crash on Solaris8

[Hideyuki SHIRAI (白井秀行)<shirai@xxxxxxxxxxx>]

白井です。

以下のメールを先週の金曜日に出したつもりなのですが、meadowy.org
から出て行っていないようなので、他のルートで出し直します。二重に
届いたらごめんなさい。

# 本来は pretest.bugs に出さなきゃいけないメールなのですが、英語
# 書いている時間がとれないので(そもそも能力がないかも ^^;)、こち
# らで失礼させていただいて、どなたかお後をよろしくお願いします (_ _)

いつからかはわからないのですが、Solaris8 で作った Emacs CVS Head
でそれなりに大きいデータを kill & yank すると crash することが多
くなりました。
'SUN SunOS xxxxx 5.8 Generic_117350-33 sun4u sparc SUNW,Sun-Blade-1000'
です。なお、emacs -nw のときはまったく大丈夫です。

● kill 中に crash したとき

Program received signal SIGABRT, Aborted.
0xfee202d4 in _libc_kill () from /usr/lib/libc.so.1
(gdb) where
#0  0xfee202d4 in _libc_kill () from /usr/lib/libc.so.1
#1  0x000e686c in abort () at emacs.c:464
#2  0x00150d3c in internal_condition_case (bfun=0xe9b40 <safe_run_hooks_1>, handlers=3459121,
    hfun=0xe9b78 <safe_run_hooks_error>) at eval.c:1456
#3  0x000e91b4 in safe_run_hooks (hook=3507225) at keyboard.c:2133
#4  0x00064e44 in update_menu_bar (f=0x3d8000, save_match_data=0, hooks_run=0) at xdisp.c:9215
#5  0x00074080 in prepare_menu_bars () at xdisp.c:9100
#6  0x000d369c in x_handle_selection_clear (event=0x14) at xselect.c:1080
#7  0x000d3ad8 in x_handle_selection_event (event=0xffbed520) at xselect.c:1099
#8  0x000f06b4 in swallow_events (do_display=0) at keyboard.c:4305
#9  0x001871dc in wait_reading_process_output (time_limit=20, microsecs=0, read_kbd=0,
    do_display=0, wait_for_cell=3441021, wait_proc=0x0, just_wait_proc=0) at process.c:4700
#10 0x000d3a80 in wait_for_property_change (location=0x4e20) at xselect.c:1271
#11 0x000d41f8 in x_handle_selection_event (event=0x15a770) at xselect.c:841
#12 0x000f06b4 in swallow_events (do_display=1) at keyboard.c:4305
#13 0x00187310 in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1,
    do_display=1, wait_for_cell=3459073, wait_proc=0x0, just_wait_proc=0) at process.c:4670
#14 0x00050fe8 in sit_for (timeout=240, reading=1, do_display=1) at dispnew.c:6539
#15 0x000f318c in read_char (commandflag=1, nmaps=2, maps=0xffbee140, prev_event=3459073,
    used_mouse_menu=0xffbee1d0, end_time=0x0) at keyboard.c:2878
#16 0x000f4ba4 in read_key_sequence (keybuf=0xffbee318, bufsize=30, prompt=3459073,
    dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:8969
#17 0x000f6af8 in command_loop_1 () at keyboard.c:1603
#18 0x00150d10 in internal_condition_case (bfun=0xf6928 <command_loop_1>, handlers=3523233,
    hfun=0xef250 <cmd_error>) at eval.c:1481
#19 0x000e8eb4 in command_loop_2 () at keyboard.c:1326
#20 0x0015094c in internal_catch (tag=3517465, func=0xe8e90 <command_loop_2>, arg=3459073)
    at eval.c:1222
#21 0x000e8c68 in command_loop () at keyboard.c:1305
#22 0x000e8d30 in recursive_edit_1 () at keyboard.c:1003
#23 0x000e8e74 in Frecursive_edit () at keyboard.c:1064
#24 0x000e8924 in main (argc=2, argv=0xffbee884) at emacs.c:1794

