bug#3714: 23.1.50; [NS/Cocoa] Crash when hovering mode-line-inactive face

[Ian Eure <ian@digg.com>]

Emacs crashes when the mouse hovers the `mode-line-inactive' face in  
list-faces-display.

Steps to reproduce:
  1. Run /Application/Emacs.app/Contents/MacOS/Emacs -Q
  2. M-x list-faces-display RET
  3. Scroll down until mode-line-inactive is visible.
  4. Hover the sample text on the right with the mouse pointer.
  5. Emacs crashes.

The problem seems to be that the ns_lookup_indexed_color call in  
nsterm.m:2725 returns a bad pointer.

Backtrace:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0xc0000003
0x94f8f684 in objc_msgSend ()
(gdb) bt full
#0  0x94f8f684 in objc_msgSend ()
No symbol table info available.
#1  0x001ef5b5 in ns_draw_box (r={origin = {x = 264, y = 336}, size =  
{width = 308, height = 15}}, thickness=0, col=0xc0000003, left_p=1  
'\001', right_p=1 '\001') at nsterm.m:2571
	s = {
   origin = {
     x = 264,
     y = 336
   },
   size = {
     width = 308,
     height = 15
   }
}
#2  0x001efe13 in ns_dumpglyphs_box_or_relief (s=0xbfffd950) at  
nsterm.m:2724
	right_x = 571
	last_x = 572
	left_p = 1 '\001'
	right_p = 1 '\001'
	last_glyph = (struct glyph *) 0x21a47e0
	r = {
   origin = {
     x = 264,
     y = 336
   },
   size = {
     width = 308,
     height = 15
   }
}
	thickness = 0
	face = (struct face *) 0x1684b80
#3  0x001f135e in ns_draw_glyph_string (s=0xbfffd950) at nsterm.m:3027
	r = {{
     origin = {
       x = 12,
       y = 336
     },
     size = {
       width = 560,
       height = 15
     }
   }, {
     origin = {
       x = 1.2879323e-38,
       y = 0
     },
     size = {
       width = -1.99880123,
       height = 0
     }
   }}
	n = 1
	box_drawn_p = 0 '\0'
#4  0x0004e06c in draw_glyphs (w=0x162c1d0, x=573, row=0x212afc8,  
area=TEXT_AREA, start=36, end=80, hl=DRAW_MOUSE_FACE, overlaps=0) at  
xdisp.c:20451
	head = (struct glyph_string *) 0xbfffd950
	tail = (struct glyph_string *) 0xbfffd950
	s = (struct glyph_string *) 0xbfffd950
	clip_head = (struct glyph_string *) 0x0
	clip_tail = (struct glyph_string *) 0x0
	i = 80
	j = 204
	x_reached = 573
	last_x = 572
	area_left = 12
	f = (struct frame *) 0x8c3e50
#5  0x00054ea7 in show_mouse_face (dpyinfo=0x837450,  
draw=DRAW_MOUSE_FACE) at xdisp.c:22746
	start_hpos = 36
	end_hpos = 80
	start_x = 252
	phys_cursor_on_p = 1
	row = (struct glyph_row *) 0x212afc8
	first = (struct glyph_row *) 0x212afc8
	last = (struct glyph_row *) 0x212afc8
	w = (struct window *) 0x162c1d0
	f = (struct frame *) 0x8c3e50
#6  0x0005581a in mouse_face_from_buffer_pos (window=23249364,  
dpyinfo=0x837450, mouse_charpos=4047, start_charpos=4025,  
end_charpos=4078, before_string=25165833, after_string=25165833,  
display_string=25165833) at xdisp.c:23011
	w = (struct window *) 0x162c1d0
	first = (struct glyph_row *) 0x212ae00
	row = (struct glyph_row *) 0x212afc8
	glyph = (struct glyph *) 0x21a4800
	end = (struct glyph *) 0x21a4800
	ignore = 4048
	x = 561
#7  0x00057ca9 in note_mouse_highlight (f=0x8c3e50, x=419, y=63) at  
xdisp.c:23855
	before = 32200
	after = 32624
	before_string = 25165833
