bug#43700: 28.0.50; Crash creating a second frame

[Andy Moreton <andrewjmoreton@gmail.com>]

On 02/10/2020 12:49, Eli Zaretskii wrote:
>> Cc: 43700@debbugs.gnu.org
>> From: Andy Moreton <andrewjmoreton@gmail.com>
>> Date: Fri, 2 Oct 2020 01:38:25 +0100
>>
>> On 01/10/2020 13:53, Eli Zaretskii wrote:
>>> If you put a breakpoint in lookup_image, on the line indicated below:
>>>
>>>     ptrdiff_t
>>>     lookup_image (struct frame *f, Lisp_Object spec, int face_id)
>>>     {
>>>       struct image *img;
>>>       EMACS_UINT hash;
>>>
>>>       struct face *face = (face_id >= 0) ? FACE_FROM_ID (f, face_id)
>>>         : FACE_FROM_ID (f, DEFAULT_FACE_ID);
>>>       unsigned long foreground = FACE_COLOR_TO_PIXEL (face->foreground, f); <<<<
>>>       unsigned long background = FACE_COLOR_TO_PIXEL (face->background, f);
>>>
>>> and condition the breakpoint by face == 0, does it break before the
>>> crash when you perform the steps that reproduces the problem?
>>
>> Yes it does.
> 
> So the next question is: how come the default face is not available?
> When that breakpoint breaks, what is the value of
> 
>     FRAME_FACE_CACHE (f)->used
> 
> Is it zero, per chance?  If so, I'd be interested to understand which
> code resets the frame's face cache in this recipe.

Yes: let me know what else you would like to look at.

(gdb) break src/image.c:2334 if face == 0
Breakpoint 2 at 0x4002c8931: file C:/emacs/git/emacs/master/src/image.c, 
line 2334.
(gdb) run --no-desktop
Starting program: 
C:\emacs\git\emacs\master\build\mingw64-x86_64-O0\src\emacs.exe --no-desktop

Thread 1 hit Breakpoint 2, lookup_image (f=0x5862600, 
spec=XIL(0xa74e1a3), face_id=-1) at 
C:/emacs/git/emacs/master/src/image.c:2334
2334      unsigned long foreground = FACE_COLOR_TO_PIXEL 
(face->foreground, f);
(gdb) p face
$1 = (struct face *) 0x0
(gdb) p FRAME_FACE_CACHE (f)->used
$2 = 0
(gdb) p *FRAME_FACE_CACHE (f)
$3 = {
   buckets = 0x4f750a0,
   f = 0x5862600,
   faces_by_id = 0x58632e0,
   size = 50,
   used = 0,
   menu_face_changed_p = 0
}