bug#81585: 31.0.91 and 32.0.50; Crash on macos hiding header-line with pixel-scroll-precision-mode

On Sun, Aug 9, 2026 at 12:25 AM Corwin Kerr <[email protected]> wrote:

> Hi,
>
> I found a crash (Fatal error 10: Bus error; Abort trap: 6) on macos and
> narrowed it down to turning off the header line when
> pixel-scroll-precision-mode is enabled.
>
> file minimal.el
> ;; -*- lexical-binding: t; -*-
> (pixel-scroll-precision-mode)
> (defun toggle-header ()
>   (interactive)
>   (setq header-line-format
>         (unless header-line-format "Pixel scroll, then press C-t to
> crash")))
> (toggle-header)
> (bind-key "C-t" #'toggle-header)
>
> To reproduce
> 1 . emacs -Q --load minimal.el
> 2. Scroll on the trackpad so half a line of buffer text is going off
> screen to the top.
> 3. C-t crash
>
> I built from source in debug mode and reproduced it on master at 32.0.50
> and emacs-31 at 31.0.91. Happy to help test any fixes.
>
> Here's a backtrace from lldb -- .src/emacs -Q --load minimal.el
>
> * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS
> (code=2, address=0x111ed1e90)
>     frame #0: 0x00007ff81bb07a4c
> libsystem_platform.dylib`_platform_memmove$VARIANT$Haswell + 268
> libsystem_platform.dylib`_platform_memmove$VARIANT$Haswell:
> ->  0x7ff81bb07a4c <+268>: vmovups %ymm0, (%rax)
>     0x7ff81bb07a50 <+272>: vxorps %ymm0, %ymm0, %ymm0
>     0x7ff81bb07a54 <+276>: vmovups 0x20(%rsi), %ymm2
>     0x7ff81bb07a59 <+281>: addq   $0x40, %rsi
> Target 0: (emacs) stopped.
> (lldb) bt all
> * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS
> (code=2, address=0x111ed1e90)
>   * frame #0: 0x00007ff81bb07a4c
> libsystem_platform.dylib`_platform_memmove$VARIANT$Haswell + 268
>     frame #1: 0x000000010023a8f4 emacs`-[EmacsView
> copyRect:to:](self=<unavailable>, _cmd=<unavailable>, srcRect=(origin = (x
> = 2, y = 5), size = (width = 576, height = 42)), dest=<unavailable>) at
> nsterm.m:9345:7
>     frame #2: 0x00000001002433ab emacs`ns_scroll_run(w=<unavailable>,
> run=0x00007fdd1c823bb0) at nsterm.m:2901:5
>     frame #3: 0x0000000100006764
> emacs`scrolling_window(w=0x00007fdd1d03e1c0, tab_line_p=<unavailable>) at
> dispnew.c:5567:6
>     frame #4: 0x0000000100005b7b emacs`update_window(w=0x00007fdd1d03e1c0)
> at dispnew.c:4492:16
>     frame #5: 0x000000010000adc8
> emacs`update_window_tree(w=0x00007fdd1d03e1c0) at dispnew.c:4262:2
>     frame #6: 0x00000001000051c1
> emacs`update_window_frame(f=0x00007fdd1d03df60) at dispnew.c:3894:3
> [inlined]
>     frame #7: 0x0000000100005143 emacs`update_frame(f=0x00007fdd1d03df60,
> inhibit_scrolling=<unavailable>) at dispnew.c:4146:5
>     frame #8: 0x00000001000329cb emacs`redisplay_internal at
> xdisp.c:17979:5
>     frame #9: 0x00000001000386e5 emacs`redisplay at xdisp.c:17045:3
> [artificial]
>     frame #10: 0x00000001000fe460 emacs`read_char(commandflag=1,
> map=0x00007fdd1b18a3c3, prev_event=0x0000000000000000,
> used_mouse_menu=0x00007ff7bfefe8bf, end_time=0x0000000000000000) at
> keyboard.c:2711:6
>     frame #11: 0x00000001000ef38c
> emacs`read_key_sequence(keybuf=<unavailable>, prompt=0x0000000000000000,
> dont_downcase_last=false, can_return_switch_frame=true,
> fix_current_buffer=true, prevent_redisplay=<unavailable>,
> disable_text_conversion_p=<unavailable>) at keyboard.c:11224:12
>     frame #12: 0x00000001000ed429 emacs`command_loop_1 at
> keyboard.c:1424:15
>     frame #13: 0x000000010018358e
> emacs`internal_condition_case(bfun=(emacs`command_loop_1 at
