Discussion:
fileno(NULL) segfault in window_change_signal
Kalle Olavi Niemitalo
2006-11-25 08:33:20 UTC
Permalink
Emacs crashed. I didn't have gdb attached but I got a core dump.
Apparently one terminal was suspended while I resized another,
which confused window_change_signal into calling fileno(NULL).
I presume it should just skip suspended terminals, as their sizes
can be checked when they are eventually resumed.

This is lorentey at elte.hu--2004/emacs--multi-tty--0--patch-580
plus various hacks of my own.

(gdb) bt
#0 0xb7772bf1 in kill () from /lib/tls/libc.so.6
#1 0x080f5fdd in fatal_error_signal (sig=6) at /home/Kalle/src/emacs--kon--1/src/emacs.c:431
#2 <signal handler called>
#3 0xb7772bf1 in kill () from /lib/tls/libc.so.6
#4 0x080f55dc in abort () at /home/Kalle/src/emacs--kon--1/src/emacs.c:465
#5 0x0815f08b in Fsignal (error_symbol=137562537, data=168094621) at /home/Kalle/src/emacs--kon--1/src/eval.c:1621
#6 0x0815f1a8 in xsignal (error_symbol=0, data=0) at /home/Kalle/src/emacs--kon--1/src/eval.c:1720
#7 0x0815f480 in xsignal1 (error_symbol=0, arg=0) at /home/Kalle/src/emacs--kon--1/src/eval.c:1737
#8 0x0815f547 in error (m=0x81a6454 "Attempt to delete the sole visible or iconified frame", a1=0x0, a2=0x0, a3=0x0)
at /home/Kalle/src/emacs--kon--1/src/eval.c:1999
#9 0x08062f3e in Fdelete_frame (frame=171957772, force=137496777) at /home/Kalle/src/emacs--kon--1/src/frame.c:1381
#10 0x0815ec87 in Ffuncall (nargs=2, args=0xbfeb57c0) at /home/Kalle/src/emacs--kon--1/src/eval.c:2995
#11 0x08189c5b in Fbyte_code (bytestr=145901787, vector=152423908, maxdepth=48) at /home/Kalle/src/emacs--kon--1/src/bytecode.c:679
#12 0x0815e67f in funcall_lambda (fun=150418356, nargs=1, arg_vector=0xbfeb58f4) at /home/Kalle/src/emacs--kon--1/src/eval.c:3179
#13 0x0815eb0b in Ffuncall (nargs=2, args=0xbfeb58f0) at /home/Kalle/src/emacs--kon--1/src/eval.c:3049
#14 0x08189c5b in Fbyte_code (bytestr=145901483, vector=150648932, maxdepth=40) at /home/Kalle/src/emacs--kon--1/src/bytecode.c:679
#15 0x0815e67f in funcall_lambda (fun=149987268, nargs=2, arg_vector=0xbfeb5a14) at /home/Kalle/src/emacs--kon--1/src/eval.c:3179
#16 0x0815eb0b in Ffuncall (nargs=3, args=0xbfeb5a10) at /home/Kalle/src/emacs--kon--1/src/eval.c:3049
#17 0x08160233 in Fapply (nargs=2, args=0xbfeb5a64) at /home/Kalle/src/emacs--kon--1/src/eval.c:2480
#18 0x08160363 in apply1 (fn=148662497, arg=168095085) at /home/Kalle/src/emacs--kon--1/src/eval.c:2744
#19 0x0818fe2d in read_process_output_call (fun_and_args=168095077) at /home/Kalle/src/emacs--kon--1/src/process.c:4916
#20 0x0815ccd1 in internal_condition_case_1 (bfun=0x818fe10 <read_process_output_call>, arg=168095077, handlers=137562537,
hfun=0x8191450 <exec_sentinel_error_handler>) at /home/Kalle/src/emacs--kon--1/src/eval.c:1525
#21 0x0818ff99 in exec_sentinel (proc=147171924, reason=166500675) at /home/Kalle/src/emacs--kon--1/src/process.c:6593
#22 0x0819161a in status_notify (deleting_process=0x8c5aa50) at /home/Kalle/src/emacs--kon--1/src/process.c:6696
#23 0x08194108 in Fdelete_process (process=147171924) at /home/Kalle/src/emacs--kon--1/src/process.c:835
#24 0x0819427a in kill_buffer_processes (buffer=137496777) at /home/Kalle/src/emacs--kon--1/src/process.c:6340
#25 0x080f5d6f in shut_down_emacs (sig=11, no_x=0, stuff=137496777) at /home/Kalle/src/emacs--kon--1/src/emacs.c:2141
#26 0x080f603a in fatal_error_signal (sig=11) at /home/Kalle/src/emacs--kon--1/src/emacs.c:414
