The following produces a reproducable segfault on an emacs;
First I launch emacs under GDB and create an X frame:
gdb ./src/emacs
run -Q -nw
M-x make-frame-on-display RET :0.0 RET
Then, I try to delete the new X frame:
M-x delete-frame
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1083362720 (LWP 1229)]
0x405ea727 in XFreeGC () from /usr/X11R6/lib/libX11.so.6
(gdb) bt full
#0 0x405ea727 in XFreeGC () from /usr/X11R6/lib/libX11.so.6
No symbol table info available.
#1 0x403458be in _gdk_gc_x11_get_type () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#2 0x40430749 in g_object_interface_list_properties () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#3 0x4032d638 in gdk_screen_get_type () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#4 0x40350047 in gdk_screen_set_default_colormap () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#5 0x40430871 in g_object_run_dispose () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#6 0x4032d6ad in _gdk_screen_close () from /usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#7 0x40337da4 in gdk_x11_display_ungrab () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#8 0x40430871 in g_object_run_dispose () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#9 0x08162629 in xg_display_close (dpy=0x8c423d0) at gtkutil.c:176
gdpy = (GdkDisplay *) 0x8436a88
#10 0x0813e272 in x_delete_terminal (terminal=0x8c7f558) at
xterm.c:11855
dpyinfo = (struct x_display_info *) 0x8c5e878
i = 3
#11 0x0811ec22 in Fdelete_terminal (terminal=147322204, force=138295545)
at terminal.c:324
t = (struct terminal *) 0x8c7f558
#12 0x08094453 in Fdelete_frame (frame=139235804, force=138295497) at
frame.c:1545
tmp = 147322204
terminal = (struct terminal *) 0x8c7f558
f = (struct frame *) 0x84c91d8
sf = (struct frame *) 0x8403868
kb = (struct kboard *) 0x0
minibuffer_selected = 0
#13 0x081f14c4 in Ffuncall (nargs=1, args=0xbfffe750) at eval.c:3028
fun = 136761988
original_fun = 138330705
funcar = 138295545
numargs = 0
lisp_numargs = 135713370
val = -1073748216
backtrace = {next = 0xbfffe920, function = 0xbfffe750, args =
0xbfffe754, nargs = 0, evalargs = 0 '\0',
debug_on_exit = 0 '\0'}
internal_args = (Lisp_Object *) 0xbfffe6a0
i = 2
#14 0x081ecfbf in Fcall_interactively (function=138330705,
record_flag=138295545, keys=138333916) at callint.c:842
val = 138295497
args = (Lisp_Object *) 0xbfffe750
visargs = (Lisp_Object *) 0xbfffe740
specs = 136785395
filter_specs = 136785395
teml = 138295497
up_event = 138295497
enable = 138295497
speccount = 5
next_event = 14
prefix_arg = 138295497
string = (unsigned char *) 0xbfffe760 ""
tem = (unsigned char *) 0xbfffe760 ""
varies = (int *) 0xbfffe730
i = 1
j = 0
count = 0
foo = 140868632
prompt1 =
"\200\001\000\000Q�>\bQ�>address@hidden@address@hidden@address@hidden>\b\025��\b����\000��\005\230���K;\035\b\f\000\000"
tem1 = 0x0
arg_from_tty = 0
gcpro1 = {next = 0x40746be5, var = 0x1c, nvars = 136125298}
gcpro2 = {next = 0x83ec251, var = 0x0, nvars = 0}
gcpro3 = {next = 0x83e38c9, var = 0x83e38c9, nvars = 1}
gcpro4 = {next = 0x81d1b72, var = 0xbfffe7ec, nvars = 1}
gcpro5 = {next = 0x83e1d6d, var = 0x0, nvars = 0}
key_count = 14
record_then_fail = 0
save_this_command = 138330705
save_last_command = 138328441
save_this_original_command = 138487713
save_real_this_command = 138330705
#15 0x081f14f3 in Ffuncall (nargs=4, args=0xbfffe9b0) at eval.c:3031
fun = 137986028
original_fun = 138458361
funcar = 141286316
numargs = 3
lisp_numargs = 135812751
val = -1073747448
backtrace = {next = 0xbfffeb30, function = 0xbfffe9b0, args =
0xbfffe9b4, nargs = 3, evalargs = 0 '\0',
