Dear Maintainer,

   * What led up to the situation?

Using Debian 11.7 with the provided package for Emacs 27.1, performing
M-x vc-revert on a changed file caused a segfault.  I've managed to
find the following to reproduce it which uses the Emacs Git repository
along with the source file that needs to be patched to resolve it.

src/emacs -Q src/xdisp.c --eval "(add-to-list 'display-buffer-alist (list \".\" 'display-buffer-same-window))" -f global-display-line-numbers-mode
Apply the patch below, or make any change for testing
M-x vc-revert

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

This is fixed upstream since 27.2 and has other ways of causing the
segfault - see https://debbugs.gnu.org/cgi/bugreport.cgi?bug=44111

I've reproduced this using a Git or Mercurial repository and other VC's
may be affected as it seems a general Emacs issue with line numbers.

Manually applying the fix from the upstream bug (commit
e29cace60afdab04ff20c4f4043a3ee64ec9d01d) also fixes the issue.

   * What was the outcome of this action?

Segfault.

   * What outcome did you expect instead?

Show the *vc-diff* buffer with the changes to be reverted.
This is resolved by applying the upstream commit.

Emacs 27.2 and later releases are unaffected.

   * Extra information

I've reproduced this

- in a TTY and in a GTK session with the provided package
- ditto with a manual build from source. tag emacs-27.1
  ./configure --without-all CFLAGS='-g -O0'
  gdb backtrace

