bug#581: 23.0.60; OSX: server crashes when quitting emacsclient

[Markus Triska]

When I do:

     $ emacs -Q -nw -f server-start

and in another terminal:

     $ emacsclient -c

and then quit the client with C-x C-c, the server crashes with the
following backtrace. When I omit "-nw" for the server, it works.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0fd07d39
0x018167ad in DestroyNTable ()
(gdb) bt
#0  0x018167ad in DestroyNTable ()
#1  0x01816873 in XrmDestroyDatabase ()
#2  0x00095fb0 in x_delete_display (dpyinfo=0x214c040) at xterm.c:10523
#3  0x00096107 in x_delete_terminal (terminal=0x214c1f0) at xterm.c:10654
#4  0x00080081 in Fdelete_terminal (terminal=34914804, force=58721337) at 
terminal.c:336
#5  0x00011ee8 in Fdelete_frame (frame=34971156, force=58721337) at frame.c:1529
#6  0x0014544c in Ffuncall (nargs=2, args=0xbfffee80) at eval.c:3052
#7  0x0017e99b in Fbyte_code (bytestr=77604907, vector=34753444, maxdepth=6) at 
bytecode.c:678
#8  0x00144d2f in funcall_lambda (fun=34753700, nargs=1, arg_vector=0xbffff014) 
at eval.c:3229
#9  0x00145212 in Ffuncall (nargs=2, args=0xbffff010) at eval.c:3099
#10 0x0017e99b in Fbyte_code (bytestr=66970363, vector=34764708, maxdepth=3) at 
bytecode.c:678
#11 0x00144d2f in funcall_lambda (fun=34764852, nargs=2, arg_vector=0xbffff194) 
at eval.c:3229
#12 0x00145212 in Ffuncall (nargs=3, args=0xbffff190) at eval.c:3099
#13 0x0017e99b in Fbyte_code (bytestr=2019283, vector=2019300, maxdepth=4) at 
bytecode.c:678
#14 0x00144d2f in funcall_lambda (fun=2019236, nargs=1, arg_vector=0xbffff364) 
at eval.c:3229
#15 0x00145212 in Ffuncall (nargs=2, args=0xbffff360) at eval.c:3099
#16 0x001418f2 in Fcall_interactively (function=67043129, record_flag=58721289, 
keys=51388540) at callint.c:857
#17 0x00145425 in Ffuncall (nargs=4, args=0xbffff560) at eval.c:3048
#18 0x001455c1 in call3 (fn=58833441, arg1=67043129, arg2=58721289, 
arg3=58721289) at eval.c:2872
#19 0x000e446d in command_loop_1 () at keyboard.c:1912
#20 0x001435a4 in internal_condition_case (bfun=0xe400e <command_loop_1>, 
handlers=58760953, hfun=0xdce69 <cmd_error>) at eval.c:1511
#21 0x000d6050 in command_loop_2 () at keyboard.c:1369
#22 0x001431f6 in internal_catch (tag=58757025, func=0xd600c <command_loop_2>, 
arg=58721289) at eval.c:1247
#23 0x000d5df2 in command_loop () at keyboard.c:1348
#24 0x000d5eab in recursive_edit_1 () at keyboard.c:957
#25 0x000d5ff3 in Frecursive_edit () at keyboard.c:1019
#26 0x000d5031 in main (argc=5, argv=0xbffff9d8) at emacs.c:1796

