process terminal finished









> uname -a
Linux raspberrypi 6.1.21-v8+ #1642 SMP PREEMPT Mon Apr  3 17:24:16 BST 2023 
aarch64 GNU/Linux

% sha512sum emacs-29.0.90.tar.gz
5cbd47142ccd845b8da33f5c2cf62088b5076182a91e4cda7de6c5eef980743221705da8e6fa825bc0f6e7dcc0625b78382bdd12e319e0ce76ec3d4690557696
  emacs-29.0.90.tar.gz










Live long and prosper

Sent with Proton Mail secure email.

------- Original Message -------
On Saturday, May 6th, 2023 at 10:19 AM, Eli Zaretskii <eliz@gnu.org> wrote:


> [Please use Reply All to reply, so that the bug address is on the CC
> list, and this discussion is recorded by our bug tracker.]
> 
> > Date: Fri, 05 May 2023 21:19:18 +0000
> > From: Seppo Ronkainen sodr80@protonmail.com
> > 
> > I was not aware about report-emacs-bug thanks for the guidance
> > 
> > Following instructions from (share/emacs/29.0.90/etc/DEBUG:19) I rebuilt 
> > with options
> > 
> > ./configure --enable-checking='yes,glyphs' --enable-check-lisp-object-type \
> > CFLAGS='-O0 -g3'
> > 
> > TL;DR
> > Now it looks as if (of course) Emacs never crashed, but it seems as if 
> > insufficient font data caused an abort is that right? Hope this helps
> > 
> > fontset.c:970: Emacs fatal error: assertion failed: fontset_id_valid_p 
> > (face->fontset)
> > Fatal error 6: Aborted
> 
> 
> Thanks, but this is not enough info to find the root cause of the
> problem. Please run Emacs under GDB, like this:
> 
> $ gdb /path/to/src/emacs
> ...
> (gdb) run
> 
> Then, when Emacs crashes or aborts, GDB will kick in and show its
> "(gdb)" prompt. Please type at the GDB prompt:
> 
> (gdb) thread apply all bt
> 
> and post here everything that GDB prints in response.
> 
> Also, please show what this displays inside Emacs built --without-all:
> 
> M-: system-configuration-features RET