bug#20802: Segfault when showing non-GTK+ tooltip

[Tobias Getzner <tobias.getzner@gmx.de>]

On Di, 2015-06-16 at 15:30 +0200, martin rudalics wrote:
>  > This was after setting x-gtk-use-system-tooltip to nil and 
> customizing
>  > the tooltip face to #qqq.
> [...]
>  > Program received signal SIGSEGV, Segmentation fault.
>  > cache_image (f=0x1170a68, img=<optimized out>) at image.c:1782
>  > 1782	  for (i = 0; i < c->used; ++i)
> 
> This should be indeed the same segfault I saw.  Meanwhile I checked 
> in a
> fix on trunk/master.  If you can build Emacs please try it.
> 

Thanks! I built from master (34a43ba), which includes your 93ae9f4. I’m
still seeing a segfault for the steps given above. Backtrace below.

Best,
TG 


Program received signal SIGSEGV, Segmentation fault.
lookup_image (f=0x1195480, spec=spec@entry=16917427) at image.c:1744
1744	      cache_image (f, img);
(gdb) bt
#0  lookup_image (f=0x1195480, spec=spec@entry=16917427) at image.c:1744
#1  0x000000000043737f in calc_pixel_width_or_height (res=res@entry=0x7fffffff37c8, it=it@entry=0x7fffffff72f0, prop=16917427, font=font@entry=0x11986c0, width_p=width_p@entry=true, 
    align_to=align_to@entry=0x7fffffff3890) at xdisp.c:24019
#2  0x00000000004370e8 in calc_pixel_width_or_height (align_to=0x7fffffff3890, width_p=<optimized out>, font=0x11986c0, prop=<optimized out>, it=0x7fffffff72f0, res=0x7fffffff37c8) at xdisp.c:24056
#3  calc_pixel_width_or_height (res=res@entry=0x7fffffff3838, it=it@entry=0x7fffffff72f0, prop=16917347, font=font@entry=0x11986c0, width_p=width_p@entry=true, align_to=align_to@entry=0x7fffffff3890)
    at xdisp.c:24058
#4  0x00000000004372e6 in calc_pixel_width_or_height (align_to=0x7fffffff3890, width_p=true, font=0x11986c0, prop=<optimized out>, it=0x7fffffff72f0, res=0x7fffffff3838) at xdisp.c:23902
#5  calc_pixel_width_or_height (res=res@entry=0x7fffffff3898, it=it@entry=0x7fffffff72f0, prop=<optimized out>, font=font@entry=0x11986c0, width_p=width_p@entry=true, align_to=align_to@entry=0x7fffffff3890)
    at xdisp.c:24033
#6  0x000000000045b4f1 in calc_pixel_width_or_height (align_to=0x7fffffff3890, width_p=true, font=0x11986c0, prop=<optimized out>, it=0x7fffffff72f0, res=0x7fffffff3898) at xdisp.c:25909
#7  produce_stretch_glyph (it=0x7fffffff72f0) at xdisp.c:25910
#8  0x000000000045a415 in x_produce_glyphs (it=0x7fffffff72f0) at xdisp.c:27136
#9  0x00000000004480ee in display_line (it=it@entry=0x7fffffff72f0) at xdisp.c:20223
#10 0x000000000044c6ca in try_window (window=window@entry=18441365, pos=..., flags=flags@entry=1) at xdisp.c:16889
#11 0x00000000004627d2 in redisplay_window (window=18441365, just_this_one_p=just_this_one_p@entry=false) at xdisp.c:16362
#12 0x000000000046548b in redisplay_window_0 (window=window@entry=18441365) at xdisp.c:14181
#13 0x000000000055765b in internal_condition_case_1 (bfun=bfun@entry=0x465460 <redisplay_window_0>, arg=18441365, handlers=<optimized out>, hfun=hfun@entry=0x42c260 <redisplay_window_error>) at eval.c:1372
#14 0x00000000004319df in redisplay_windows (window=18441365) at xdisp.c:14161
#15 0x0000000000452541 in redisplay_internal () at xdisp.c:13753
#16 0x000000000045469a in redisplay_preserve_echo_area (from_where=from_where@entry=2) at xdisp.c:14014
#17 0x000000000041d6de in Fredisplay (force=0) at dispnew.c:5777
#18 0x0000000000558f5e in Ffuncall (nargs=1, args=args@entry=0x7fffffffc140) at eval.c:2718
#19 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, vector=8816373, maxdepth=<optimized out>, args_template=<optimized out>, nargs=nargs@entry=1, args=<optimized out>, args@entry=0x7fffffffc140)
    at bytecode.c:919
#20 0x0000000000558ad4 in funcall_lambda (fun=8816340, nargs=nargs@entry=1, arg_vector=0x7fffffffc140, arg_vector@entry=0x7fffffffc2c0) at eval.c:2885
#21 0x0000000000558d7b in Ffuncall (nargs=2, args=args@entry=0x7fffffffc2b8) at eval.c:2779
#22 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, vector=10509325, maxdepth=<optimized out>, args_template=args_template@entry=0, nargs=nargs@entry=0, args=<optimized out>, args@entry=0x0)
    at bytecode.c:919
#23 0x00000000005589af in funcall_lambda (fun=10509197, nargs=nargs@entry=2, arg_vector=arg_vector@entry=0x7fffffffc4c0) at eval.c:2951
