bug#34394: 27.0.50; Emacs segfaults with SLY, company and C-g

[João Távora]

Hi,

This has been happening for a while, but I finally had some time to
track it down.  The problem renders Emacs completely unusable.

Before the recipe and some debugging info, a few notes:

1. The problem happens exlusively with company-mode. It's not easy to
   trigger but I have narrowed a technique that takes me a few minutes a
   most.

2. When using optimized builds, it's not really a SIGSEGV but a strange
   freeze in the display.
   
   The following is printed to stderr, if Emacs was started from the
   terminal:
   
      *** longjmp causes uninitialized stack frame ***: ./src/emacs terminated
      Fatal error 6: Aborted
      
   Very bizarrely, I can still open another frame to the Emacs
   (i.e. from a terminal) if i have the server running, but the buffer
   contents won't be displayed.  Back in the broken GUI I can even use
   the minibuffer to save the buffer to a file, request completions, and
   jump out to another window and apparently resume normal usage.

   But eventually there is always a broken window/display/buffer.

   Evidently, I can't understand what's going on.  But if you know some
   elisp diagnostic command, I can probably still type it in and read
   its output.
      
3. In contrast, when using a non-optimized build I always see SIGSEGV
   and the process dies completely, under gdb or not.
   
4. Also bizarely, when using non-optimized build, configured with:

      ./configure --enable-checking='yes,glyphs' \
      --enable-check-lisp-object-type CFLAGS='-O0 -g3 -gdwarf-4'

   I get _less_ information in gdb than when debugging an
   optimized build:
   
      (gdb) bt full
      #0  0x0000000000000000 in ?? ()
      No symbol table info available.
      #1  0x0000000000000000 in ?? ()
      No symbol table info available.
      (gdb) xbacktrace
      (gdb)

5. Debugging an optimized build gave me much more information (search
   for "yes-optimized-gdb" from here).

6. The use of SLY, a Common Lisp IDE, is not necessary.  I've seen the
   same bug with Eglot and company.  What Eglot has in common with SLY
   is that they both set up a completion-at-point-function that requests
   completions from a subprocess.  The specific manner in which
   completions are requested is interruptable by user input, i.e. using
   either sit-for or while-no-input.  I've witnessed the problem using
   both approaches, though lately I've settled for sit-for in both
   systems.
   
   In Emacs core, the elisp function jsonrpc-request (used by Eglot) is
   where the interruptible sit-for approach in used.

   Nevertheless this recipe uses SLY, since I've been using it more
   often these days.
   
7. I've can get a little more information with a non-optimized build if
   I start without Emacs -Q and load my normal config file.  It's not
   much more info than above, tho, and I don't understand what the
   difference is.  But you can have a look if you search for
   "non-optimized-gdb" from here.
   
Thanks,
João
   
## Now for the reproduction recipe:

The easiest way to get SLY is to clone it from github

   git clone git@github.com:joaotavora/sly.git /path/to/sly

To get company:

   git clone git@github.com:company-mode/company-mode.git
   /path/to/company
   
You also need a Common Lisp executable in your path.  For Debian this
will probably do

   sudo apt-get install sbcl

Now start Emacs

   ~/Source/Emacs/emacs/src/emacs -Q                             \
   -L /path/to/sly -l sly-autoloads                              \
   -L /path/to/company-mode -l /path/to/company-mode/company.el  \
   -f global-company-mode                                        \
   -f sly  # start sly
   
After the SLY CL prompt is ready, type "pos". A company widget should
appear.

You should now move quickly <up> and <down> as if selecting a completion
and then quickly press C-g as if wanting to give up on those
completions.  If you do this often enough you will trigger the crash.