#27 <signal handler called>
#28 0xb77a7891 in fileno_unlocked () from /lib/tls/libc.so.6
#29 0x0805ad08 in window_change_signal (signalnum=28) at /home/Kalle/src/emacs--kon--1/src/dispnew.c:6175
#30 <signal handler called>
#31 0xb78132f8 in ___newselect_nocancel () from /lib/tls/libc.so.6
#32 0x0818fe05 in select_wrapper (n=Variable "n" is not available.
) at /home/Kalle/src/emacs--kon--1/src/process.c:4186
#33 0x08191e21 in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=137496777,
wait_proc=0x0, just_wait_proc=0) at /home/Kalle/src/emacs--kon--1/src/process.c:4555
#34 0x0805b1c3 in sit_for (timeout=240, reading=1, do_display=1) at /home/Kalle/src/emacs--kon--1/src/dispnew.c:6575
#35 0x08102b24 in read_char (commandflag=1, nmaps=3, maps=0xbfeb6b10, prev_event=137496777, used_mouse_menu=0xbfeb6bb8, end_time=0x0)
at /home/Kalle/src/emacs--kon--1/src/keyboard.c:2869
#36 0x081044f8 in read_key_sequence (keybuf=0xbfeb6c54, bufsize=30, prompt=137496777, dont_downcase_last=0,
can_return_switch_frame=1, fix_current_buffer=1) at /home/Kalle/src/emacs--kon--1/src/keyboard.c:9044
#37 0x08106111 in command_loop_1 () at /home/Kalle/src/emacs--kon--1/src/keyboard.c:1610
#38 0x0815cfbb in internal_condition_case (bfun=0x8105f70 <command_loop_1>, handlers=137562537, hfun=0x80fdfd0 <cmd_error>)
at /home/Kalle/src/emacs--kon--1/src/eval.c:1475
#39 0x080f82be in command_loop_2 () at /home/Kalle/src/emacs--kon--1/src/keyboard.c:1399
#40 0x0815cecc in internal_catch (tag=-4, func=0x80f8290 <command_loop_2>, arg=137496777)
at /home/Kalle/src/emacs--kon--1/src/eval.c:1210
#41 0x080f8099 in command_loop () at /home/Kalle/src/emacs--kon--1/src/keyboard.c:1378
#42 0x080f8144 in recursive_edit_1 () at /home/Kalle/src/emacs--kon--1/src/keyboard.c:990
#43 0x080f826c in Frecursive_edit () at /home/Kalle/src/emacs--kon--1/src/keyboard.c:1052
#44 0x080f7079 in main (argc=2, argv=0xbfeb7334) at /home/Kalle/src/emacs--kon--1/src/emacs.c:1798
(gdb) frame 5
#5 0x0815f08b in Fsignal (error_symbol=137562537, data=168094621) at /home/Kalle/src/emacs--kon--1/src/eval.c:1621
1621 abort ();
(gdb) list
1616 struct backtrace *bp;
1617
1618 immediate_quit = handling_signal = 0;
1619 abort_on_gc = 0;
1620 if (gc_in_progress || waiting_for_input)
1621 abort ();
1622
1623 if (NILP (error_symbol))
1624 real_error_symbol = Fcar (data);
1625 else
(gdb) print gc_in_progress
$9 = 0
(gdb) print waiting_for_input
$10 = 1

(gdb) frame 29
#29 0x0805ad08 in window_change_signal (signalnum=28) at /home/Kalle/src/emacs--kon--1/src/dispnew.c:6175
6175 get_tty_size (fileno (tty->input), &width, &height);
(gdb) list
6170 for (tty = tty_list; tty; tty = tty->next) {
6171
6172 if (! tty->term_initted)
6173 continue;
6174
6175 get_tty_size (fileno (tty->input), &width, &height);
6176
6177 if (width > 5 && height > 2) {
6178 Lisp_Object tail, frame;
6179
(gdb) print tty_list
$13 = (struct tty_display_info *) 0x94a3d38
(gdb) print tty_list->next
$14 = (struct tty_display_info *) 0x85b59a8
(gdb) print tty_list->next->next
$15 = (struct tty_display_info *) 0x0
(gdb) print tty_list->input
$16 = (FILE *) 0x0
(gdb) print tty_list->next->input
$17 = (FILE *) 0x85af758
(gdb) print tty
$18 = (struct tty_display_info *) 0x94a3d38
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 188 bytes
Desc: not available
Url : http://lists.fnord.hu/pipermail/multi-tty/attachments/20061125/02fd1bd3/attachment.pgp
Loading...