bug#47207: 28.0.50; decode_next_window_args crash

[martin rudalics]

The following bug has hit me out of the blue a couple of times.  Trying
to ediff two buffers gets me the crash below:


#0  0x00000000005a5f85 in terminate_due_to_signal (sig=6, 
backtrace_limit=2147483647) at ../../src/emacs.c:379
#1  0x0000000000651df0 in die (msg=0x788ee1 "WINDOWP (a)", file=0x788ece 
"../../src/window.h", line=543) at ../../src/alloc.c:7420
#2  0x00000000004bdca6 in XWINDOW (a=XIL(0)) at ../../src/window.h:543
#3  0x00000000004c6a4d in decode_next_window_args (window=0x7fffffffa808, 
minibuf=0x7fffffffa800, all_frames=0x7fffffffa7f8) at ../../src/window.c:2891
#4  0x00000000004c6bff in next_window (window=XIL(0x2b04405), minibuf=XIL(0), 
all_frames=XIL(0x30), next_p=true) at ../../src/window.c:2927
#5  0x00000000004c7086 in Fnext_window (window=XIL(0x2b04405), minibuf=XIL(0), 
all_frames=XIL(0x30)) at ../../src/window.c:3023
#6  0x000000000068b298 in funcall_subr (subr=0xc4b6e0 <Snext_window>, 
numargs=3, args=0x7fffffffa9d0) at ../../src/eval.c:2996
#7  0x000000000068ad15 in Ffuncall (nargs=4, args=0x7fffffffa9c8) at 
../../src/eval.c:2918
#8  0x00000000006e4865 in exec_byte_code (bytestr=XIL(0x7ffff3cc5764), 
vector=XIL(0x7ffff3cc5255), maxdepth=make_fixnum(12), 
args_template=make_fixnum(769), nargs=2, args=0x7fffffffaf68) at 
../../src/bytecode.c:632
#9  0x000000000068b4cd in fetch_and_exec_byte_code (fun=XIL(0x7ffff3cc51fd), 
syms_left=make_fixnum(769), nargs=2, args=0x7fffffffaf58) at 
../../src/eval.c:3040
#10 0x000000000068b953 in funcall_lambda (fun=XIL(0x7ffff3cc51fd), nargs=2, 
arg_vector=0x7fffffffaf58) at ../../src/eval.c:3121
#11 0x000000000068ad59 in Ffuncall (nargs=3, args=0x7fffffffaf50) at 
../../src/eval.c:2920
#12 0x00000000006e4865 in exec_byte_code (bytestr=XIL(0x1b2c854), 
vector=XIL(0x1a0010d), maxdepth=make_fixnum(7), args_template=make_fixnum(256), 
nargs=0, args=0x7fffffffb4a0) at ../../src/bytecode.c:632
#13 0x000000000068b4cd in fetch_and_exec_byte_code (fun=XIL(0x1a001ad), 
syms_left=make_fixnum(256), nargs=0, args=0x7fffffffb4a0) at 
../../src/eval.c:3040
#14 0x000000000068b953 in funcall_lambda (fun=XIL(0x1a001ad), nargs=0, 
arg_vector=0x7fffffffb4a0) at ../../src/eval.c:3121
#15 0x000000000068ad59 in Ffuncall (nargs=1, args=0x7fffffffb498) at 
../../src/eval.c:2920
#16 0x00000000006e4865 in exec_byte_code (bytestr=XIL(0x1b09454), 
vector=XIL(0x1988f85), maxdepth=make_fixnum(9), args_template=make_fixnum(514), 
nargs=2, args=0x7fffffffba68) at ../../src/bytecode.c:632
#17 0x000000000068b4cd in fetch_and_exec_byte_code (fun=XIL(0x198906d), 
