bug#5973: Crash in get_next_display_element

[David Reitter <david.reitter@gmail.com>]

On Apr 19, 2010, at 1:23 PM, Eli Zaretskii wrote:
> 
> Let's start by finding the immediate reason for the crash.  Please
> show the contents of `face', the last argument to FACE_FOR_CHAR in the
> line that crashed.

How do I do that?
It didn't run in gdb, and I don't know how to reproduce the crash.

I just did a search on a year worth of crash logs (47 crashes) and didn't find this specific crash again.

> Also, what kind of signal was it that crashed the program?  (The
> backtrace is in some form that I'm not familiar with, so maybe the
> information is already present there.)

Yes:

Exception Type:  EXC_BAD_ACCESS (SIGABRT)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000110

> 
> Thanks, but I don't think we should fix problems until we understand
> them.  In general, it->face_id should index a face that is already
> realized at this point.

Is it possible that this code runs, somehow, after a face got deleted?  That, per se, might be the real cause of the bug - but I can only speculate.

As said, the macro is documented to return NULL in some cases, and the code in the same function (below) checks for that case (of course I don't know when such a case can happen).  So independently of this particular crash it would be good style to "if (face)" there.

Let me know if I can help in any way.