NTEmacs crashes, #2 of 2

[David Abrahams <dave@boost-consulting.com>]

>	emacs.exe!get_cached_font_char(bdffont * fontp=0x39353838, int strchr=32)  Line 343 + 0x14	C
 	emacs.exe!get_bitmap_with_cache(bdffont * fontp=0x39353838, int strchr=32)  Line 542	C
 	emacs.exe!w32_BDF_TextOut(bdffont * fontp=0x39353838, HDC__ * hdc=0x0c012230, int left=787, int top=129, unsigned char * text=0x0082f588, int dim=2, int bytelen=0, int fixed_pitch_size=0)  Line 672 + 0x9	C
 	emacs.exe!w32_text_out()  Line 2764 + 0x1b	C
 	emacs.exe!x_draw_glyph_string_foreground(glyph_string * s=0x00000313)  Line 3516	C
 	emacs.exe!x_draw_glyph_string(glyph_string * s=0x0082f58c)  Line 4404	C
 	emacs.exe!x_draw_glyphs(window * w=0x022fb400, int x=794, glyph_row * row=0x026a9488, int area=1, int start=0, int end=1, int hl=2, int overlaps_p=0)  Line 5087 + 0x6	C
 	emacs.exe!x_draw_phys_cursor_glyph(window * w=0x022fb400, glyph_row * row=0x026a9488, int hl=2)  Line 9665	C
 	emacs.exe!x_display_and_set_cursor(window * w=0x00000000, int on=7, int hpos=0, int vpos=10, int x=0, int y=3211898)  Line 9940 + 0x9	C
 	emacs.exe!x_update_window_end(window * w=0x022fb400, int cursor_on_p=1, int mouse_face_overwritten_p=0)  Line 723 + 0x20	C
 	emacs.exe!update_window(window * w=0x022fb400, int force_p=0)  Line 4196 + 0x14	C
 	emacs.exe!update_window_tree(window * w=0x022fb200, int force_p=0)  Line 3881 + 0x9	C
 	emacs.exe!update_window_tree(window * w=0x02300800, int force_p=0)  Line 3880	C
 	emacs.exe!update_frame(frame * f=0x02300800, int force_p=0, int inhibit_hairy_id_p=0)  Line 3819	C
 	emacs.exe!redisplay_internal(int preserve_echo_area=0)  Line 9107 + 0x18	C
 	emacs.exe!redisplay()  Line 8444 + 0x7	C
 	emacs.exe!read_char(int commandflag=1, int nmaps=3, int * maps=0x0082fc9c, int prev_event=287928324, int * used_mouse_menu=0x0082fce8)  Line 2475	C
 	emacs.exe!read_key_sequence(int * keybuf=0x0082fd7c, int bufsize=30, int prompt=287928324, int dont_downcase_last=0, int can_return_switch_frame=1, int fix_current_buffer=1)  Line 8584 + 0x24	C
 	emacs.exe!command_loop_1()  Line 1503 + 0x28	C
 	emacs.exe!internal_condition_case(int (void)* bfun=0x0100e224, int handlers=288038420, int (void)* hfun=0x0100deb8)  Line 1352	C
 	emacs.exe!command_loop_2()  Line 1286 + 0x15	C
 	emacs.exe!internal_catch(int tag=287994820, int (void)* func=0x0100e12c, int arg=287928324)  Line 1112 + 0x6	C
 	emacs.exe!command_loop()  Line 1270	C
 	emacs.exe!recursive_edit_1()  Line 985 + 0x5	C
 	emacs.exe!Frecursive_edit()  Line 1042	C
 	emacs.exe!main()  Line 1659 + 0x5	C
 	emacs.exe!_mainCRTStartup()  + 0xb4	
 	kernel32.dll!77e814c7() 	

------ disassembly --------

010EBCF0  jl          get_cached_font_char+3Dh (10EBD25h) 
010EBCF2  cmp         eax,10000h 
010EBCF7  jg          get_cached_font_char+3Dh (10EBD25h) 

  pch = fontp->chtbl[BDF_FIRST_OFFSET(index)];
010EBCF9  mov         ecx,eax 
010EBCFB  and         ecx,80h 
010EBD01  shl         ecx,1 
010EBD03  mov         edx,eax 
010EBD05  sar         edx,8 
010EBD08  or          ecx,edx 
010EBD0A  mov         edx,dword ptr [fontp] 
010EBD0D  mov         ecx,dword ptr [edx+ecx*4+18h] <========== PC is here
  if (!pch)
010EBD11  test        ecx,ecx 
    return NULL;
010EBD13  je          get_cached_font_char+3Dh (10EBD25h) 

  result = &pch[BDF_SECOND_OFFSET(index)];
010EBD15  and         eax,7Fh 
010EBD18  lea         ecx,[ecx+eax*8] 


-------- locals ---------

-	fontp	0x39353838 {filename=??? hfile=??? hfilemap=??? ...}	bdffont *
+	filename	CXX0030: Error: expression cannot be evaluated	char *
	hfile	CXX0030: Error: expression cannot be evaluated	void *
	hfilemap	CXX0030: Error: expression cannot be evaluated	void *
+	font	CXX0030: Error: expression cannot be evaluated	unsigned char *
+	seeked	CXX0030: Error: expression cannot be evaluated	unsigned char *
	size	CXX0030: Error: expression cannot be evaluated	unsigned long
+	chtbl	0x39353850	fchar * [512]
	llx	CXX0030: Error: expression cannot be evaluated	int
	lly	CXX0030: Error: expression cannot be evaluated	int
	urx	CXX0030: Error: expression cannot be evaluated	int
	ury	CXX0030: Error: expression cannot be evaluated	int
	yoffset	CXX0030: Error: expression cannot be evaluated	int
	relative_compose	CXX0030: Error: expression cannot be evaluated	int
	default_ascent	CXX0030: Error: expression cannot be evaluated	int
+	registry	CXX0030: Error: expression cannot be evaluated	unsigned char *
+	encoding	CXX0030: Error: expression cannot be evaluated	unsigned char *
+	slant	CXX0030: Error: expression cannot be evaluated	unsigned char *
	width	CXX0030: Error: expression cannot be evaluated	int
	height	CXX0030: Error: expression cannot be evaluated	int
	pixsz	CXX0030: Error: expression cannot be evaluated	int
	nchars	CXX0030: Error: expression cannot be evaluated	int
	strchr	32	int

-- 
Dave Abrahams
Boost Consulting
www.boost-consulting.com