## Running this under GDB, (yes-optimized-gdb)

The optimized build was configured with

   --enable-checking=yes,glyphs --enable-check-lisp-object-type 'CFLAGS=-Og 
-gdwarf-4'

gdb --args ./emacs -Q -L ~/Source/Emacs/sly -l sly-autoloads -L 
~/Source/Emacs/company-mode -l ~/Source/Emacs/company-mode/company.el -f 
global-company-mode -f sly
GNU gdb (Debian 8.2-1) 8.2
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./emacs...done.
SIGINT is used by the debugger.
Are you sure you want to change it? (y or n) [answered Y; input not from 
terminal]
DISPLAY = :0
TERM = xterm
Breakpoint 1 at 0x15015c: file emacs.c, line 370.
Temporary breakpoint 2 at 0x172efd: file lisp.h, line 1056.
(gdb) r
Starting program: /home/capitaomorte/Source/Emacs/emacs-master/src/emacs -Q -L 
/home/capitaomorte/Source/Emacs/sly -l sly-autoloads -L 
/home/capitaomorte/Source/Emacs/company-mode -l 
/home/capitaomorte/Source/Emacs/company-mode/company.el -f global-company-mode 
-f sly
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[Detaching after vfork from child process 17193]
[Detaching after vfork from child process 17201]
[Detaching after vfork from child process 17202]
*** longjmp causes uninitialized stack frame ***: 
/home/capitaomorte/Source/Emacs/emacs-master/src/emacs terminated

