bug#71176: 30.0.50; Segmentation fault (SIGSEGV) in TTY+emacsclient, default_face is nil

[Eli Zaretskii <eliz@gnu.org>]

> From: Daniel Clemente <n142857@gmail.com>
> Date: Sat, 25 May 2024 11:04:18 +0000
> Cc: Eli Zaretskii <eliz@gnu.org>
> 
> I found out how to reproduce this and a possible cause, see "garbage-collection-messages" below.
> 
> > > 6819      return default_face->id;
> > 
> > Do you use face-remapping?  Is face-remapping-alist non-nil when this
> > happens?  If so, can you show the value of Vface_remapping_alist?
> 
> I don't use it, and it's nil when the SIGSEGV happens.
> (gdb) p Vface_remapping_alist 
> $1 = XIL(0)
> 
> >> warning: Source file is more recent than executable.
> >        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > This is not a good sign: you have edited your sources after the Emacs
> > binary was produced, so some of the information in the backtrace and
> > the GDB session might be inaccurate or even incorrect.
> 
> My source branch was at yesterday's HEAD, sorry. There were only small recent changes in xfaces.c/xdisp.c.
> I now switched my branch to the commit I used to build Emacs (b82a003544c607b5c54bab13870d52), from 2
> weeks ago.
> I also recompiled using -O2 instead of -O3, thanks.
> 
> With that, and by opening+closing many frames in succession (details at bug#71177), I made it crash.
> Backtrace attached below.
> 
> I was able to consistently reproduce the crash by running this command (30 seconds is always enough to
> reproduce it, but it also happens after less than 10 secons, so you may change the 30 to a lower number):
> 
> for j in `seq 30`; do for i in `seq 10`; do urxvt -e emacsclient '-nw' '-e' '(dired "~")' &; done; sleep 1 && killall
> emacsclient; done
> 
> I couldn't reproduce it under emacs -Q
> The minimal .emacs needed to reproduce it has these 2 lines:
> 
> (setq garbage-collection-messages t)
> (set-face-foreground 'default "#bbb")

Thanks.  Please try the stab-in-the-dark patch below.

diff --git a/src/xfaces.c b/src/xfaces.c
index 5192b22..8c07e5e 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -1041,13 +1041,17 @@ tty_lookup_color (struct frame *f, Lisp_Object color, Emacs_Color *tty_color,
 		  Emacs_Color *std_color)
 {
   Lisp_Object frame, color_desc;
+  specpdl_ref count;
 
   if (!STRINGP (color) || NILP (Ffboundp (Qtty_color_desc)))
     return false;
 
   XSETFRAME (frame, f);
 
+  count = SPECPDL_INDEX ();
+  specbind (Qinhibit_free_realized_faces, Qt);
   color_desc = call2 (Qtty_color_desc, color, frame);
+  unbind_to (count, Qnil);
   if (CONSP (color_desc) && CONSP (XCDR (color_desc)))
     {
       Lisp_Object rgb;
@@ -1076,7 +1080,10 @@ tty_lookup_color (struct frame *f, Lisp_Object color, Emacs_Color *tty_color,
 	      && !NILP (Ffboundp (Qtty_color_standard_values)))
 	    {
 	      /* Look up STD_COLOR separately.  */
+	      count = SPECPDL_INDEX ();
+	      specbind (Qinhibit_free_realized_faces, Qt);
 	      rgb = call1 (Qtty_color_standard_values, color);
+	      unbind_to (count, Qnil);
 	      if (! parse_rgb_list (rgb, std_color))
 		return false;
 	    }