bug#63614: 29.0.91; PGTK Emacs crashes after clearing the clipboard

[Leonardo Hernández Hernández]

On Thu, May 25, 2023 at 12:13:38AM -0600, Po Lu wrote:
> I suppose what this shows is that an invalid SELECTION_CLEAR_EVENT has
> somehow found its way in to the keyboard buffer.
> 
> We need to narrow down the scope of the problem.  If you comment out the
> entirety of `process_special_events', does the crash still occur?

Yes, I am using this diff:

diff --git a/src/keyboard.c b/src/keyboard.c
index b1ccf4acde4..2c9515194f7 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -4401,6 +4401,7 @@ kbd_buffer_get_event (KBOARD **kbp,
 static void
 process_special_events (void)
 {
+  #if 0
   union buffered_input_event *event;
 #if defined HAVE_X11 || defined HAVE_PGTK || defined HAVE_HAIKU
 #ifndef HAVE_HAIKU
@@ -4476,6 +4477,7 @@ process_special_events (void)
 #endif
        }
     }
+  #endif
 }

 /* Process any events that are not user-visible, run timer events that



and the backtrace:

(gdb) bt full
#0  0x00007fe5d8b238ec in  () at /usr/lib64/libc.so.6
#1  0x00007fe5d8ad43e2 in raise () at /usr/lib64/libc.so.6
#2  0x0000558b3fc04c6a in terminate_due_to_signal (sig=11, 
backtrace_limit=<optimized out>) at emacs.c:464
#3  0x0000558b3fc05ae5 in handle_fatal_signal (sig=11) at sysdep.c:1783
        fatal = <optimized out>
#4  deliver_thread_signal (handler=<optimized out>, sig=11) at sysdep.c:1775
        fatal = <optimized out>
#5  deliver_fatal_thread_signal (sig=11) at sysdep.c:1795
        fatal = <optimized out>
#6  handle_sigsegv (sig=11, siginfo=0x558b4048ccb0 <sigsegv_stack+64528>, 
arg=<optimized out>) at sysdep.c:1888
        fatal = <optimized out>
#7  0x00007fe5d8ad4490 in <signal handler called> () at /usr/lib64/libc.so.6
#8  0x0000558b3fd2795f in pgtk_handle_selection_clear (event=0x7ffe61851e40) at 
pgtkselect.c:742
        changed_owner_time = 0
        local_selection_time = <optimized out>
        dpyinfo = 0x40da71d0
        Vselection_alist = <optimized out>
        selection = <optimized out>
        selection_symbol = <optimized out>
        local_selection_data = <optimized out>
        copy = {kind = SELECTION_CLEAR_EVENT, dpyinfo = 0x40da71d0, requestor = 
0x0, selection = 0x45, target = 0x0, property = 0x0, time = 0}
        event = <optimized out>
        obj = 0x0
        str = <optimized out>
#9  pgtk_handle_selection_event (event=0x7ffe61851e40) at pgtkselect.c:782
        copy = {kind = SELECTION_CLEAR_EVENT, dpyinfo = 0x40da71d0, requestor = 
0x0, selection = 0x45, target = 0x0, property = 0x0, time = 0}
        event = <optimized out>
        obj = 0x0
        str = <optimized out>
#10 kbd_buffer_get_event (kbp=kbp@entry=0x7ffe618520c8, 
used_mouse_menu=used_mouse_menu@entry=0x7ffe6185263b, 
end_time=end_time@entry=0x0) at keyboard.c:4071
        copy = {kind = SELECTION_CLEAR_EVENT, dpyinfo = 0x40da71d0, requestor = 
0x0, selection = 0x45, target = 0x0, property = 0x0, time = 0}
        event = <optimized out>
        obj = 0x0
        str = <optimized out>
#11 0x0000558b3fd29bc4 in read_event_from_main_queue 
(used_mouse_menu=<optimized out>, local_getcjmp=0x7ffe61852340, 
end_time=<optimized out>) at keyboard.c:2279
        c = 0x0
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 
0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        kb = 0x558b40d2dbd0
        nextevt = <optimized out>
        frame = <optimized out>
        terminal = <optimized out>
        events = {0x7fe5d489770d, 0x13f000000, 0x558b41335113, 0x9c90d489770d, 
0x24a, 0x558b40c05963, 0x9c90, 0x9c90, 0x4000000006000000, 0x400000003f000000, 
0x0, 0x558b3fe54381 <lookup_char_property+497>, 0x9c90, 0x1618524b0, 
0xffffffffffffffff, 0x93}
        n = 0
        c = <optimized out>
        local_getcjmp = {{__jmpbuf = {94056566772352, -1901120014703127217, 1, 
140625090017032, 0, 94056582669987, -1901120015443421873, 
-5658946911598406321}, __mask_was_saved = 0, __saved_mask = {__val = 
{94056560832960, 94056575718051, 586, 2, 94056560847727, 140730534536336, 
40080, 140730534536224, 0, 0, 140625090017037, 0, 94056575718051, 0, 146, 
147}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 
0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = true
        orig_kboard = 0x558b40d2dbd0
#12 read_decoded_event_from_main_queue (used_mouse_menu=<optimized out>, 
prev_event=<optimized out>, local_getcjmp=<optimized out>, end_time=<optimized 