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt full
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {
          __val = {0, 0, 93825000843456, 140737328736549, 11310, 
93825000838608, 93825000883760, 1, 140737488341936, 
            140737305084542, 93825008640256, 16777216000000000000, 
140737488342240, 93825000373056, 4294967256, 1}
        }
        pid = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
#1  0x00007ffff4f6d535 in __GI_abort () at abort.c:79
        save_stage = 1
        act = {
          __sigaction_handler = {
            sa_handler = 0x1, 
            sa_sigaction = 0x1
          }, 
          sa_mask = {
            __val = {140737305057658, 1937910009842106368, 8260008066545429248, 
32, 1, 2, 140737488342496, 93825000021600, 
              140737488342544, 140737488342480, 140737305057352, 1, 
140737305057658, 1937910009842106368, 140737488342400, 
              140737488342800}
          }, 
          sa_flags = -12928, 
          sa_restorer = 0x1000
        }
        sigs = {
          __val = {32, 0 <repeats 15 times>}
        }
#2  0x00007ffff4fc4718 in __libc_message (action=<optimized out>, 
fmt=fmt@entry=0x7ffff50cf088 "*** %s ***: %s terminated\n")
    at ../sysdeps/posix/libc_fatal.c:181
        ap = {{
            gp_offset = 32, 
            fp_offset = 465, 
            overflow_arg_area = 0x7fffffffcf20, 
            reg_save_area = 0x7fffffffceb0
          }}
        fd = 11
        list = <optimized out>
        nlist = <optimized out>
        cp = <optimized out>
        written = <optimized out>
#3  0x00007ffff5055bbd in __GI___fortify_fail_abort 
(need_backtrace=need_backtrace@entry=true, 
    msg=0x7ffff50cf03d <longjmp_msg> "longjmp causes uninitialized stack 
frame") at fortify_fail.c:28
No locals.
#4  0x00007ffff5055bf1 in __GI___fortify_fail (msg=<optimized out>) at 
fortify_fail.c:44
No locals.
#5  0x00007ffff5055aad in ____longjmp_chk () at 
../sysdeps/unix/sysv/linux/x86_64/____longjmp_chk.S:105
No locals.
#6  0x00007ffff5055a0b in __longjmp_chk (env=0x555555d01238 <main_thread+216>, 
val=val@entry=1) at ../setjmp/longjmp.c:39
No locals.
#7  0x00005555556b22d4 in quit_throw_to_read_char 
(from_signal=from_signal@entry=false) at keyboard.c:10486
No locals.
#8  0x00005555556ba3cd in set_waiting_for_input 
(time_to_clear=time_to_clear@entry=0x7fffffffd130) at keyboard.c:10253
No locals.
--Type <RET> for more, q to quit, c to continue without paging--
#9  0x000055555579007c in wait_reading_process_output 
(time_limit=time_limit@entry=30, nsecs=nsecs@entry=0, read_kbd=-1, 
    do_display=do_display@entry=true, wait_for_cell=..., 
wait_proc=wait_proc@entry=0x0, just_wait_proc=0) at process.c:5212
        process_skipped = false
        channel = <optimized out>
        nfds = <optimized out>
        Available = {
          fds_bits = {16, 0 <repeats 15 times>}
        }
        Writeok = {
          fds_bits = {0 <repeats 16 times>}
        }
        check_write = <optimized out>
        check_delay = <optimized out>
        no_avail = <optimized out>
        xerrno = 11
        proc = XIL(0x555556473955)
        timeout = {
          tv_sec = 29, 
          tv_nsec = 861423452
        }
        end_time = <optimized out>
        timer_delay = <optimized out>
        got_output_end_time = <optimized out>
        wait = TIMEOUT
        got_some_output = -1
        prev_wait_proc_nbytes_read = 0
        retry_for_async = false
        count = 3
        now = <optimized out>
#10 0x00005555555983ac in sit_for (timeout=..., timeout@entry=make_number(30), 
reading=reading@entry=true, 
    display_option=display_option@entry=1) at lisp.h:1056
        sec = 30
        nsec = 0
        do_display = true
#11 0x00005555556b6209 in read_char (commandflag=1, map=..., 
map@entry=XIL(0x555556bba943), prev_event=XIL(0), 
    used_mouse_menu=used_mouse_menu@entry=0x7fffffffd5cb, 
end_time=end_time@entry=0x0) at lisp.h:751
        tem0 = <optimized out>
        timeout = 30
        delay_level = <optimized out>
        buffer_size = <optimized out>
        c = XIL(0)
        jmpcount = 3
        local_getcjmp = {{
            __jmpbuf = {0, 7951441480105110497, 93825009979408, 93825001081184, 
140737488344720, 0, 4254887586582539233, 
              7951440073964956641}, 
