bug#63614: 29.0.91; PGTK Emacs crashes after clearing the clipboard

[Leonardo Hernández Hernández]

On Thu, May 25, 2023 at 04:35:56AM -0600, Po Lu wrote:
> OK, thanks.  Does the crash still happen with this?
> 
> diff --git a/src/pgtkterm.c b/src/pgtkterm.c
> index b8c626d81d8..bbe68f04adc 100644
> --- a/src/pgtkterm.c
> +++ b/src/pgtkterm.c
> @@ -6606,8 +6606,7 @@ pgtk_selection_event (GtkWidget *widget, GdkEvent 
> *event,
> 
>    if (event->type == GDK_PROPERTY_NOTIFY)
>      pgtk_handle_property_notify (&event->property);
> -  else if (event->type == GDK_SELECTION_CLEAR
> -        || event->type == GDK_SELECTION_REQUEST)
> +  else if (event->type == GDK_SELECTION_REQUEST)
>      {
>        f = pgtk_find_selection_owner (event->selection.window);
> 

The crash does not happen when copying text from outside emacs,
however it crashes when pasting text killed from emacs,
for example, open `emacs -Q` kill some text and try to paste that
text outside emacs (just run `wl-paste`)

Here the backtrace:
(gdb) bt full
#0  0x00007f1daf5d58ec in  () at /usr/lib64/libc.so.6
#1  0x00007f1daf5863e2 in raise () at /usr/lib64/libc.so.6
#2  0x00005634e0ec7c68 in terminate_due_to_signal (sig=11, 
backtrace_limit=<optimized out>)
    at emacs.c:464
#3  0x00005634e0ec8abb in handle_fatal_signal (sig=11) at sysdep.c:1783
        fatal = <optimized out>
#4  deliver_thread_signal (handler=<optimized out>, sig=11) at sysdep.c:1775
        fatal = <optimized out>
#5  deliver_fatal_thread_signal (sig=11) at sysdep.c:1795
        fatal = <optimized out>
#6  handle_sigsegv (sig=11, siginfo=0x5634e174fcb0 <sigsegv_stack+64528>, 
arg=<optimized out>)
    at sysdep.c:1888
        fatal = <optimized out>
#7  0x00007f1daf586490 in <signal handler called> () at /usr/lib64/libc.so.6
#8  pgtk_handle_selection_request (event=0x7fffdb8c9420) at pgtkselect.c:573
        local_selection_time = <optimized out>
        dpyinfo = 0xe35f53a0
        selection = 0x45
        selection_symbol = 0x150
        target = <optimized out>
        target_symbol = 0x2a30
        property = 0x5d
        local_selection_data = <optimized out>
        success = false
        pushed = false
        alias = <optimized out>
        tem = <optimized out>
#9  0x00005634e0fe4a75 in pgtk_handle_selection_event (event=0x7fffdb8c9420) at 
pgtkselect.c:784
        event = 0x5634e16fff20 <kbd_buffer+1856>
        copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0xe35f53a0, requestor 
= 0x5634e3756330, selection = 0x45, target = 0x4c, property = 0x5d, time = 0}
        moved_events = <optimized out>
#10 process_special_events () at keyboard.c:4449
        event = 0x5634e16fff20 <kbd_buffer+1856>
        copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0xe35f53a0, requestor 
= 0x5634e3756330, selection = 0x45, target = 0x4c, property = 0x5d, time = 0}
        moved_events = <optimized out>
#11 0x00005634e0fe5bed in swallow_events (do_display=true) at keyboard.c:4489
        old_timers_run = <optimized out>
#12 0x00005634e110195c in wait_reading_process_output
    (time_limit=<optimized out>, nsecs=<optimized out>, read_kbd=<optimized 
out>, do_display=<optimized out>, wait_for_cell=<optimized out>, 
wait_proc=<optimized out>, just_wait_proc=<optimized out>)
    at process.c:5781
        leave = false
        wrapped = <optimized out>
        process_skipped = <optimized out>
        channel_start = <optimized out>
        child_fd = <optimized out>
        channel = <optimized out>
        nfds = <optimized out>
        Available = {fds_bits = {16, 0 <repeats 15 times>}}
        Writeok = {fds_bits = {0 <repeats 16 times>}}
        check_write = true
        check_delay = <optimized out>
        no_avail = false
        xerrno = 11
        proc = <optimized out>
        timeout = {tv_sec = 0, tv_nsec = 0}
        end_time = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        timer_delay = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        got_output_end_time = {tv_sec = <optimized out>, tv_nsec = <optimized 
out>}
        wait = <optimized out>
        got_some_output = <optimized out>
        prev_wait_proc_nbytes_read = <optimized out>
        retry_for_async = <optimized out>
        count = {bytes = <optimized out>}
        now = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        last_read_channel = -1
#13 0x00005634e0ee23a0 in sit_for
