🚀 go-pugleaf

In GNU Emacs 19.25.2 of Wed Jun 22 1994 on muir.arc.nasa.gov (sparc-sun-sunos4.1)

This is default 19.25, except for the "Control-z kills emacs" posted patch.
Sparcs (1,2,10), SunOS 4.1.3, X.V11R5 from MIT, mwm although I think we've
had this problem with twm too.

Configured for `sparc-sun-sunos4.1':
   ./configure sparc-sun-sunos4.1 --prefix=/usr/local2 \
         --x-includes=/usr/local/X.V11R5/include/ \
         --x-libs=/usr/local/X.V11R5/lib/ \
         --with-x-toolkit=athena \

General comment: we've had several users here who've bus-error'ed emacs on
large 19.2[1235] images with multiple frames, substantial use of menu
pull-downs, large SZ's.  We've not been able to track this down before.

Specific report (best we've gotten so far):

With an 19.25 image running multiple frames, running CVS (if that matters, I
doubt it), I bus-errored when I clicked on a menubar pull-down (I think it
was then, it happened quickly).  This is not repeatable; it was after I'd
been running emacs for hours.  However, we have a core-dump.

Below we have a backtrace.  It appears that the problem is a 'deadbeef'
pointer field in mw->menu.old_stack[1], in function size_menu.

We are more than happy to provide the core file (10M, or 500k gzip'ed), let
us know where/whether we should upload it.  I know you'd rather have
repeatable, but since it takes lot of work to get this we're not sure how.

Backtrace:
(gdb) bt
#0  0x1169d0 in kill ()
#1  0x2dbe0 in fatal_error_signal (sig=10) at emacs.c:164
#2  0x132fa4 in _sigtramp ()
#3  0x90bd8 in size_menu_item (mw=0x3004b8, val=0xdeadbeef, horizontal_p=0, label_width=0xf7fdd094, 
    rest_width=0xf7fdd090, height=0xf7fdd08c) at xlwmenu.c:288
#4  0x90d4c in size_menu (mw=0x3004b8, level=-559038737) at xlwmenu.c:339
#5  0x919b4 in remap_menubar (mw=0x3004b8) at xlwmenu.c:812
#6  0x926a8 in handle_single_motion_event (mw=0x3004b8, ev=0xf7fdd648) at xlwmenu.c:1278
#7  0x926dc in handle_motion_event (mw=0x3004b8, ev=0xf7fdd648) at xlwmenu.c:1293
#8  0x927b4 in Start (w=0x3004b8, ev=0xf7fdd648, params=0x0, num_params=0x1c5db8) at xlwmenu.c:1323
#9  0xd1aac in _XtMatchAtom ()
#10 0xd207c in _XtMatchAtom ()
#11 0xd25f4 in _XtTranslateEvent ()
#12 0xb5720 in _XtFreeWWTable ()
#13 0xb5e30 in _XtOnGrabList ()
#14 0xb5f00 in XtDispatchEvent ()
#15 0x1d20c in XTread_socket (sd=1, bufp=0xf7fde738, numchars=4095, waitp=16777215, expected=234881024)
    at xterm.c:4289
#16 0x3354c in read_avail_input (expected=234881024) at keyboard.c:3398
#17 0x33750 in input_available_signal (signo=23) at keyboard.c:3543
#18 0x132fa4 in _sigtramp ()
#19 0x89d98 in wait_reading_process_input (time_limit=0, microsecs=0, read_kbd=16777215, do_display=1)
    at process.c:1951
#20 0x31598 in kbd_buffer_get_event () at keyboard.c:1991
#21 0x30b64 in read_char (commandflag=1, nmaps=2, maps=0xf7fff420, prev_event=18656068, 
    used_mouse_menu=0xf7fff568) at keyboard.c:1636
#22 0x34ce4 in read_key_sequence (keybuf=0xf7fff5d8, bufsize=30, prompt=18656068) at keyboard.c:4540
#23 0x2fa10 in command_loop_1 () at keyboard.c:1013
#24 0x718fc in internal_condition_case (bfun=0x2f7ec <command_loop_1>, handlers=18656368, 
    hfun=0x2f1e4 <cmd_error>) at eval.c:1096
#25 0x2f574 in command_loop_2 () at keyboard.c:859
#26 0x71458 in internal_catch (tag=18656348, func=0x2f550 <command_loop_2>, arg=18656068) at eval.c:886
#27 0x2f520 in command_loop () at keyboard.c:839
#28 0x2f030 in recursive_edit_1 () at keyboard.c:674
#29 0x2f160 in Frecursive_edit () at keyboard.c:716
#30 0x2e5d0 in main (argc=1, argv=0xf7fffa64, envp=0xf7fffa6c) at emacs.c:755

(gdb) up 4
#4  0x90d4c in size_menu (mw=0x3004b8, level=-559038737) at xlwmenu.c:339
339           size_menu_item (mw, val, horizontal_p, &label_width, &rest_width,
(gdb) l
334       ws->height = 0;
335       ws->label_width = 0;
336
337       for (val = mw->menu.old_stack [level]->contents; val; val = val->next)
338         {
339           size_menu_item (mw, val, horizontal_p, &label_width, &rest_width,
340                           &height);
341           if (horizontal_p)
342             {
343               ws->width += label_width + rest_width;
(gdb) p *mw->menu.old_stack[1]
$1 = {name = 0xdeadbeef<Address 0xdeadbeef out of bounds>, 
  value = 0xdeadbeef<Address 0xdeadbeef out of bounds>, 
  key = 0xdeadbeef<Address 0xdeadbeef out of bounds>, enabled = 1 '\001', selected = 0 '\000', 
  edited = 0 '\000', change = NO_CHANGE, contents = 0xdeadbeef, call_data = 0x0, next = 0x0, 
  toolkit_data = 0x0, free_toolkit_data = 0 '\000', free_list = 0x0}

The value of level is 1, the problem happens at line 339 above, when you try
to access something through the val pointer.

It appears the problem is that we're accessing something that was freed in
free_menubar_widget_value_tree (from grep'ing from DEADBEEF).

Sorry we're unable to be more specific in this message -- please let us know
how to get you the core-file.  If there are better gdb commands we can do, let
us know.

Kevin Thompson (and Colin Howell)

-- 
kthompso@ptolemy.arc.nasa.gov     Artificial Intelligence Research Laboratory
(415) 604-4767 (voicemail)        NASA-Ames Research Center, Moffett Field, CA