> keyboard.c:1319), handlers=<unavailable>, hfun=(emacs`cmd_error at
> keyboard.c:965)) at eval.c:1712:25
>     frame #14: 0x00000001000ed02e
> emacs`command_loop_2(handlers=0x0000000000000090) at keyboard.c:1163:11
>     frame #15: 0x0000000100182ccb emacs`internal_catch(tag=<unavailable>,
> func=(emacs`command_loop_2 at keyboard.c:1159), arg=0x0000000000000090) at
> eval.c:1392:25
>     frame #16: 0x0000000100275a18 emacs`command_loop.cold.1 at
> keyboard.c:1141:2
>     frame #17: 0x00000001000ec874 emacs`command_loop at keyboard.c:1140:2
>     frame #18: 0x00000001000ec74f emacs`recursive_edit_1 at
> keyboard.c:749:9
>     frame #19: 0x00000001000eca10 emacs`Frecursive_edit at keyboard.c:832:3
>     frame #20: 0x00000001000eb7fb emacs`main(argc=<unavailable>,
> argv=0x00007ff7bfeff458) at emacs.c:2635:3
>     frame #21: 0x00007ff81b72c530 dyld`start + 3056
>   thread #2
>     frame #0: 0x00007ff81ba91286 libsystem_kernel.dylib`__workq_kernreturn
> + 10
>   thread #3
>     frame #0: 0x00007ff81ba91286 libsystem_kernel.dylib`__workq_kernreturn
> + 10
>     frame #1: 0x6566666141c813fd
>     frame #2: 0x00007ff81bacd843 libsystem_pthread.dylib`start_wqthread +
> 15
>   thread #4, name = 'gmain'
>     frame #0: 0x00007ff81ba989fe libsystem_kernel.dylib`__select + 10
>     frame #1: 0x0000000101305b7b libglib-2.0.0.dylib`g_poll + 663
>     frame #2: 0x00000001012f694b
> libglib-2.0.0.dylib`g_main_context_iterate_unlocked + 392
>     frame #3: 0x00000001012f6a07
> libglib-2.0.0.dylib`g_main_context_iteration + 55
>     frame #4: 0x00000001012f7a31 libglib-2.0.0.dylib`glib_worker_main + 30
>     frame #5: 0x000000010131e6c8 libglib-2.0.0.dylib`g_thread_proxy + 77
>     frame #6: 0x00007ff81bad1e05 libsystem_pthread.dylib`_pthread_start +
> 115
>     frame #7: 0x00007ff81bacd857 libsystem_pthread.dylib`thread_start + 15
>   thread #5
>     frame #0: 0x00007ff81ba94962 libsystem_kernel.dylib`__pselect + 10
>     frame #1: 0x00007ff81ba94858
> libsystem_kernel.dylib`pselect$DARWIN_EXTSN + 42
>     frame #2: 0x000000010022ff02 emacs`-[EmacsApp
> fd_handler:](self=<unavailable>, _cmd=<unavailable>, unused=<unavailable>)
> at nsterm.m:6780:20
>     frame #3: 0x00007ff81ccf8d29 Foundation`__NSThread__start__ + 1014
>     frame #4: 0x00007ff81bad1e05 libsystem_pthread.dylib`_pthread_start +
> 115
>     frame #5: 0x00007ff81bacd857 libsystem_pthread.dylib`thread_start + 15
>   thread #6, name = 'com.apple.NSEventThread'
>     frame #0: 0x00007ff81ba8fb4a libsystem_kernel.dylib`mach_msg2_trap + 10
>     frame #1: 0x00007ff81ba9e6bc libsystem_kernel.dylib`mach_msg2_internal
> + 83
>     frame #2: 0x00007ff81ba96bc3 libsystem_kernel.dylib`mach_msg_overwrite
> + 574
>     frame #3: 0x00007ff81ba8fe3b libsystem_kernel.dylib`mach_msg + 19
>     frame #4: 0x00007ff81bbbb9f2 CoreFoundation`__CFRunLoopServiceMachPort
> + 145
>     frame #5: 0x00007ff81bbba43f CoreFoundation`__CFRunLoopRun + 1430
>     frame #6: 0x00007ff81bbb9872 CoreFoundation`CFRunLoopRunSpecific + 536
>     frame #7: 0x00007ff81f7729ff AppKit`_NSEventThread + 127
>     frame #8: 0x00007ff81bad1e05 libsystem_pthread.dylib`_pthread_start +
> 115
>     frame #9: 0x00007ff81bacd857 libsystem_pthread.dylib`thread_start + 15
>   thread #7, stop reason = thread-creation
>     frame #0: 0x00007ff81bacd834 libsystem_pthread.dylib`start_wqthread
>   thread #8
>     frame #0: 0x00007ff81ba91286 libsystem_kernel.dylib`__workq_kernreturn
> + 10
>     frame #1: 0x00007ff81bace8ba libsystem_pthread.dylib`_pthread_wqthread