debug_on_exit = 0 '\0'}
internal_args = (Lisp_Object *) 0xbfffe9b4
i = 1
#16 0x081f1117 in call3 (fn=138458361, arg1=138330705, arg2=138295545,
arg3=138295497) at eval.c:2855
ret_ungc_val = 138295497
gcpro1 = {next = 0x83e0755, var = 0x83e38c9, nvars = 4}
#17 0x0817c839 in Fcommand_execute (cmd=138330705,
record_flag=138295545, keys=138295497, special=138295497)
at keyboard.c:10443
final = 136761988
tem = 138295497
prefixarg = 138295497
#18 0x0817cb79 in Fexecute_extended_command (prefixarg=138295497) at
keyboard.c:10556
function = 138330705
buf = "M-x
\000\000\000\000\b\000\000\000\020F�\b\000\000\000\000\204^�\b�����4\035\b\000\234\215\b\001\000\000"
saved_last_point_position = 1
saved_keys = 140335180
saved_last_point_position_buffer = 138321348
bindings = 141286316
value = 138295497
gcpro1 = {next = 0x1, var = 0x84c91d8, nvars = 138426888}
gcpro2 = {next = 0x83eaba9, var = 0x0, nvars = 1}
gcpro3 = {next = 0x83e1d5d, var = 0x83eaba9, nvars =
-1073747256}
hstarted = 1
#19 0x081f149f in Ffuncall (nargs=2, args=0xbfffebc0) at eval.c:3025
fun = 136779020
original_fun = 138334793
funcar = 138295497
numargs = 1
lisp_numargs = 135713370
val = -1073747080
backtrace = {next = 0xbfffed90, function = 0xbfffebc0, args =
0xbfffebc4, nargs = 1, evalargs = 0 '\0',
debug_on_exit = 0 '\0'}
internal_args = (Lisp_Object *) 0xbfffebc4
i = 138295497
#20 0x081ecfbf in Fcall_interactively (function=138334793,
record_flag=138295497, keys=138333916) at callint.c:842
val = 0
args = (Lisp_Object *) 0xbfffebc0
visargs = (Lisp_Object *) 0xbfffebb0
specs = 143498243
filter_specs = 143498243
teml = 0
up_event = 138295497
enable = 138295497
speccount = 3
next_event = 1
prefix_arg = 138295497
string = (unsigned char *) 0xbfffebd0 "P"
tem = (unsigned char *) 0x82670ac ""
varies = (int *) 0xbfffeba0
i = 2
j = 1
count = 1
foo = 0
prompt1 = '\0' <repeats 99 times>
tem1 = 0x0
arg_from_tty = 0
gcpro1 = {next = 0x0, var = 0x0, nvars = 0}
gcpro2 = {next = 0x0, var = 0x0, nvars = 0}
gcpro3 = {next = 0x0, var = 0x0, nvars = 2}
gcpro4 = {next = 0x0, var = 0x0, nvars = 2}
gcpro5 = {next = 0x0, var = 0x0, nvars = 0}
key_count = 1
record_then_fail = 0
save_this_command = 138334793
save_last_command = 138497537
save_this_original_command = 138334793
save_real_this_command = 138334793
#21 0x081f14f3 in Ffuncall (nargs=4, args=0xbfffee20) at eval.c:3031
fun = 137986028
original_fun = 138458361
funcar = 138295497
numargs = 3
lisp_numargs = 2
val = -1073747032
backtrace = {next = 0x0, function = 0xbfffee20, args =
0xbfffee24, nargs = 3, evalargs = 0 '\0',
debug_on_exit = 0 '\0'}
internal_args = (Lisp_Object *) 0xbfffee24
i = 0
#22 0x081f1117 in call3 (fn=138458361, arg1=138334793, arg2=138295497,
arg3=138295497) at eval.c:2855
ret_ungc_val = 138295497
gcpro1 = {next = 0x83e38c9, var = 0x83e38c9, nvars = 4}
#23 0x0817c839 in Fcommand_execute (cmd=138334793,
record_flag=138295497, keys=138295497, special=138295497)
at keyboard.c:10443
final = 136779020
tem = 138295497
prefixarg = 138295497
#24 0x0816eeea in command_loop_1 () at keyboard.c:1908
scount = 2
cmd = 138334793
lose = -1073746008
nonundocount = 0
keybuf = {1073742784, 960, -1073746120, 1081301168, 147286128,
1085183913, 0, 1085200928, -1073746068, 1,
-1073746100, 1085181697, -1073746040, 11459104, 1080932728,
-1073746016, 0, -1073746044, -1073746356, 0, 0, 0, 0, 0, 0,
0, 0, 0, 138295497, 143469681}
i = 1
prev_modiff = 1
prev_buffer = (struct buffer *) 0x83e9dc0
already_adjusted = 0
#25 0x081ef0f3 in internal_condition_case (bfun=0x816d8b2
<command_loop_1>, handlers=138339729, hfun=0x816d2af <cmd_error>)