Lisp Backtrace:
"delete-frame" (0xbfffee84)
"server-delete-client" (0xbffff014)
"server-save-buffers-kill-terminal" (0xbffff194)
"save-buffers-kill-terminal" (0xbffff364)
"call-interactively" (0xbffff564)
(gdb) bt full
#0  0x01816746 in DestroyLTable ()
No symbol table info available.
#1  0x0181686c in XrmDestroyDatabase ()
No symbol table info available.
#2  0x00095fb0 in x_delete_display (dpyinfo=0x21447c0) at xterm.c:10523
        t = (struct terminal *) 0x329d50
        dpyinfo = (struct x_display_info *) 0x21447c0
#3  0x00096107 in x_delete_terminal (terminal=0x2144970) at xterm.c:10654
        dpyinfo = (struct x_display_info *) 0x21447c0
        terminal = (struct terminal *) 0x83
#4  0x00080081 in Fdelete_terminal (terminal=34883956, force=58721337) at 
terminal.c:336
        t = (struct terminal *) 0x2144970
        terminal = 34883956
#5  0x00011ee8 in Fdelete_frame (frame=34944756, force=58721337) at frame.c:1529
        tmp = -1099628544
        f = (struct frame *) 0x21536f0
        sf = (struct frame *) 0x3800439
        kb = (struct kboard *) 0x100
#6  0x0014544c in Ffuncall (nargs=2, args=0xbfffe5c0) at eval.c:3052
        fun = -1073748672
        original_fun = 1803152
        funcar = -1099628544
        numargs = 1
        val = 3306160
        backtrace = {
  next = 0xbfffe70c, 
  function = 0xbfffe5c0, 
  args = 0xbfffe5c4, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0xbfffe540
        i = -1099628544
        args = (Lisp_Object *) 0x1b8390
#7  0x0017e99b in Fbyte_code (bytestr=77637499, vector=34678884, maxdepth=6) at 
bytecode.c:678
        op = 131
        vectorp = (Lisp_Object *) 0x2112868
        stack = {
  pc = 0x58f3344 "\210\016$A\211\026$\204o", 
  top = 0xbfffe5c4, 
  bottom = 0xbfffe5c0, 
  byte_string = 77637499, 
  byte_string_start = 0x58f32b4 "\306\307\b\205\a", 
  constants = 34678884, 
  next = 0xbfffe7c4
}
        result = 3306160
        bytestr = -1099628544
#8  0x00144d2f in funcall_lambda (fun=34627908, nargs=1, arg_vector=0xbfffe754) 
at eval.c:3229
        val = 131
        syms_left = 34627904
        next = 34627904
        i = 1
        optional = 1
        rest = 0
#9  0x00145212 in Ffuncall (nargs=2, args=0xbfffe750) at eval.c:3099
        fun = 34627908
        original_fun = 93438921
        funcar = -1099628544
        numargs = 1
        val = 3306160
        backtrace = {
  next = 0xbfffe88c, 
  function = 0xbfffe750, 
  args = 0xbfffe754, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x2106144
        i = -1099628544
        args = (Lisp_Object *) 0x591c3c9
#10 0x0017e99b in Fbyte_code (bytestr=75536379, vector=34704900, maxdepth=3) at 
bytecode.c:678
        op = 131
        vectorp = (Lisp_Object *) 0x2118e08
        stack = {
  pc = 0x5906043 ")\207", 
  top = 0xbfffe754, 
  bottom = 0xbfffe750, 
  byte_string = 75536379, 
  byte_string_start = 0x5906028 "\303\b!\205\034", 
  constants = 34704900, 
  next = 0xbfffe944
}
        result = 3306160
        bytestr = -1099628544
#11 0x00144d2f in funcall_lambda (fun=34705044, nargs=2, arg_vector=0xbfffe8d4) 
at eval.c:3229
        val = 131
        syms_left = 34705040
        next = 34705040
        i = 2
        optional = 1
        rest = 0
#12 0x00145212 in Ffuncall (nargs=3, args=0xbfffe8d0) at eval.c:3099
        fun = 34705044
        original_fun = 67043153
        funcar = -1099628544
        numargs = 2
        val = 3306160
        backtrace = {
  next = 0xbfffea0c, 
  function = 0xbfffe8d0, 
  args = 0xbfffe8d4, 
  nargs = 2, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x2118e94
        i = -1099628544
        args = (Lisp_Object *) 0x3feff51
#13 0x0017e99b in Fbyte_code (bytestr=2019283, vector=2019300, maxdepth=4) at 
bytecode.c:678
        op = 131
        vectorp = (Lisp_Object *) 0x1ecfe8
        stack = {
  pc = 0x2cc418 "*\207", 
  top = 0xbfffe8d8, 
  bottom = 0xbfffe8d0, 
  byte_string = 2019283, 
  byte_string_start = 0x2cc402 "\303\304 \305\"\304 \030\211\031\204\022", 
  constants = 2019300, 
  next = 0x0
}
        result = 3306160
        bytestr = -1099628544
#14 0x00144d2f in funcall_lambda (fun=2019236, nargs=1, arg_vector=0xbfffeaa4) 
at eval.c:3229
        val = 131
        syms_left = 2019232
        next = 2019232
        i = 1
        optional = 1
        rest = 0
