Hi,

2018-1-11(Thu) 21:29:25 UTC+9 [email protected]:
> Hi,
> 
> I saw several bug reports on Fedora on gvim getting signal SIGSEGV at 
> _cairo_hash_table_lookup function. It is curious that segfault happened at 
> beginning of function, at '{', so I looked more into it.
> I checked backtrace in core dump, which has about 130 000 frames. These 
> frames are mostly calling two functions - gui_update_cursor() and 
> gui_mch_stop_blink() - I think there is infinity loop between these two 
> functions, so gvim ate all stack memory.
> 
> Backtrace:
> #0  0x00007f4df8adbca6 in _cairo_hash_table_lookup 
> (hash_table=0x56411b554800, key=key@entry=0x7ffd93deb028) at cairo-hash.c:340
> #1  0x00007f4df8b136e9 in _cairo_scaled_glyph_lookup 
> (scaled_font=scaled_font@entry=0x56411b10f220, index=<optimized out>, 
> info=info@entry=CAIRO_SCALED_GLYPH_INFO_METRICS, 
>     scaled_glyph_ret=scaled_glyph_ret@entry=0x7ffd93deb098) at 
> cairo-scaled-font.c:3004
> #2  0x00007f4df8b14a8e in _cairo_scaled_font_single_glyph_device_extents 
> (extents=0x7ffd93deb3cc, glyph=0x7ffd93debb10, scaled_font=0x56411b10f220) at 
> cairo-scaled-font.c:2176
> #3  _cairo_scaled_font_glyph_device_extents 
> (scaled_font=scaled_font@entry=0x56411b10f220, 
> glyphs=glyphs@entry=0x7ffd93debb10, num_glyphs=num_glyphs@entry=1, 
> extents=extents@entry=0x7ffd93deb3cc, 
>     overlap_out=overlap_out@entry=0x7ffd93deb3ac) at cairo-scaled-font.c:2228
> #4  0x00007f4df8ad1e34 in _cairo_composite_rectangles_init_for_glyphs 
> (extents=extents@entry=0x7ffd93deb3b0, surface=surface@entry=0x56411abdf830, 
> op=op@entry=CAIRO_OPERATOR_OVER, 
>     source=source@entry=0x7ffd93deb7c0, 
> scaled_font=scaled_font@entry=0x56411b10f220, 
> glyphs=glyphs@entry=0x7ffd93debb10, num_glyphs=1, clip=0x56411b425e40, 
> overlap=0x7ffd93deb3ac)
>     at cairo-composite-rectangles.c:446
> #5  0x00007f4df8ad244e in _cairo_compositor_glyphs (compositor=0x7f4df8dc8d00 
> <compositor>, surface=surface@entry=0x56411abdf830, 
> op=op@entry=CAIRO_OPERATOR_OVER, source=source@entry=0x7ffd93deb7c0, 
>     glyphs=glyphs@entry=0x7ffd93debb10, num_glyphs=num_glyphs@entry=1, 
> scaled_font=0x56411b10f220, clip=0x56411b425e40) at cairo-compositor.c:238
> #6  0x00007f4df8b4ba40 in _cairo_xlib_surface_glyphs (_surface=<optimized 
> out>, op=CAIRO_OPERATOR_OVER, source=0x7ffd93deb7c0, glyphs=0x7ffd93debb10, 
> num_glyphs=1, scaled_font=0x56411b10f220, 
>     clip=0x56411b425e40) at cairo-xlib-surface.c:1667
> #7  0x00007f4df8b1cb3c in _cairo_surface_show_text_glyphs 
> (surface=0x56411abdf830, op=CAIRO_OPERATOR_OVER, 
> source=source@entry=0x7ffd93deb7c0, utf8=0x0, utf8_len=<optimized out>, 
> glyphs=0x7ffd93debb10, 
>     num_glyphs=<optimized out>, clusters=0x0, num_clusters=<optimized out>, 
> cluster_flags=(unknown: 0), scaled_font=0x56411b10f220, clip=0x56411b425e40) 
> at cairo-surface.c:2890
> #8  0x00007f4df8adb5a3 in _cairo_gstate_show_text_glyphs 
> (gstate=0x56411b53bda8, glyphs=<optimized out>, num_glyphs=<optimized out>, 
> info=0x0) at cairo-gstate.c:2077