syms_left=make_fixnum(514), nargs=2, args=0x7fffffffba58) at 
../../src/eval.c:3040
#18 0x000000000068b953 in funcall_lambda (fun=XIL(0x198906d), nargs=2, 
arg_vector=0x7fffffffba58) at ../../src/eval.c:3121
#19 0x000000000068ad59 in Ffuncall (nargs=3, args=0x7fffffffba50) at 
../../src/eval.c:2920
#20 0x00000000006e4865 in exec_byte_code (bytestr=XIL(0x1b08c04), 
vector=XIL(0x1988ba5), maxdepth=make_fixnum(8), args_template=make_fixnum(771), 
nargs=3, args=0x7fffffffbfc0) at ../../src/bytecode.c:632
#21 0x000000000068b4cd in fetch_and_exec_byte_code (fun=XIL(0x1988c45), 
syms_left=make_fixnum(771), nargs=3, args=0x7fffffffbfa8) at 
../../src/eval.c:3040
#22 0x000000000068b953 in funcall_lambda (fun=XIL(0x1988c45), nargs=3, 
arg_vector=0x7fffffffbfa8) at ../../src/eval.c:3121
#23 0x000000000068ad59 in Ffuncall (nargs=4, args=0x7fffffffbfa0) at 
../../src/eval.c:2920
#24 0x00000000006e4865 in exec_byte_code (bytestr=XIL(0x1b41884), 
vector=XIL(0x1a037f5), maxdepth=make_fixnum(17), 
args_template=make_fixnum(2312), nargs=9, args=0x7fffffffcb10) at 
../../src/bytecode.c:632
#25 0x000000000068b4cd in fetch_and_exec_byte_code (fun=XIL(0x1aa7c75), 
syms_left=make_fixnum(2312), nargs=9, args=0x7fffffffcac8) at 
../../src/eval.c:3040
#26 0x000000000068b953 in funcall_lambda (fun=XIL(0x1aa7c75), nargs=9, 
arg_vector=0x7fffffffcac8) at ../../src/eval.c:3121
#27 0x000000000068ad59 in Ffuncall (nargs=10, args=0x7fffffffcac0) at 
../../src/eval.c:2920
#28 0x00000000006e4865 in exec_byte_code (bytestr=XIL(0x1a187b4), 
vector=XIL(0x1123095), maxdepth=make_fixnum(25), 
args_template=make_fixnum(1541), nargs=5, args=0x7fffffffd0f8) at 
../../src/bytecode.c:632
#29 0x000000000068b4cd in fetch_and_exec_byte_code (fun=XIL(0x112310d), 
syms_left=make_fixnum(1541), nargs=5, args=0x7fffffffd0d0) at 
../../src/eval.c:3040
#30 0x000000000068b953 in funcall_lambda (fun=XIL(0x112310d), nargs=5, 
arg_vector=0x7fffffffd0d0) at ../../src/eval.c:3121
#31 0x000000000068ad59 in Ffuncall (nargs=6, args=0x7fffffffd0c8) at 
../../src/eval.c:2920
#32 0x00000000006e4865 in exec_byte_code (bytestr=XIL(0x1a18a34), 
vector=XIL(0x1616e2d), maxdepth=make_fixnum(10), 
args_template=make_fixnum(1026), nargs=2, args=0x7fffffffd540) at 
../../src/bytecode.c:632
#33 0x000000000068b4cd in fetch_and_exec_byte_code (fun=XIL(0x1a7257d), 
syms_left=make_fixnum(1026), nargs=2, args=0x7fffffffd530) at 
../../src/eval.c:3040
#34 0x000000000068b953 in funcall_lambda (fun=XIL(0x1a7257d), nargs=2, 
arg_vector=0x7fffffffd530) at ../../src/eval.c:3121
#35 0x000000000068b677 in apply_lambda (fun=XIL(0x1a7257d), 
args=XIL(0x1afad93), count=9) at ../../src/eval.c:3065