            __mask_was_saved = 0, 
            __saved_mask = {
              __val = {93825009136931, 0, 93824993581685, 3, 0, 4294967295, 3, 
93825001229536, 93824993726913, 0, 0, 0, 7655440, 
                0, 93824993581685, 8194}
            }
          }}
        save_jump = {{
--Type <RET> for more, q to quit, c to continue without paging--
            __jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, 
            __mask_was_saved = 0, 
            __saved_mask = {
              __val = {0 <repeats 16 times>}
            }
          }}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = XIL(0)
        also_record = XIL(0)
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x555555d68c90
#12 0x00005555556b74f5 in read_key_sequence 
(keybuf=keybuf@entry=0x7fffffffd690, prompt=XIL(0x555555d68c90), 
    dont_downcase_last=dont_downcase_last@entry=false, 
can_return_switch_frame=can_return_switch_frame@entry=true, 
    fix_current_buffer=fix_current_buffer@entry=true, 
prevent_redisplay=prevent_redisplay@entry=false) at keyboard.c:9082
        interrupted_kboard = 0x555555d68c90
        interrupted_frame = 0x555555dc4960
        key = XIL(0x555556641010)
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = <optimized out>
        new_binding = <optimized out>
        count = 3
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = <optimized out>
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {
          parent = XIL(0x555555d84f73), 
          map = XIL(0x555555d84f73), 
          start = 0, 
          end = 0
        }
        keytran = {
          parent = XIL(0x7ffff103d5cb), 
          map = XIL(0x7ffff103d5cb), 
          start = 0, 
          end = 0
        }
        indec = {
          parent = XIL(0x555555d84f63), 
          map = XIL(0x555555d84f63), 
          start = 0, 
          end = 0
        }
        shift_translated = false
--Type <RET> for more, q to quit, c to continue without paging--
        delayed_switch_frame = <optimized out>
        original_uppercase = <optimized out>
        original_uppercase_position = -1
        dummyflag = false
        starting_buffer = 0x555556641010
        fake_prefixed_keys = <optimized out>
        first_event = <optimized out>
        second_event = <optimized out>
#13 0x00005555556b8bc1 in command_loop_1 () at lisp.h:1056
        cmd = <optimized out>
        keybuf = {XIL(0x50a0), XIL(0x555555c595e5), XIL(0x2aaa9b297918), 
XIL(0x3), XIL(0x3), XIL(0x555555742c17), XIL(0), 
          XIL(0x555556ad8393), XIL(0x7fffffffd750), XIL(0x2aaa9b297918), 
XIL(0), XIL(0), XIL(0), make_number(23456248568811), 
          XIL(0x2aaa9b297918), XIL(0x555556ad8393), XIL(0x7ffff0ad5f74), 
XIL(0), XIL(0x7fffffffd750), XIL(0x5555556acf45), XIL(0), 
          XIL(0x555556ad8393), XIL(0), XIL(0x5555556ad2bb), XIL(0), XIL(0), 
XIL(0x3), XIL(0x55555574182b), XIL(0x7ffff104060b), 
          XIL(0x555555d68a50)}
        i = <optimized out>
        prev_modiff = 36
        prev_buffer = 0x555556641010
#14 0x0000555555741a96 in internal_condition_case 
(bfun=bfun@entry=0x5555556b8943 <command_loop_1>, handlers=..., 
    handlers@entry=XIL(0x55b0), hfun=hfun@entry=0x5555556acf6d <cmd_error>) at 
eval.c:1376
        val = XIL(0)
        c = 0x555555d68a50
#15 0x00005555556a9494 in command_loop_2 (ignore=..., ignore@entry=XIL(0)) at 
lisp.h:1056
        val = <optimized out>
#16 0x00005555557419da in internal_catch (tag=..., 
func=func@entry=0x5555556a9478 <command_loop_2>, arg=..., arg@entry=XIL(0))
    at eval.c:1139
        val = XIL(0)
        c = 0x555555d68930
#17 0x00005555556a6786 in command_loop () at lisp.h:1056
No locals.
#18 0x00005555556ac728 in recursive_edit_1 () at keyboard.c:714
        count = 1
        val = <optimized out>
#19 0x00005555556accf0 in Frecursive_edit () at keyboard.c:785
        count = 0
        buffer = <optimized out>
#20 0x00005555556a5154 in main (argc=14, argv=<optimized out>) at emacs.c:1949
        stack_bottom_variable = 0x5555557f9155 <__libc_csu_init+69>
        do_initial_setlocale = <optimized out>
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = <optimized out>
        skip_args = 0
        temacs = 0x0
        rlim = {
          rlim_cur = 10022912, 
          rlim_max = 18446744073709551615
        }
        
