> From: Nicolas Carranza <nicarran@gmail.com>
> Date: Wed, 21 Oct 2020 00:07:49 -0500
> Cc: nicarran@yandex.com
>
> I can reproduce an emacs segmentation fault following this steps on my
> system:
>
> 1. Start emacs as daemon using:
> emacs --daemon=myEmacs
>
> 2. Start emacsclient using:
> emacsclient -s myEmacs -n -c test.org
>
> 3. emacs crashes:

Thanks.

Can you try the patch below?  I've just installed it on the emacs-27
branch.

diff --git a/src/xdisp.c b/src/xdisp.c
index 6c401d0..03dc4be 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -22793,6 +22793,10 @@ maybe_produce_line_number (struct it *it)
   int lnum_face_id = merge_faces (it->w, Qline_number, 0, DEFAULT_FACE_ID);
   int current_lnum_face_id
     = merge_faces (it->w, Qline_number_current_line, 0, DEFAULT_FACE_ID);
+  /* From here onwards, we must prevent freeing realized faces, because
+     we are using the above 2 face IDs for the glyphs we produce.  */
+  bool save_free_realized_faces = inhibit_free_realized_faces;
+  inhibit_free_realized_faces = true;
   /* Compute point's line number if needed.  */
   if ((EQ (Vdisplay_line_numbers, Qrelative)
        || EQ (Vdisplay_line_numbers, Qvisual)
@@ -22922,10 +22926,13 @@ maybe_produce_line_number (struct it *it)
          it->lnum_width = 0;
          it->lnum_pixel_width = 0;
          bidi_unshelve_cache (itdata, false);
+         inhibit_free_realized_faces = save_free_realized_faces;
          return;
        }
     }

+  inhibit_free_realized_faces = save_free_realized_faces;
+
   /* Record the width in pixels we need for the line number display.  */
   it->lnum_pixel_width = tem_it.current_x;
   /* Copy the produced glyphs into IT's glyph_row.  */