#24 0x0000000000558d7b in Ffuncall (nargs=3, args=args@entry=0x7fffffffc4b8) at eval.c:2779
#25 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, vector=10511429, maxdepth=<optimized out>, args_template=args_template@entry=0, nargs=nargs@entry=0, args=<optimized out>, args@entry=0x0)
    at bytecode.c:919
#26 0x00000000005589af in funcall_lambda (fun=10511333, nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x7fffffffc778) at eval.c:2951
#27 0x0000000000558d7b in Ffuncall (nargs=2, args=0x7fffffffc770) at eval.c:2779
#28 0x0000000000556f95 in run_hook_with_args (nargs=2, args=0x7fffffffc770, funcall=0x558ba0 <Ffuncall>) at eval.c:2529
#29 0x0000000000558e69 in Ffuncall (nargs=3, args=args@entry=0x7fffffffc768) at eval.c:2698
#30 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, vector=10508605, maxdepth=<optimized out>, args_template=args_template@entry=0, nargs=nargs@entry=0, args=<optimized out>, args@entry=0x0)
    at bytecode.c:919
#31 0x00000000005589af in funcall_lambda (fun=10508541, nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x7fffffffca48) at eval.c:2951
#32 0x0000000000558d7b in Ffuncall (nargs=nargs@entry=2, args=args@entry=0x7fffffffca40) at eval.c:2779
#33 0x000000000055a1f3 in Fapply (nargs=2, args=0x7fffffffca40) at eval.c:2293
#34 0x0000000000558e69 in Ffuncall (nargs=3, args=args@entry=0x7fffffffca38) at eval.c:2698
#35 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, vector=10064605, maxdepth=<optimized out>, args_template=args_template@entry=0, nargs=nargs@entry=0, args=<optimized out>, args@entry=0x0)
    at bytecode.c:919
#36 0x00000000005589af in funcall_lambda (fun=10064525, nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x7fffffffcc38) at eval.c:2951
#37 0x0000000000558d7b in Ffuncall (nargs=nargs@entry=2, args=args@entry=0x7fffffffcc30) at eval.c:2779
#38 0x000000000055904a in call1 (fn=fn@entry=43776, arg1=arg1@entry=23853549) at eval.c:2573
#39 0x00000000004ee838 in timer_check_2 (idle_timers=<optimized out>, timers=<optimized out>) at keyboard.c:4536
#40 timer_check () at keyboard.c:4603
#41 0x00000000004eebe9 in readable_events (flags=flags@entry=1) at keyboard.c:3437
#42 0x00000000004f0218 in get_input_pending (flags=flags@entry=1) at keyboard.c:6821
#43 0x00000000004f2328 in detect_input_pending_run_timers (do_display=do_display@entry=true) at keyboard.c:9976
#44 0x000000000059719e in wait_reading_process_output (time_limit=time_limit@entry=30, nsecs=<optimized out>, nsecs@entry=0, read_kbd=read_kbd@entry=-1, do_display=do_display@entry=true, 
    wait_for_cell=wait_for_cell@entry=0, wait_proc=wait_proc@entry=0x0, just_wait_proc=0) at process.c:5009
#45 0x00000000004221d2 in sit_for (timeout=<optimized out>, reading=reading@entry=true, display_option=display_option@entry=1) at dispnew.c:5748
#46 0x00000000004f48a4 in read_char (commandflag=commandflag@entry=1, map=map@entry=34697955, prev_event=0, used_mouse_menu=used_mouse_menu@entry=0x7fffffffd82b, end_time=end_time@entry=0x0) at keyboard.c:2784
#47 0x00000000004f542c in read_key_sequence (keybuf=keybuf@entry=0x7fffffffd900, prompt=prompt@entry=0, dont_downcase_last=dont_downcase_last@entry=false, 
    can_return_switch_frame=can_return_switch_frame@entry=true, fix_current_buffer=fix_current_buffer@entry=true, prevent_redisplay=prevent_redisplay@entry=false, bufsize=30) at keyboard.c:9159
#48 0x00000000004f7051 in command_loop_1 () at keyboard.c:1407
#49 0x0000000000557537 in internal_condition_case (bfun=bfun@entry=0x4f6e20 <command_loop_1>, handlers=handlers@entry=18624, hfun=hfun@entry=0x4edf70 <cmd_error>) at eval.c:1348
#50 0x00000000004e95fc in command_loop_2 (ignore=ignore@entry=0) at keyboard.c:1139
#51 0x0000000000557413 in internal_catch (tag=tag@entry=44352, func=func@entry=0x4e95e0 <command_loop_2>, arg=arg@entry=0) at eval.c:1108
#52 0x00000000004e95b9 in command_loop () at keyboard.c:1118
#53 0x00000000004edb5b in recursive_edit_1 () at keyboard.c:728
#54 0x00000000004edea8 in Frecursive_edit () at keyboard.c:799
#55 0x0000000000418447 in main (argc=2, argv=0x7fffffffdc68) at emacs.c:1626