#15 0x00145212 in Ffuncall (nargs=2, args=0xbfffeaa0) at eval.c:3099
        fun = 2019236
        original_fun = 67043129
        funcar = -1099628544
        numargs = 1
        val = 3306160
        backtrace = {
  next = 0xbfffec4c, 
  function = 0xbfffeaa0, 
  args = 0xbfffeaa4, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x1ecfa4
        i = -1099628544
        args = (Lisp_Object *) 0x3feff39
#16 0x001418f2 in Fcall_interactively (function=67043129, record_flag=58721289, 
keys=51388540) at callint.c:857
        val = 131
        specs = 58750537
        filter_specs = 2019339
        teml = 77516529
        up_event = 58721289
        enable = 58721289
        next_event = 2
        prefix_arg = 58721289
        string = (unsigned char *) 0x2 <Address 0x2 out of bounds>
        tem = (unsigned char *) 0xbe750000 <Address 0xbe750000 out of bounds>
        i = 3306160
        j = 1
        foo = 2
        prompt1 = '\0' <repeats 99 times>
        arg_from_tty = 0
        key_count = 2
        record_then_fail = 0
        save_this_command = 67043129
        save_last_command = 77516529
        save_this_original_command = 67043129
        save_real_this_command = 67043129
#17 0x00145425 in Ffuncall (nargs=4, args=0xbfffeca0) at eval.c:3048
        fun = -1073746780
        original_fun = 58833441
        funcar = -1099628544
        numargs = 3
        val = 3306160
        backtrace = {
  next = 0x0, 
  function = 0xbfffeca0, 
  args = 0xbfffeca4, 
  nargs = 3, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0xbfffeca4
        i = -1099628544
        args = (Lisp_Object *) 0x381ba21
#18 0x001455c1 in call3 (fn=58833441, arg1=67043129, arg2=58721289, 
arg3=58721289) at eval.c:2872
        ret_ungc_val = 131
#19 0x000e446d in command_loop_1 () at keyboard.c:1912
        cmd = 2
        lose = 2
        nonundocount = 0
        keybuf = {192, 24, -1073746360, 2922218, 0, -1073746832, 2050659, 
3298672, 58721289, 51396124, 0, 0, 0, 1330293, 2050600, 2050604, -1073746568, 
1330494, 16, 58721289, 7, 0, 1, 0, -1073746596, -1073746784, 0, 0, 58721289, 
67054001}
        i = 2
        prev_modiff = 15
        prev_buffer = (struct buffer *) 0x3101678
        already_adjusted = 0
#20 0x001435a4 in internal_condition_case (bfun=0xe400e <command_loop_1>, 
handlers=58760953, hfun=0xdce69 <cmd_error>) at eval.c:1511
        val = -1099628544
        c = {
  tag = 58721289, 
  val = 58721289, 
  next = 0xbfffee9c, 
  gcpro = 0x0, 
  jmp = {2032511, 1325783, 8096, 1324211, 58721289, 58721289, 3311984, 3298672, 
-1073746376, -1073746560, 31, 658, 1324360, 1507351, 3276831, 3276831, 
-1073807360, -1073807305}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 58760953, 
  var = 58721289, 
  chosen_clause = 0, 
  tag = 0xbfffed98, 
  next = 0x0
}
#21 0x000d6050 in command_loop_2 () at keyboard.c:1369
        val = 131
#22 0x001431f6 in internal_catch (tag=58757025, func=0xd600c <command_loop_2>, 
arg=58721289) at eval.c:1247
        c = {
  tag = 58757025, 
  val = 58721289, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {895, 0, 8096, 1323354, 5, 0, 3320944, 3298672, -1073746152, 
-1073746304, 58851359, 658, 1323497, 58851351, 58851359, 58720287, 51380224, 
55}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        tag = 131
#23 0x000d5df2 in command_loop () at keyboard.c:1348
        val = 131
#24 0x000d5eab in recursive_edit_1 () at keyboard.c:957
        val = 0
#25 0x000d5ff3 in Frecursive_edit () at keyboard.c:1019
        buffer = 58721289
#26 0x000d5031 in main (argc=5, argv=0xbffff11c) at emacs.c:1796
        dummy = -1881117246
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = 1
        skip_args = 1
        rlim = {
  rlim_cur = 8388608, 
  rlim_max = 67108864
}
        no_loadup = 0
        junk = 0x0

Lisp Backtrace:
"delete-frame" (0xbfffe5c4)
"server-delete-client" (0xbfffe754)
"server-save-buffers-kill-terminal" (0xbfffe8d4)
"save-buffers-kill-terminal" (0xbfffeaa4)
"call-interactively" (0xbfffeca4)


In GNU Emacs 23.0.60.13 (i386-apple-darwin8.11.1, GTK+ Version 2.12.9)
 of 2008-07-20 on mt-computer.local
Windowing system distributor `The XFree86 Project, Inc', version 11.0.40400000
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  value of $XMODIFIERS: nil
  locale-coding-system: nil
  default-enable-multibyte-characters: t