0  0x000055555592f1bd in face_for_char (f=0x555555efd120, face=0x0, c=0, pos=-1, object=0x0) at fontset.c:929
1  0x00005555555b2d03 in FACE_FOR_CHAR (f=0x555555efd120, face=0x0, character=0, pos=-1, object=0x0) at dispextern.h:1891
2  0x00005555555f20d8 in append_space_for_newline (it=0x7fffffff6730, default_face_p=false) at xdisp.c:21640
3  0x00005555555f9521 in display_line (it=0x7fffffff6730, cursor_vpos=0) at xdisp.c:23674
4  0x00005555555eb34f in try_window (window=0x555555efd385, pos=..., flags=1) at xdisp.c:19182
5  0x00005555555e8ae7 in redisplay_window (window=0x555555efd385, just_this_one_p=false) at xdisp.c:18600
6  0x00005555555e1b83 in redisplay_window_0 (window=0x555555efd385) at xdisp.c:16314
7  0x00005555558512ed in internal_condition_case_1 (bfun=0x5555555e1b41 <redisplay_window_0>, arg=0x555555efd385, handlers=0x7ffff6ce74fb, hfun=0x5555555e1b09 <redisplay_window_error>) at eval.c:1380
8  0x00005555555e1adf in redisplay_windows (window=0x555555efd385) at xdisp.c:16294
9  0x00005555555e0a0a in redisplay_internal () at xdisp.c:15762
10 0x00005555555dedd6 in redisplay () at xdisp.c:14989
11 0x00005555557383ea in read_char (commandflag=1, map=0x5555564c2f53, prev_event=0x0, used_mouse_menu=0x7fffffffbb4f, end_time=0x0) at keyboard.c:2493
12 0x00005555557471a0 in read_key_sequence (keybuf=0x7fffffffbd50, prompt=0x0, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:9553
13 0x0000555555735575 in command_loop_1 () at keyboard.c:1350
14 0x0000555555851246 in internal_condition_case (bfun=0x55555573512f <command_loop_1>, handlers=0x90, hfun=0x5555557348cb <cmd_error>) at eval.c:1356
15 0x0000555555734df7 in command_loop_2 (ignore=0x0) at keyboard.c:1091
16 0x0000555555850afb in internal_catch (tag=0x51f0, func=0x555555734dca <command_loop_2>, arg=0x0) at eval.c:1117
17 0x0000555555734d26 in command_loop () at keyboard.c:1062
18 0x000055555573449c in recursive_edit_1 () at keyboard.c:714de
19 0x000055555579c602 in read_minibuf (map=0x7ffff6b25e3b, initial=0x0, prompt=0x5555563f62e4, expflag=false, histvar=0xe340, histpos=0x2, defalt=0x0, allow_props=false, inherit_input_method=false) at minibuf.c:664
20 0x000055555579cf6c in Fread_from_minibuffer (prompt=0x5555563f62e4, initial_contents=0x0, keymap=0x7ffff6b25e3b, read=0x0, hist=0xe340, default_value=0x0, inherit_input_method=0x0) at minibuf.c:942
21 0x000055555586923c in Fyes_or_no_p (prompt=0x5555563f62e4) at fns.c:2813
22 0x0000555555854d6b in funcall_subr (subr=0x555555e4dae0 <Syes_or_no_p>, numargs=1, args=0x7fffffffc400) at eval.c:2868
23 0x000055555585497f in Ffuncall (nargs=2, args=0x7fffffffc3f8) at eval.c:2795
24 0x00005555558b76c7 in exec_byte_code (bytestr=0x555556414244, vector=0x5555563d3675, maxdepth=0x3a, args_template=0x2, nargs=0, args=0x7fffffffcb60) at bytecode.c:633
25 0x00005555558553e5 in funcall_lambda (fun=0x55555640dfc5, nargs=0, arg_vector=0x7fffffffcb60) at eval.c:2990
26 0x00005555558549c3 in Ffuncall (nargs=1, args=0x7fffffffcb58) at eval.c:2797
27 0x00005555558477ca in Ffuncall_interactively (nargs=1, args=0x7fffffffcb58) at callint.c:254
28 0x0000555555854c91 in funcall_subr (subr=0x555555e4ba20 <Sfuncall_interactively>, numargs=1, args=0x7fffffffcb58) at eval.c:2848
29 0x000055555585497f in Ffuncall (nargs=2, args=0x7fffffffcb50) at eval.c:2795
30 0x00005555558538fb in Fapply (nargs=3, args=0x7fffffffcb50) at eval.c:2378
31 0x0000555555847b83 in Fcall_interactively (function=0x2aaaa0d5fbf0, record_flag=0xa7a0, keys=0x5555563135f5) at callint.c:342
32 0x0000555555854dc5 in funcall_subr (subr=0x555555e4ba60 <Scall_interactively>, numargs=3, args=0x7fffffffcef0) at eval.c:2873
33 0x000055555585497f in Ffuncall (nargs=4, args=0x7fffffffcee8) at eval.c:2795
34 0x00005555558b76c7 in exec_byte_code (bytestr=0x7ffff6bd363c, vector=0x7ffff6bd3165, maxdepth=0x36, args_template=0x1006, nargs=2, args=0x7fffffffd458) at bytecode.c:633
35 0x00005555558553e5 in funcall_lambda (fun=0x7ffff6bd3135, nargs=2, arg_vector=0x7fffffffd448) at eval.c:2990
36 0x00005555558549c3 in Ffuncall (nargs=3, args=0x7fffffffd440) at eval.c:2797
37 0x00005555558b76c7 in exec_byte_code (bytestr=0x7ffff6b84ea4, vector=0x7ffff6b849a5, maxdepth=0x3e, args_template=0xc06, nargs=3, args=0x7fffffffdb68) at bytecode.c:633
38 0x00005555558553e5 in funcall_lambda (fun=0x7ffff6b8381d, nargs=3, arg_vector=0x7fffffffdb50) at eval.c:2990
39 0x00005555558549c3 in Ffuncall (nargs=4, args=0x7fffffffdb48) at eval.c:2797
40 0x00005555558477ca in Ffuncall_interactively (nargs=4, args=0x7fffffffdb48) at callint.c:254
41 0x0000555555854c91 in funcall_subr (subr=0x555555e4ba20 <Sfuncall_interactively>, numargs=4, args=0x7fffffffdb48) at eval.c:2848
42 0x000055555585497f in Ffuncall (nargs=5, args=0x7fffffffdb40) at eval.c:2795
43 0x0000555555853c9c in Fapply (nargs=3, args=0x7fffffffdc10) at eval.c:2425
44 0x0000555555847b83 in Fcall_interactively (function=0x2aaaa0cd4308, record_flag=0x0, keys=0x55555611f745) at callint.c:342
45 0x0000555555854dc5 in funcall_subr (subr=0x555555e4ba60 <Scall_interactively>, numargs=3, args=0x7fffffffdfb0) at eval.c:2873
46 0x000055555585497f in Ffuncall (nargs=4, args=0x7fffffffdfa8) at eval.c:2795
47 0x00005555558b76c7 in exec_byte_code (bytestr=0x7ffff6bd363c, vector=0x7ffff6bd3165, maxdepth=0x36, args_template=0x1006, nargs=1, args=0x7fffffffe4f0) at bytecode.c:633
48 0x00005555558553e5 in funcall_lambda (fun=0x7ffff6bd3135, nargs=1, arg_vector=0x7fffffffe4e8) at eval.c:2990
49 0x00005555558549c3 in Ffuncall (nargs=2, args=0x7fffffffe4e0) at eval.c:2797
50 0x0000555555854258 in call1 (fn=0x3ae0, arg1=0x2aaaa0cd4308) at eval.c:2655
51 0x0000555555735913 in command_loop_1 () at keyboard.c:1463
52 0x0000555555851246 in internal_condition_case (bfun=0x55555573512f <command_loop_1>, handlers=0x90, hfun=0x5555557348cb <cmd_error>) at eval.c:1356
53 0x0000555555734df7 in command_loop_2 (ignore=0x0) at keyboard.c:1091
54 0x0000555555850afb in internal_catch (tag=0xc510, func=0x555555734dca <command_loop_2>, arg=0x0) at eval.c:1117
55 0x0000555555734d96 in command_loop () at keyboard.c:1070 |
56 0x000055555573449c in recursive_edit_1 () at keyboard.c:714
57 0x000055555573461f in Frecursive_edit () at keyboard.c:786
58 0x000055555572cc6a in main (argc=1, argv=0x7fffffffea08) at emacs.c:2062 EC [B] Abbrev)