out>) at keyboard.c:2343
        nextevt = <optimized out>
        frame = <optimized out>
        terminal = <optimized out>
        events = {0x7fe5d489770d, 0x13f000000, 0x558b41335113, 0x9c90d489770d, 
0x24a, 0x558b40c05963, 0x9c90, 0x9c90, 0x4000000006000000, 0x400000003f000000, 
0x0, 0x558b3fe54381 <lookup_char_property+497>, 0x9c90, 0x1618524b0, 
0xffffffffffffffff, 0x93}
        n = 0
        c = <optimized out>
        local_getcjmp = {{__jmpbuf = {94056566772352, -1901120014703127217, 1, 
140625090017032, 0, 94056582669987, -1901120015443421873, 
-5658946911598406321}, __mask_was_saved = 0, __saved_mask = {__val = 
{94056560832960, 94056575718051, 586, 2, 94056560847727, 140730534536336, 
40080, 140730534536224, 0, 0, 140625090017037, 0, 94056575718051, 0, 146, 
147}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 
0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = true
        orig_kboard = 0x558b40d2dbd0
#13 read_char (commandflag=1, map=0x558b40c8c593, prev_event=0x0, 
used_mouse_menu=0x7ffe6185263b, end_time=0x0) at keyboard.c:2973
        c = <optimized out>
        local_getcjmp = {{__jmpbuf = {94056566772352, -1901120014703127217, 1, 
140625090017032, 0, 94056582669987, -1901120015443421873, 
-5658946911598406321}, __mask_was_saved = 0, __saved_mask = {__val = 
{94056560832960, 94056575718051, 586, 2, 94056560847727, 140730534536336, 
40080, 140730534536224, 0, 0, 140625090017037, 0, 94056575718051, 0, 146, 
147}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 
0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = true
        orig_kboard = 0x558b40d2dbd0
#14 0x0000558b3feda8b7 in read_key_sequence.constprop.0
    (keybuf=<optimized out>, prevent_redisplay=false, 
fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, 
dont_downcase_last=<optimized out>, prompt=<optimized out>)
    at keyboard.c:10085
        interrupted_kboard = 0x558b40d2dbd0
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        new_binding = <optimized out>
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = 0x558b40c8c593
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {parent = 0x558b40bb6393, map = 0x558b40bb6393, start = 0, end = 
0}
        keytran = {parent = 0x7fe5d500897b, map = 0x7fe5d500897b, start = 0, 
end = 0}
        indec = {parent = 0x558b40bb63a3, map = 0x558b40bb63a3, start = 0, end 
= 0}
        shift_translated = <optimized out>
        delayed_switch_frame = <optimized out>
        original_uppercase = <optimized out>
        original_uppercase_position = <optimized out>
        dummyflag = false
        fake_prefixed_keys = 0x0
        first_event = 0x0
        second_event = <optimized out>
#15 0x0000558b3fd1ebea in command_loop_1 () at keyboard.c:1384
        cmd = <optimized out>
        keybuf = {0x5e, 0x558b3fddddd6 <eval_sub+1142>, 0x558b40b63510, 
0x558b3fe368dc <exec_byte_code+508>, 0x0, 0x80, 0x0, 0x7fe5d4d0e738, 
0x558b3ff8d020 <main_thread.lto_priv>, 0x7fe5d50e62b5, 0x558b40ba93c4, 0x0, 
0x558b3ff17314, 0x7fe5da405705, 0x53474e, 0x7fe5d8b31400, 0x7ffe61852c30, 
0xc8655754adb42900, 0x9510, 0x558b3ff1dd60, 0x7ffe61852900, 0x60, 
0x558b40ba93c4, 0x0, 0x558b3ff8d020 <main_thread.lto_priv>, 0x558b3fd1c925 
<top_level_2+725>, 0x558b3ff17314, 0x7fe5d8b31f12 <malloc+434>, 0x15, 0x30}
        i = <optimized out>
        prev_modiff = 37
        prev_buffer = 0x7fe5d4897708
#16 0x0000558b3fdd81b7 in internal_condition_case (bfun=0x558b3fd1e920 
<command_loop_1>, handlers=<optimized out>, hfun=0x558b3fd1c380 <cmd_error>) at 
eval.c:1474
        val = <optimized out>
        c = 0x558b40bad350
#17 0x0000558b3fd1c63e in command_loop_2 (handlers=handlers@entry=0x90) at 
keyboard.c:1133
        val = <optimized out>
#18 0x0000558b3fdd810c in internal_catch (tag=<optimized out>, 
func=0x558b3fd1c610 <command_loop_2>, arg=0x90) at eval.c:1197
        val = <optimized out>
        c = 0x558b40bacde0
#19 0x0000558b3fd1e409 in command_loop () at keyboard.c:1111
#20 0x0000558b3ff0d720 in recursive_edit_1.isra.0 () at keyboard.c:720
        val = <optimized out>
#21 0x0000558b3fd1e8ec in Frecursive_edit () at keyboard.c:803
        buffer = <optimized out>
#22 0x0000558b3fc12bad in main (argc=<optimized out>, argv=0x7ffe61852d48) at 
emacs.c:2529
        stack_bottom_variable = 0x0
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = <optimized out>
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>
(gdb)