## non-optimized-gdb

gdb ./emacs            
GNU gdb (Debian 8.2-1) 8.2
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./emacs...done.
SIGINT is used by the debugger.
Are you sure you want to change it? (y or n) [answered Y; input not from 
terminal]
DISPLAY = :0
TERM = xterm
Breakpoint 1 at 0x1ad3b8: file emacs.c, line 371.
Temporary breakpoint 2 at 0x1d9e93: file sysdep.c, line 1101.
(gdb) r
Starting program: /home/capitaomorte/Source/Emacs/emacs/src/emacs 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[Detaching after vfork from child process 17713]
[Detaching after vfork from child process 17718]
[Detaching after vfork from child process 17719]
[Detaching after vfork from child process 17721]
[Detaching after vfork from child process 17725]
[Detaching after vfork from child process 17726]
[Detaching after vfork from child process 17729]
[Detaching after vfork from child process 17754]
[Detaching after vfork from child process 17755]
[Detaching after vfork from child process 17769]

Program received signal SIGSEGV, Segmentation fault.
0x0000000000000000 in ?? ()
(gdb) bt full
#0  0x0000000000000000 in ?? ()
No symbol table info available.
#1  0x00005555557d02ae in do_one_unbind (this_binding=0x7fffffff85a0, 
unwinding=true, bindflag=SET_INTERNAL_UNBIND) at eval.c:3504
No locals.
#2  0x00005555557d0763 in unbind_to (count=8589905392, value=XIL(0)) at 
eval.c:3631
        this_binding = {
          kind = SPECPDL_UNWIND, 
          unwind = {
            kind = SPECPDL_UNWIND, 
            func = 0x0, 
            arg = XIL(0), 
            eval_depth = 0
          }, 
          unwind_array = {
            kind = SPECPDL_UNWIND, 
            nelts = 0, 
            array = 0x0
          }, 
          unwind_ptr = {
            kind = SPECPDL_UNWIND, 
            func = 0x0, 
            arg = 0x0
          }, 
          unwind_int = {
            kind = SPECPDL_UNWIND, 
            func = 0x0, 
            arg = 0
          }, 
          unwind_excursion = {
            kind = SPECPDL_UNWIND, 
            marker = XIL(0), 
            window = XIL(0)
          }, 
          unwind_void = {
            kind = SPECPDL_UNWIND, 
            func = 0x0
          }, 
          let = {
            kind = SPECPDL_UNWIND, 
            symbol = XIL(0), 
            old_value = XIL(0), 
            where = XIL(0), 
            saved_value = XIL(0)
          }, 
          bt = {
            kind = SPECPDL_UNWIND, 
            debug_on_exit = false, 
            function = XIL(0), 
            args = 0x0, 
            nargs = 0
          }
        }
--Type <RET> for more, q to quit, c to continue without paging--c
        quitf = XIL(0xc750)
#3  0x000055555570a27b in read_char (commandflag=21845, 
map=XIL(0x555556e3cc00), prev_event=XIL(0x20), used_mouse_menu=0x7ffff0abeabd, 
end_time=0x3d5579264f) at keyboard.c:2551
        c = XIL(0x7fffffff8868)
        jmpcount = 8589905392
        local_getcjmp = {{
            __jmpbuf = {140737488324512, 1433386485, 171798691841, 
140737236181973, 140737488324608, 140737488325824, 93825017529728, 
140737488324604}, 
            __mask_was_saved = 0, 
            __saved_mask = {
              __val = {140737326527355, 140737488324656, 140737488325872, 
93825017529728, 140737488324652, 0, 140737326527355, 93825003666096, 
140737488325804, 140737488325868, 4294967296, 18446744069414584321, 1432946432, 
140737488324752, 108819530576, 140737236339464}
            }
          }}
        save_jump = {{
            __jmpbuf = {140737488324320, 93824993965235, 140737488324336, 0, 0, 
107374182400, 140737236339464, 140737488324360}, 
            __mask_was_saved = 1433384518, 
            __saved_mask = {
              __val = {111669118032, 140737488324448, 140737488325664, 
93825017529728, 140737488324444, 0, 140737326527355, 140737488324496, 
140737488325712, 93825017529728, 140737488324492, 0, 140737326527355, 
93825003666096, 140737488325644, 140737488325708}
            }
          }}
        tem = XIL(0x555556e3cbe5)
        save = XIL(0x7fffffff86d0)
        previous_echo_area_message = XIL(0x7ffff0b3c5ad)
        also_record = XIL(0)
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x7ffff65ab37b <XftGlyphExtents+123>
#4  0x00007fffffffa3a0 in ?? ()
No symbol table info available.
#5  0x00007fffffff8dec in ?? ()
No symbol table info available.
#6  0x00000001ffffb2b0 in ?? ()
No symbol table info available.
#7  0x0000000000000000 in ?? ()
No symbol table info available.
(gdb) xbacktrace
(gdb)