at eval.c:1494
val = 138605317
c = {tag = 138295497, val = 138295497, next = 0xbffff120, gcpro
= 0x0, jmp = {{__jmpbuf = {-1073744960,
-1073744960, -1073745164, -1073745688, -1073746000, 136245384},
__mask_was_saved = 0, __saved_mask = {__val = {
136131703, 0, 0, 0, 1082158912, 147286128, 147286128,
3221221116, 1081359036, 147286128, 3221221144, 1082158912,
147286128, 3221221144, 1081372021, 147286128, 1081301168,
1082158912, 0, 147286128, 3221221176, 1081301168,
147286128, 1085183913, 0, 1085200928, 3221221228, 1,
3221221856, 138217632, 3221221844, 3221221704}}}},
backlist = 0x0, handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2,
poll_suppress_count = 1,
interrupt_input_blocked = 0, byte_stack = 0x0}
h = {handler = 138339729, var = 138295497, chosen_clause = 0,
tag = 0xbfffeff0, next = 0x0}
#26 0x0816d61a in command_loop_2 () at keyboard.c:1370
val = 0
#27 0x081eeb8f in internal_catch (tag=138334577, func=0x816d5f6
<command_loop_2>, arg=138295497) at eval.c:1230
c = {tag = 138334577, val = 138295497, next = 0x0, gcpro = 0x0,
jmp = {{__jmpbuf = {-1073744960, -1073744960,
-1073745164, -1073745400, -1073745648, 136244096},
__mask_was_saved = 0, __saved_mask = {__val = {135784103,
3221221856, 0, 0, 0, 0, 1, 3221221912, 135116808, 138427232,
0, 0, 0, 0, 0, 0, 0, 0, 1081374788, 0, 2, 147404648,
0, 0, 0, 0, 1081374788, 3221221880, 136159901, 138525137,
138521730, 138295497}}}}, backlist = 0x0,
handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2,
poll_suppress_count = 1, interrupt_input_blocked = 0,
byte_stack = 0x0}
#28 0x0816d5cf in command_loop () at keyboard.c:1349
No locals.
#29 0x0816cec9 in recursive_edit_1 () at keyboard.c:958
count = 1
val = -1073744960
#30 0x0816d02d in Frecursive_edit () at keyboard.c:1020
count = 0
buffer = 138295497
#31 0x0816b94e in main (argc=3, argv=0xbffff624) at emacs.c:1787
dummy = 136655259
stack_bottom_variable = -65 '�'
do_initial_setlocale = 1
skip_args = 1
rlim = {rlim_cur = 8388608, rlim_max = 18446744073709551615}
no_loadup = 0
junk = 0x0
(gdb) frame 9
#9 0x08162629 in xg_display_close (dpy=0x8c423d0) at gtkutil.c:176
176 g_object_run_dispose (G_OBJECT (gdpy));
(gdb) p gdpy
$1 = (GdkDisplay *) 0x8436a88
(gdb) p *gdpy
$2 = {parent_instance = {g_type_instance = {g_class = 0x8704f10}, ref_count =
2, qdata = 0x0}, queued_events = 0x8552844, queued_tail = 0x8552844,
button_click_time = {0, 0}, button_window = {0x0, 0x0}, button_number = {-1,
-1}, double_click_time = 250, core_pointer = 0x8992ec8, pointer_hooks =
0x403800ac, closed = 0, double_click_distance = 5, button_x = {0, 0}, button_y
= {0, 0}}
This is manually pasted from the M-x report-emacs-bug form on the emacs
that crashed:
In GNU Emacs 23.0.60.1 (i686-pc-linux-gnu, GTK+ Version 2.6.4)
of 2008-02-27 on tharsis
configured using `configure 'CFLAGS=-ggdb3 -fno-crossjumping''
Important settings:
value of $LC_ALL: en_US.UTF-8
value of $LC_COLLATE: nil
value of $LC_CTYPE: nil
value of $LC_MESSAGES: nil
value of $LC_MONETARY: nil
value of $LC_NUMERIC: nil
value of $LC_TIME: nil
value of $LANG: en_US.UTF-8
value of $XMODIFIERS: nil
locale-coding-system: utf-8-unix
default-enable-multibyte-characters: t
Major mode: Lisp Interaction
Minor modes in effect:
menu-bar-mode: t
file-name-shadow-mode: t
global-font-lock-mode: t
font-lock-mode: t
global-auto-composition-mode: t
auto-composition-mode: t
auto-compression-mode: t
line-number-mode: t
transient-mark-mode: t
Recent input:
ESC x r e p TAB o TAB r TAB RET
Recent messages:
("/var/src/emacs/src/emacs" "-Q")
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list... [2 times]