● yank 中に crash したとき
Program received signal SIGSEGV, Segmentation fault.
0x000c258c in x_uncatch_errors () at xterm.c:7561
7561      if (x_display_info_for_display (x_error_message->dpy) != 0)
(gdb) where
#0  0x000c258c in x_uncatch_errors () at xterm.c:7561
#1  0x000d3260 in x_catch_errors_unwind (dummy=3459073) at xselect.c:619
#2  0x001512e0 in unbind_to (count=32, value=3459073) at eval.c:3352
#3  0x00151454 in unwind_to_catch (catch=0xffbee420, value=3400704) at eval.c:1267
#4  0x00152fd0 in Fsignal (error_symbol=3523233, data=12608749) at eval.c:1697
#5  0x0015302c in xsignal (error_symbol=3523233, data=12608749) at eval.c:1722
#6  0x001532e4 in xsignal1 (error_symbol=3523233, arg=20307107) at eval.c:1739
#7  0x001533b0 in error (m=0x1c2bf8 "Timed out waiting for property-notify event", a1=0x0,
    a2=0xffbedbf0 "Timed out waiting for property-notify event",
    a3=0x190 <Address 0x190 out of bounds>) at eval.c:2004
#8  0x000d3ab0 in wait_for_property_change (location=0x4e20) at xselect.c:1277
#9  0x000d41f8 in x_handle_selection_event (event=0x15a770) at xselect.c:841
#10 0x000f06b4 in swallow_events (do_display=0) at keyboard.c:4305
#11 0x000f1724 in read_char (commandflag=1, nmaps=3, maps=0xffbee148, prev_event=3459073,
    used_mouse_menu=0xffbee1d8, end_time=0x0) at keyboard.c:2636
#12 0x000f4ba4 in read_key_sequence (keybuf=0xffbee320, bufsize=30, prompt=3459073,
    dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:8969
#13 0x000f6af8 in command_loop_1 () at keyboard.c:1603
#14 0x00150d10 in internal_condition_case (bfun=0xf6928 <command_loop_1>, handlers=3523233,
    hfun=0xef250 <cmd_error>) at eval.c:1481
#15 0x000e8eb4 in command_loop_2 () at keyboard.c:1326
#16 0x0015094c in internal_catch (tag=3517465, func=0xe8e90 <command_loop_2>, arg=3459073)
    at eval.c:1222
#17 0x000e8c68 in command_loop () at keyboard.c:1305
#18 0x000e8d30 in recursive_edit_1 () at keyboard.c:1003
#19 0x000e8e74 in Frecursive_edit () at keyboard.c:1064
#20 0x000e8924 in main (argc=1, argv=0xffbee88c) at emacs.c:1794

という感じです。上記の例は "set args -q" で run させた Emacs で
1.4MByte 程の ascii だけのファイル全体を選択して  kill&yank した
ものです。

また、以下のような状態もあります。

● 不思議なことに、kill しているときに
  "Timed out waiting for property-notify event" というメッセージ
  が出たときは、kill の完了までの時間は 20秒かかりますが、kill,
  yank ともに正常に終了します。
  

● xselect.c で #define TRACE_SELECTION 1 したところ、こんなのも
   取れました。微妙に全出のソースと違っているかもしれません。

% gdb emacs-cvs/src/emacs
 <<snip>>
(gdb) set args -q
(gdb) run
Starting program: /tmp/work/emacs-cvs/src/emacs -q
1668: x_handle_selection_event
1668: x_handle_selection_request, from=0x00000035 time=3224101499
1668: PRIMARY, target COMPOUND_TEXT (1)
1668: x_start_queuing_selection_requests 1
1668: Start sending 1419120 bytes incrementally (COMPOUND_TEXT)
1668: Set COMPOUND_TEXT to number of bytes to send
1668: Send SelectionNotify event
1668: Waiting for ACK (deletion of COMPOUND_TEXT)
1668:   Waiting 20 secs, 0 usecs
1668:   Timed out
1668: x_stop_queuing_selection_requests 1
1668: x_handle_selection_event
1668: x_handle_selection_request, from=0x00000035 time=3224148477
1668: PRIMARY, target COMPOUND_TEXT (2)
1668: x_start_queuing_selection_requests 1
1668: Start sending 1419120 bytes incrementally (COMPOUND_TEXT)
1668: Set COMPOUND_TEXT to number of bytes to send
1668: Send SelectionNotify event
1668: Waiting for ACK (deletion of COMPOUND_TEXT)
1668:   Waiting 20 secs, 0 usecs
1668: Expected deletion of property COMPOUND_TEXT
1668: x_handle_selection_event
1668: QUEUE SELECTION EVENT 0068e040
1668: x_handle_selection_event
1668: x_handle_selection_clear