> + 387
>     frame #2: 0x00007ff81bacd843 libsystem_pthread.dylib`start_wqthread +
> 15
>
>
>
> Output from M-x report-emacs-bug:
>
> In GNU Emacs 32.0.50 (build 1, x86_64-apple-darwin24.6.0, NS
>  appkit-2575.70 Version 15.7.8 (Build 24G824)) of 2026-08-08 built on
>  XXX
> Repository revision: b157d8e96a26e7509136bf93fad2c7ec49c0ee88
> Repository branch: master
> Windowing system distributor 'Apple', version 10.3.2575
> System Description: macOS 15.7.8
>
> Configured using:
>  'configure --with-native-compilation=no 'CFLAGS=-g -ggdb3''
>
> Configured features:
> ACL DBUS GIF GLIB GMP GNUTLS JPEG LCMS2 LIBXML2 MODULES NOTIFY KQUEUE NS
> PDUMPER PNG RSVG SQLITE3 THREADS TIFF TOOLKIT_SCROLL_BARS TREE_SITTER
> WEBP XIM ZLIB
>
> Important settings:
>   value of $LANG: en_US.UTF-8
>   locale-coding-system: utf-8-unix
>
> Major mode: Lisp Interaction
>
> Minor modes in effect:
>   override-global-mode: t
>   pixel-scroll-precision-mode: t
>   tooltip-mode: t
>   global-eldoc-mode: t
>   eldoc-mode: t
>   show-paren-mode: t
>   electric-indent-mode: t
>   mouse-wheel-mode: t
>   tool-bar-mode: t
>   menu-bar-mode: t
>   file-name-shadow-mode: t
>   global-font-lock-mode: t
>   font-lock-mode: t
>   blink-cursor-mode: t
>   minibuffer-nonselected-mode: t
>   minibuffer-regexp-mode: t
>   line-number-mode: t
>   indent-tabs-mode: t
>   transient-mark-mode: t
>   auto-composition-mode: t
>   auto-encryption-mode: t
>   auto-compression-mode: t
>
> Load-path shadows:
> None found.
>
> Features:
> (shadow sort mail-extr emacsbug lisp-mnt message mailcap yank-media puny
> dired dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg
> rfc6068 epg-config gnus-util text-property-search time-date mm-decode
> mm-bodies mm-encode mailabbrev gmm-utils mailheader sendmail mail-parse
> rfc2231 rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils edmacro
> kmacro bind-key easy-mmode cl-loaddefs cl-lib pixel-scroll ring subr-x
> rmc iso-transl tooltip cconv eldoc paren electric uniquify ediff-hook
> vc-hooks lisp-float-type elisp-mode mwheel term/ns-win ns-win
> ucs-normalize mule-util term/common-win tool-bar dnd fontset image
> regexp-opt fringe tabulated-list replace newcomment text-mode lisp-mode
> prog-mode register page tab-bar menu-bar rfn-eshadow isearch easymenu
> timer select scroll-bar mouse jit-lock font-lock syntax font-core
> term/tty-colors frame minibuffer nadvice seq simple cl-generic
> indonesian philippine cham georgian utf-8-lang misc-lang vietnamese
> tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek
> romanian slovak czech european ethiopic indian cyrillic chinese
> composite emoji-zwj charscript charprop case-table epa-hook
> jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button loaddefs
> theme-loaddefs faces cus-face macroexp files window text-properties
> overlay sha1 md5 base64 format env code-pages mule custom widget keymap
> hashtable-print-readable backquote threads dbusbind kqueue cocoa ns
> lcms2 multi-tty make-network-process tty-child-frames emacs)
>
> Memory information:
> ((conses 16 44123 8967) (symbols 48 7016 0) (strings 32 15654 1055)
>  (string-bytes 1 344177) (vectors 16 10273)
>  (vector-slots 8 117236 8476) (floats 8 33 3) (intervals 56 231 0)
>  (buffers 1064 10))
>

I was able to reproduce this on emacs-31 and with a debug build I can see
generally what the problem is but not precisely sure what computation is
erroneous within the redisplay.  Perhaps Alan (cc'd here) has more
experience with this.