bug#22818: 25.1.1 Emacs.app crash ns_compute_glyph_string_overhangs

[Alan Third <alan@idiocy.org>]

On Sat, Nov 19, 2016 at 09:07:50AM +0200, Eli Zaretskii wrote:
> Can you convert the address in frame #0 into line numbers?  Judging by
> the faulting address, 0xd0, some pointer in
> ns_compute_glyph_string_overhangs is a null pointer, but it's hard to
> tell which one without the line number information.

I finally managed to replicate this on my own build:

(lldb) run -Q ~/test-file
Process 66588 launched: '/Users/alan/src/emacs/emacs-25/nextstep/Emacs.app/Contents/MacOS/Emacs' (x86_64)
Process 66588 stopped
* thread #1: tid = 0x154600, 0x00000001002c0940 Emacs`ns_compute_glyph_string_overhangs(s=0x00007fff5fbfb6f0) + 224 at nsterm.m:2681, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xd0)
    frame #0: 0x00000001002c0940 Emacs`ns_compute_glyph_string_overhangs(s=0x00007fff5fbfb6f0) + 224 at nsterm.m:2681
   2678	  else
   2679	    {
   2680	      s->left_overhang = 0;
-> 2681	      if (EQ (font->driver->type, Qns))
   2682	        s->right_overhang = ((struct nsfont_info *)font)->ital ?
   2683	          FONT_HEIGHT (font) * 0.2 : 0;
   2684	      else
(lldb) bt all
* thread #1: tid = 0x154600, 0x00000001002c0940 Emacs`ns_compute_glyph_string_overhangs(s=0x00007fff5fbfb6f0) + 224 at nsterm.m:2681, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xd0)
  * frame #0: 0x00000001002c0940 Emacs`ns_compute_glyph_string_overhangs(s=0x00007fff5fbfb6f0) + 224 at nsterm.m:2681
    frame #1: 0x0000000100058e7c Emacs`draw_glyphs(w=0x000000010204f430, x=570, row=0x000000010240e100, area=TEXT_AREA, start=0, end=52, hl=DRAW_NORMAL_TEXT, overlaps=0) + 3324 at xdisp.c:25673
    frame #2: 0x00000001000580cd Emacs`x_write_glyphs(w=0x000000010204f430, updated_row=0x000000010240e100, start=0x0000000102420000, updated_area=TEXT_AREA, len=52) + 269 at xdisp.c:27774
    frame #3: 0x000000010000ea34 Emacs`update_text_area(w=0x000000010204f430, updated_row=0x000000010240e100, vpos=1) + 452 at dispnew.c:3612
    frame #4: 0x000000010000ca32 Emacs`update_window_line(w=0x000000010204f430, vpos=1, mouse_face_overwritten_p=0x00007fff5fbfbdd2) + 274 at dispnew.c:3855
    frame #5: 0x0000000100006be1 Emacs`update_window(w=0x000000010204f430, force_p=true) + 865 at dispnew.c:3477
    frame #6: 0x0000000100005c88 Emacs`update_window_tree(w=0x000000010204f430, force_p=true) + 200 at dispnew.c:3219
    frame #7: 0x0000000100005996 Emacs`update_frame(f=0x0000000102050430, force_p=true, inhibit_hairy_id_p=false) + 182 at dispnew.c:3108
    frame #8: 0x000000010004151d Emacs`redisplay_internal + 6957 at xdisp.c:14085
    frame #9: 0x0000000100042a79 Emacs`redisplay + 9 at xdisp.c:13255
    frame #10: 0x000000010013a985 Emacs`read_char(commandflag=1, map=4362425571, prev_event=0, used_mouse_menu=0x00007fff5fbfefb7, end_time=0x0000000000000000) + 1829 at keyboard.c:2482
    frame #11: 0x0000000100136b09 Emacs`read_key_sequence(keybuf=0x00007fff5fbff2e0, bufsize=30, prompt=0, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) + 1737 at keyboard.c:9068
    frame #12: 0x00000001001356bb Emacs`command_loop_1 + 1435 at keyboard.c:1370
    frame #13: 0x00000001001f8493 Emacs`internal_condition_case(bfun=(Emacs`command_loop_1 at keyboard.c:1261), handlers=16752, hfun=(Emacs`cmd_error at keyboard.c:940)) + 115 at eval.c:1314
    frame #14: 0x000000010014a8ec Emacs`command_loop_2(ignore=0) + 44 at keyboard.c:1112
    frame #15: 0x00000001001f7c68 Emacs`internal_catch(tag=42480, func=(Emacs`command_loop_2 at keyboard.c:1108), arg=0) + 72 at eval.c:1079
    frame #16: 0x0000000100134688 Emacs`command_loop + 280 at keyboard.c:1091
    frame #17: 0x00000001001344d0 Emacs`recursive_edit_1 + 192 at keyboard.c:697
    frame #18: 0x0000000100134821 Emacs`Frecursive_edit + 305 at keyboard.c:768
    frame #19: 0x0000000100132548 Emacs`main(argc=3, argv=0x00007fff5fbff8e8) + 5864 at emacs.c:1626
    frame #20: 0x00007fff8f1a6255 libdyld.dylib`start + 1
    frame #21: 0x00007fff8f1a6255 libdyld.dylib`start + 1

(lldb) frame variable
(glyph_string *) s = 0x00007fff5fbfb6f0
(font *) font = 0x0000000000000000

(lldb) frame variable *s
(glyph_string) *s = {
  x = 10
  y = 16
  ybase = 30
  width = 11
  background_width = 11
  height = 20
  left_overhang = 0
  right_overhang = 0
  f = 0x0000000102050430
  w = 0x000000010204f430
  display = 0x0000000000000000
  window = 1
  row = 0x000000010240e100
  area = TEXT_AREA
  char2b = 0x0000000000000000
  nchars = 1
  hl = DRAW_NORMAL_TEXT
  face = 0x000000010153b400
  font = 0x0000000000000000
  cmp = 0x0000000000000000
  cmp_id = 0
  cmp_from = 0
  cmp_to = 0
  extends_to_end_of_line_p = false
  background_filled_p = false
  font_not_found_p = false
  stippled_p = false
  for_overlaps = 0
  padding_p = false
  first_glyph = 0x0000000102420000
  img = 0x0000000000000000
  xwidget = 0x0000000000000000
  slice = (x = 0, y = 0, width = 0, height = 0)
  clip_head = 0x0000000000000000
  clip_tail = 0x0000000000000000
  clip = ([0] = (origin = (x = 0, y = 0), size = (width = 0, height = 0)), [1] = (origin = (x = 0, y = 0), size = (width = 0, height = 0)))
  num_clips = 0
  underline_position = 0
  underline_thickness = 0
  next = 0x00007fff5fbfb5d0
  prev = 0x0000000000000000
}

-- 
Alan Third