bug#20802: Segfault when showing non-GTK+ tooltip

[martin rudalics <rudalics@gmx.at>]

 > Breakpoint 1, x_free_frame_resources (f=0x124fd70) at xterm.c:10970
 > 10970	{
 > (gdb) bt
 > #0  x_free_frame_resources (f=0x124fd70) at xterm.c:10970
 > #1  0x00000000004c9715 in unwind_create_frame (frame=19201397) at xfns.c:2842
 > #2  0x00000000004c9759 in unwind_create_tip_frame (frame=<optimized out>) at xfns.c:4997
 > #3  0x0000000000557b2e in unbind_to (count=<optimized out>, value=value@entry=0) at eval.c:3211
 > #4  0x0000000000557cf9 in unwind_to_catch (catch=catch@entry=0x140a040, value=value@entry=19849283)
 >      at eval.c:1157
 > #5  0x00000000005592ed in Fsignal (error_symbol=error_symbol@entry=18624, data=<optimized out>)
 >      at eval.c:1557
 > #6  0x00000000005595f9 in xsignal (error_symbol=error_symbol@entry=18624, data=<optimized out>)
 >      at eval.c:1581
 > #7  0x0000000000559c6d in signal_error (s=s@entry=0x5e3d1d "Undefined color", arg=19849315,
 >      arg@entry=34016084) at eval.c:1636
 > #8  0x00000000004ccc57 in x_decode_color (f=<optimized out>, color_name=34016084,
 >      mono_color=<optimized out>) at xfns.c:495
 > #9  0x00000000004ce96c in x_set_foreground_color (f=0x124fd70, arg=34016084, oldval=<optimized out>)
 >      at xfns.c:602
 > #10 0x0000000000426ff6 in x_set_frame_parameters (f=f@entry=0x124fd70, alist=alist@entry=140737488338931)
 >      at frame.c:3152
 > #11 0x0000000000429ac7 in x_default_parameter (f=f@entry=0x124fd70, alist=alist@entry=19856675,
 >      prop=prop@entry=22320, deflt=34090788, xprop=xprop@entry=0x5db8ca "foreground",
 >      xclass=xclass@entry=0x5e3f61 "Foreground", type=RES_TYPE_STRING) at frame.c:4374
 > #12 0x00000000004cd200 in x_create_tip_frame (dpyinfo=0x173c900, parms=19856675, parms@entry=19857043,
 >      text=text@entry=34092084) at xfns.c:5181
 > #13 0x00000000004cd94d in Fx_show_tip (string=34092084, frame=18429029, parms=19857043, timeout=42, dx=22,
 >      dy=82) at xfns.c:5540

Why am I not surprised?  xfns.c sets image_cache_refcount on line 5192,
that is, after it processes the foreground parameter on line 5181 so
probably line 5192 is not executed.  I initially tried to set it right
after the record_unwind_protect on line 5061 but that got me a(nother?)
segfault as well.  Funnily I coudn't get a crash after my patch.

Can you try whether my conjecture is true by putting a breakpoint on
line 5192 and check whether the refcount gets set there for the tooltip
frame?  If it isn't, then could you experimentally try to move the

   image_cache_refcount =
     FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
#ifdef GLYPH_DEBUG
   dpyinfo_refcount = dpyinfo->reference_count;
#endif /* GLYPH_DEBUG */

block from line 5192 somewhere up in the code, first before line 5172,
later maybe a bit further up and check whether it helps?

Thanks, martin