#36 0x00000000006897c1 in eval_sub (form=XIL(0x1afadd3)) at 
../../src/eval.c:2440
#37 0x000000000068391a in Fprogn (body=XIL(0)) at ../../src/eval.c:462
#38 0x000000000068be0a in funcall_lambda (fun=XIL(0x1afab83), nargs=0, 
arg_vector=0x0) at ../../src/eval.c:3188
#39 0x000000000068ae6c in Ffuncall (nargs=1, args=0x7fffffffda88) at 
../../src/eval.c:2932
#40 0x000000000067ef12 in Ffuncall_interactively (nargs=1, args=0x7fffffffda88) 
at ../../src/callint.c:260
#41 0x000000000068b13f in funcall_subr (subr=0xc570a0 <Sfuncall_interactively>, 
numargs=1, args=0x7fffffffda88) at ../../src/eval.c:2971
#42 0x000000000068ad15 in Ffuncall (nargs=2, args=0x7fffffffda80) at 
../../src/eval.c:2918
#43 0x0000000000689b16 in Fapply (nargs=3, args=0x7fffffffda80) at 
../../src/eval.c:2501
#44 0x000000000067f39a in Fcall_interactively (function=XIL(0xd1edf0), 
record_flag=XIL(0), keys=XIL(0x7ffff437c805)) at ../../src/callint.c:353
#45 0x000000000068b298 in funcall_subr (subr=0xc570e0 <Scall_interactively>, 
numargs=3, args=0x7fffffffdd40) at ../../src/eval.c:2996
#46 0x000000000068ad15 in Ffuncall (nargs=4, args=0x7fffffffdd38) at 
../../src/eval.c:2918
#47 0x00000000006e4865 in exec_byte_code (bytestr=XIL(0x7ffff3d7c80c), 
vector=XIL(0x7ffff3d7c125), maxdepth=make_fixnum(13), 
args_template=make_fixnum(1025), nargs=1, args=0x7fffffffe2b0) at 
../../src/bytecode.c:632
#48 0x000000000068b4cd in fetch_and_exec_byte_code (fun=XIL(0x7ffff3d7c0f5), 
syms_left=make_fixnum(1025), nargs=1, args=0x7fffffffe2a8) at 
../../src/eval.c:3040
#49 0x000000000068b953 in funcall_lambda (fun=XIL(0x7ffff3d7c0f5), nargs=1, 
arg_vector=0x7fffffffe2a8) at ../../src/eval.c:3121
#50 0x000000000068ad59 in Ffuncall (nargs=2, args=0x7fffffffe2a0) at 
../../src/eval.c:2920
#51 0x000000000068a645 in call1 (fn=XIL(0x4230), arg1=XIL(0xd1edf0)) at 
../../src/eval.c:2778
#52 0x00000000005ade1b in command_loop_1 () at ../../src/keyboard.c:1466
#53 0x0000000000686b71 in internal_condition_case (bfun=0x5ad5c2 <command_loop_1>, 
handlers=XIL(0x90), hfun=0x5acbd1 <cmd_error>) at ../../src/eval.c:1443
#54 0x00000000005ad1a7 in command_loop_2 (ignore=XIL(0)) at 
../../src/keyboard.c:1094
#55 0x0000000000685f7d in internal_catch (tag=XIL(0xd6b0), func=0x5ad17a 
<command_loop_2>, arg=XIL(0)) at ../../src/eval.c:1193
#56 0x00000000005ad145 in command_loop () at ../../src/keyboard.c:1073
#57 0x00000000005ac6b8 in recursive_edit_1 () at ../../src/keyboard.c:720
#58 0x00000000005ac8b0 in Frecursive_edit () at ../../src/keyboard.c:789
#59 0x00000000005a8787 in main (argc=1, argv=0x7fffffffe7c8) at 
../../src/emacs.c:2050