Program received signal SIGABRT, Aborted.
0xfee202d4 in _libc_kill () from /usr/lib/libc.so.1
(gdb) where
#0  0xfee202d4 in _libc_kill () from /usr/lib/libc.so.1
#1  0x000e7058 in abort () at emacs.c:464
#2  0x00151528 in internal_condition_case (bfun=0xea32c <safe_run_hooks_1>, handlers=3463217,
    hfun=0xea364 <safe_run_hooks_error>) at eval.c:1456
#3  0x000e99a0 in safe_run_hooks (hook=3511321) at keyboard.c:2133
#4  0x00064ea4 in update_menu_bar (f=0x3d8000, save_match_data=0, hooks_run=0) at xdisp.c:9215
#5  0x000740e0 in prepare_menu_bars () at xdisp.c:9100
#6  0x000d3884 in x_handle_selection_clear (event=0x14) at xselect.c:1080
#7  0x000d3d24 in x_handle_selection_event (event=0xffbed4f8) at xselect.c:1099
#8  0x000f0ea0 in swallow_events (do_display=0) at keyboard.c:4305
#9  0x001879c8 in wait_reading_process_output (time_limit=20, microsecs=0, read_kbd=0,
    do_display=0, wait_for_cell=3445117, wait_proc=0x0, just_wait_proc=0) at process.c:4700
#10 0x000d3c90 in wait_for_property_change (location=0x0) at xselect.c:1271
#11 0x000d4524 in x_handle_selection_event (event=0x6347d0) at xselect.c:803
#12 0x000f0ea0 in swallow_events (do_display=1) at keyboard.c:4305
#13 0x00187afc in wait_reading_process_output (time_limit=120, microsecs=0, read_kbd=-1,
    do_display=1, wait_for_cell=3463169, wait_proc=0x0, just_wait_proc=0) at process.c:4670
#14 0x00051048 in sit_for (timeout=960, reading=1, do_display=1) at dispnew.c:6539
#15 0x000f3978 in read_char (commandflag=1, nmaps=2, maps=0xffbee128, prev_event=3463169,
    used_mouse_menu=0xffbee1b8, end_time=0x0) at keyboard.c:2878
#16 0x000f5390 in read_key_sequence (keybuf=0xffbee300, bufsize=30, prompt=3463169,
    dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:8969
#17 0x000f72e4 in command_loop_1 () at keyboard.c:1603
#18 0x001514fc in internal_condition_case (bfun=0xf7114 <command_loop_1>, handlers=3527329,
    hfun=0xefa3c <cmd_error>) at eval.c:1481
#19 0x000e96a0 in command_loop_2 () at keyboard.c:1326
#20 0x00151138 in internal_catch (tag=3521561, func=0xe967c <command_loop_2>, arg=3463169)
    at eval.c:1222
#21 0x000e9454 in command_loop () at keyboard.c:1305
#22 0x000e951c in recursive_edit_1 () at keyboard.c:1003
#23 0x000e9660 in Frecursive_edit () at keyboard.c:1064
#24 0x000e9110 in main (argc=2, argv=0xffbee86c) at emacs.c:1794
(gdb)

また、ftp://alpha.gnu.org/gnu/emacs/pretest/emacs-22.0.90.tar.gz
でも crash しました。

-- 
白井秀行 (mailto:shirai@xxxxxxxxxxx)