> #9  0x00007f4df8acd374 in cairo_show_glyphs (cr=<optimized out>, 
> glyphs=<optimized out>, num_glyphs=<optimized out>) at cairo.c:3630
> #10 0x00007f4df901f89b in pango_cairo_renderer_show_text_glyphs 
> (renderer=<optimized out>, text=text@entry=0x0, text_len=text_len@entry=0, 
> clusters=clusters@entry=0x0, num_clusters=0, backward=0, 
>     font=0x56411b316890, x=0, y=0, glyphs=<optimized out>, glyphs=<optimized 
> out>) at ../pango/pangocairo-render.c:531
> #11 0x00007f4df901fbff in pango_cairo_renderer_draw_glyphs 
> (renderer=<optimized out>, font=<optimized out>, glyphs=<optimized out>, 
> x=<optimized out>, y=<optimized out>) at ../pango/pangocairo-render.c:547
> #12 0x00007f4df8df2fb9 in pango_renderer_draw_glyphs 
> (renderer=0x56411b3a36c0, font=0x56411b316890, glyphs=0x56411b214c60, x=0, 
> y=0) at ../pango/pango-renderer.c:643
> #13 0x00007f4df901fe64 in _pango_cairo_do_glyph_string (do_path=0, 
> glyphs=0x56411b214c60, font=0x56411b316890, cr=0x56411b53bbe0) at 
> ../pango/pangocairo-render.c:959
> #14 pango_cairo_show_glyph_string (cr=0x56411b53bbe0, font=0x56411b316890, 
> glyphs=0x56411b214c60) at ../pango/pangocairo-render.c:1095
> #15 0x0000564119397025 in draw_glyph_string ()
> #16 0x000056411939a688 in gui_gtk2_draw_string ()
> #17 0x000056411938c576 in gui_outstr_nowrap ()
> #18 0x000056411938cc84 in gui_redraw_block.part ()
> #19 0x000056411938cdc3 in gui_undraw_cursor.part ()
> #20 0x000056411938d24b in gui_update_cursor ()
> #21 0x000056411939c234 in gui_mch_stop_blink ()
> #22 0x000056411938d021 in gui_update_cursor ()
> #23 0x000056411939c234 in gui_mch_stop_blink ()
> #24 0x000056411938d021 in gui_update_cursor ()
> #25 0x000056411939c234 in gui_mch_stop_blink ()
> #26 0x000056411938d021 in gui_update_cursor ()
> ....(many calls of gui_mch_stop_blink() and gui_update_cursor())
> #130787 0x000056411939c234 in gui_mch_stop_blink ()
> #130788 0x000056411938d021 in gui_update_cursor ()
> #130789 0x00005641193901c9 in gui_write ()
> #130790 0x00005641193709b8 in ui_write ()
> #130791 0x000056411938ed30 in gui_resize_shell ()
> #130792 0x00005641193dfcd4 in main_loop ()
> #130793 0x00005641193e1147 in vim_main2 ()
> #130794 0x00005641191df028 in main ()
> 
> 
> Problem is that I'm not able to reproduce this segfault, so I cannot properly 
> test some solutions for it. My guess is the issue was introduced with 
> patchlevel 1294, because there was added gui_mch_stop_blink() call.

I think so.
Perhaps I think that the problem is caused by the following logic.

When `blink_state` is `BLINK_OFF`, Vim sets shape->blinkoff to 0.

  gui_update_cursor()
    gui_mch_stop_blink() at gui.c:1126
      gui_update_cursor() at gui_gtk_x11.c:914
        gui_mch_stop_blink() at gui.c:1126
          gui_update_cursor() at gui_gtk_x11.c:914
            ...
              ... 
                (Continue until ate the all stack.)


Thanks for your report.
--
Best regards,
Hirohito Higashi (h_east)

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Raspunde prin e-mail lui