Lisp Backtrace:
"next-window" (0xffffa9d0)
"other-window" (0xffffaf58)
"ediff-skip-unsuitable-frames" (0xffffb4a0)
"ediff-prepare-error-list" (0xffffba58)
"ediff-setup-diff-regions" (0xffffbfa8)
"ediff-setup" (0xffffcac8)
"ediff-buffers-internal" (0xffffd0d0)
"ediff-buffers" (0xffffd530)
"my-diffs-b" (0xffffda90)
"funcall-interactively" (0xffffda88)
"call-interactively" (0xffffdd40)
"command-execute" (0xffffe2a8)
(gdb) frame 3
#3  0x00000000004c6a4d in decode_next_wMajor mode: Text

Minor modes in effect:
  pop-up-mini-mode: t
  shell-dirtrack-mode: t
  scroll-restore-mode: t
  show-paren-mode: t
  tooltip-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  temp-buffer-resize-mode: t
  column-number-mode: t
  line-number-mode: t
  auto-fill-function: do-auto-fill
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow mail-extr warnings emacsbug message rmc puny rfc822 mml mml-sec
epa derived epg epg-config gnus-util rmail rmail-loaddefs auth-source
password-cache json map mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils smerge-mode diff mule-util eieio-opt
cl-extra speedbar ezimage dframe dabbrev etags fileloop generator xref
cl-seq project eieio eieio-core eieio-loaddefs minibuf-eldef time-date
subr-x shortdoc thingatpt help-fns radix-tree help-mode speck cl-macs
pop-up-mini vc cc-mode cc-fonts cc-guess cc-menus cc-cmds cc-styles
cc-align cc-engine cc-vars cc-defs vc-git diff-mode vc-dispatcher
bug-reference elp ediff-vers ediff ediff-merg ediff-mult ediff-wind
ediff-diff ediff-help ediff-init ediff-util local-tags info-look
find-func elinfo-support elinfo texinfo info shell pcomplete comint
ansi-color ring sidebar bookmark seq byte-opt bytecomp byte-compile
cconv text-property-search sort m&d scroll-restore regexp-lock
time-stamp eldoc-tooltip pcase easy-mmode find-dired dired
dired-loaddefs cus-edit pp cus-start cus-load wid-edit cl-loaddefs
cl-lib jka-compr paren ls-lisp gv iso-transl tooltip eldoc electric
uniquify ediff-hook vc-hooks lisp-float-type mwheel term/x-win x-win
term/common-win x-dnd tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode elisp-mode lisp-mode
prog-mode register page tab-bar menu-bar rfn-eshadow isearch easymenu
timer select scroll-bar mouse jit-lock font-lock syntax facemenu
font-core term/tty-colors frame minibuffer cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese composite charscript charprop
case-table epa-hook jka-cmpr-hook help simple abbrev obarray
cl-preloaded nadvice button loaddefs faces cus-face macroexp files
window text-properties overlay sha1 md5 base64 format env code-pages
mule custom widget hashtable-print-readable backquote threads dbusbind
inotify dynamic-setting system-font-setting font-render-setting cairo
move-toolbar gtk x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 328334 70021)
 (symbols 48 17143 1)
 (strings 32 52277 4856)
 (string-bytes 1 1699127)
 (vectors 16 33942)
 (vector-slots 8 1202337 161897)
 (floats 8 170 554)
 (intervals 56 19456 1549)
 (buffers 1008 42))
indow_args (window=0x7fffffffa808, minibuf=0x7fffffffa800, 
all_frames=0x7fffffffa7f8) at ../../src/window.c:2891
2891        *minibuf = this_minibuffer_depth (XWINDOW (miniwin)->contents)
(gdb) p miniwin
$1 = XIL(0)
(gdb) frame 5
#5  0x00000000004c7086 in Fnext_window (window=XIL(0x2b04405), minibuf=XIL(0), 
all_frames=XIL(0x30)) at ../../src/window.c:3023
3023      return next_window (window, minibuf, all_frames, true);
(gdb) p window
$4 = XIL(0x2b04405)
(gdb) p XWINDOW (window)->contents
$5 = XIL(0x2d46a85)
(gdb) xpr
Lisp_Vectorlike
PVEC_BUFFER
$6 = (struct buffer *) 0x2d46a80
0x1fadde8 " *tip*"
(gdb)


Presumably, commit c7c154bb5756e0ae71d342c5d8aabf725877f186 is directly
responsible for the crash.  It's triggered by the

(other-window 1 t)

call in `ediff-skip-unsuitable-frames' which selects the tooltip window
which has no minibuffer.  Patch attached, but we probably should decide
whether to consider tooltip windows in `next-window' or `other-window'
at all.  See also

https://lists.gnu.org/archive/html/emacs-devel/2018-02/msg00694.html

martin

window.c.diff
Description: Text Data