    (timeout=<optimized out>, reading=<optimized out>, 
display_option=<optimized out>) at dispnew.c:6264
        sec = 30
        nsec = 0
        do_display = <optimized out>
        curbuf_eq_winbuf = true
        nbytes = <optimized out>
#14 0x00005634e0fee4f5 in read_char
    (commandflag=1, map=0x5634e3b7e0e3, prev_event=0x0, 
used_mouse_menu=0x7fffdb8c9f1b, end_time=0x0)
    at keyboard.c:2881
        delay_level = <optimized out>
        buffer_size = <optimized out>
        c = 0x0
        local_getcjmp = {{__jmpbuf = {94785120273024, -60015580120531561, 1, 
139765404497672, 0, 94785158788803, -60015580189737577, -5999710865743200873}, 
__mask_was_saved = 0, __saved_mask = {__val = {94785114331872, 2000000000002, 
586, 500000, 94785114346639, 0, 40080, 140736876813568, 0, 0, 139765404497677, 
0, 94785114190645, 0, 146, 147}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 
0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x5634e356ffb0
#15 0x00005634e119c3a7 in read_key_sequence.constprop.0
    (keybuf=<optimized out>, prevent_redisplay=false, 
fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, 
dont_downcase_last=<optimized out>, prompt=<optimized out>) at keyboard.c:10083
        interrupted_kboard = 0x5634e356ffb0
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        new_binding = <optimized out>
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = 0x5634e3b7e0e3
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {parent = 0x5634e3406393, map = 0x5634e3406393, start = 0, end = 
0}
        keytran = {parent = 0x7f1dabc0897b, map = 0x7f1dabc0897b, start = 0, 
end = 0}
        indec = {parent = 0x5634e34063a3, map = 0x5634e34063a3, start = 0, end 
= 0}
        shift_translated = <optimized out>
        delayed_switch_frame = <optimized out>
        original_uppercase = <optimized out>
        original_uppercase_position = <optimized out>
        dummyflag = false
        fake_prefixed_keys = 0x0
        first_event = 0x0
        second_event = <optimized out>
#16 0x00005634e0fe1b8a in command_loop_1 () at keyboard.c:1384
        cmd = <optimized out>
        keybuf = {0x5e, 0x5634e10a0676 <eval_sub+1142>, 0x5634e33b3510, 
0x5634e10f91fc <exec_byte_code+508>, 0x0, 0x80, 0x0, 0x7f1dab90e738, 
0x5634e1250020 <main_thread.lto_priv>, 0x7f1dabce62b5, 0x5634e33f93c4, 0x0, 
0x5634e11da314, 0x7f1db0e68705, 0x53474e, 0x7f1daf5e3400, 0x7fffdb8ca510, 
0x1cdd2cc6a070d500, 0x9510, 0x5634e11e0d60, 0x7fffdb8ca1e0, 0x60, 
0x5634e33f93c4, 0x0, 0x5634e1250020 <main_thread.lto_priv>, 0x5634e0fdf8c5 
<top_level_2+725>, 0x5634e11da314, 0x7f1daf5e3f12 <malloc+434>, 0x15, 0x30}
        i = <optimized out>
        prev_modiff = 42
        prev_buffer = 0x7f1dab497708
#17 0x00005634e109aa57 in internal_condition_case
    (bfun=0x5634e0fe18c0 <command_loop_1>, handlers=<optimized out>, 
hfun=0x5634e0fdf320 <cmd_error>)
    at eval.c:1474
        val = <optimized out>
        c = 0x5634e33fd350
#18 0x00005634e0fdf5de in command_loop_2 (handlers=handlers@entry=0x90) at 
keyboard.c:1133
        val = <optimized out>
#19 0x00005634e109a9ac in internal_catch
    (tag=<optimized out>, func=0x5634e0fdf5b0 <command_loop_2>, arg=0x90) at 
eval.c:1197
        val = <optimized out>
        c = 0x5634e33fcde0
#20 0x00005634e0fe13a9 in command_loop () at keyboard.c:1111
#21 0x00005634e11cf8a0 in recursive_edit_1.isra.0 () at keyboard.c:720
        val = <optimized out>
#22 0x00005634e0fe188c in Frecursive_edit () at keyboard.c:803
        buffer = <optimized out>
#23 0x00005634e0ed5b9d in main (argc=<optimized out>, argv=0x7fffdb8ca628) at 
emacs.c:2529
        stack_bottom_variable = 0x0
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = <optimized out>
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>
(gdb) frame 8
#8  pgtk_handle_selection_request (event=0x7fffdb8c9420) at pgtkselect.c:573
573      local_selection_data = LOCAL_SELECTION (selection_symbol, dpyinfo);
(gdb) p *event
$2 = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0xe35f53a0, requestor = 
0x5634e3756330,
  selection = 0x45, target = 0x4c, property = 0x5d, time = 0}
(gdb) p *event->selection
$3 = <incomplete type>
(gdb) p *event->dpyinfo
Cannot access memory at address 0xe35f53a0
(gdb) p kbd_buffer[1856].sie
$4 = {kind = NO_EVENT, dpyinfo = 0x0, requestor = 0x0, selection = 0x0, target 
= 0x0, property = 0x0,
  time = 0}
(gdb)