	after_string = 25165833
	buffer = 23528644
	display_string = 25165833
	hpos = 58
	i = -1
	dx = 2
	overlay_vec = (Lisp_Object *) 0xbfffddb0
	noverlays = 0
	obuf = (struct buffer *) 0x601678
	obegv = 1
	same_region = 0
	dy = 14
	area = 1
	position = 32376
	vpos = 3
	ozv = 5429
	pos = 4047
	glyph = (struct glyph *) 0x21a4540
	object = 23528644
	mouse_face = 25649105
	overlay = 25165833
	dpyinfo = (Display_Info *) 0x837450
	part = ON_TEXT
	window = 23249364
	w = (struct window *) 0x162c1d0
	cursor = (Cursor) 0x0
	pointer = 25165833
	b = (struct buffer *) 0x16704c0
#8  0x001eca9d in note_mouse_movement (frame=0x8c3e50, x=421, y=350)  
at nsterm.m:1765
No locals.
#9  0x001f76a4 in -[EmacsView mouseMoved:] (self=0x1605b00,  
_cmd=0x94faf684, e=0x16ce160) at nsterm.m:4942
	dpyinfo = (struct ns_display_info *) 0x837450
	frame = -1830347271
#10 0x92e71d6d in -[NSWindow sendEvent:] ()
No symbol table info available.
#11 0x92e3e3c5 in -[NSApplication sendEvent:] ()
No symbol table info available.
#12 0x001f4771 in -[EmacsApp sendEvent:] (self=0x81f980,  
_cmd=0x94f954b8, theEvent=0x16ce160) at nsterm.m:4098
	type = 5
	window = (NSWindow *) 0x161a7b0
	objc_super = {
   self = 0x81f980,
   cls = 0xa0449ea0
}
#13 0x92d9b62f in -[NSApplication run] ()
No symbol table info available.
#14 0x001f1b60 in ns_read_socket (terminal=0x837a50, expected=1,  
hold_quit=0xbfffe56c) at nsterm.m:3229
	ev = {
   kind = NO_EVENT,
   code = 0,
   part = scroll_bar_above_handle,
   modifiers = 0,
   x = 0,
   y = 0,
   timestamp = 0,
   padding = {0x0, 0x0},
   frame_or_window = 0,
   arg = 0
}
	nevents = -1790782963
#15 0x000d3a30 in read_avail_input (expected=1) at keyboard.c:7093
	nr = 50343304
	hold_quit = {
   kind = NO_EVENT,
   code = 0,
   part = scroll_bar_above_handle,
   modifiers = 0,
   x = 0,
   y = 0,
   timestamp = 0,
   padding = {0x0, 0x0},
   frame_or_window = 0,
   arg = 0
}
	next = (struct terminal *) 0x0
	nread = 0
	err = 0
	t = (struct terminal *) 0x837a50
#16 0x000d387a in gobble_input (expected=1) at keyboard.c:7004
	mask = 0
#17 0x001f1e25 in ns_select (nfds=1, readfds=0xbfffe878, writefds=0x0,  
exceptfds=0x0, timeout=0xbfffe7f0) at nsterm.m:3302
	result = 0
	time = 29.999998999999999
	ev = (NSEvent *) 0xbfffe658
#18 0x001c57bc in wait_reading_process_output (time_limit=30,  
microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=25165833,  
wait_proc=0x0, just_wait_proc=0) at process.c:4828
	timeout_reduced_for_timers = 0
	channel = 3
	nfds = 204
	Available = {
   fds_bits = {0 <repeats 32 times>}
}
	Connecting = {
   fds_bits = {0 <repeats 32 times>}
}
	check_connect = 0
	check_delay = 0
	no_avail = 0
	xerrno = 0
	proc = 0
	timeout = {
   tv_sec = 29,
   tv_usec = 999999
}
	end_time = {
   tv_sec = 1246297824,
   tv_usec = 508699
}
	wait_channel = -1
	got_some_input = 0
	count = 2
#19 0x0000f606 in sit_for (timeout=240, reading=1, do_display=1) at  
dispnew.c:6644
	sec = 30
	usec = 0
#20 0x000cc34d in read_char (commandflag=1, nmaps=2, maps=0xbfffebd0,  
prev_event=25165833, used_mouse_menu=0xbfffed78, end_time=0x0) at  
keyboard.c:2950
	tem0 = 25165833
	timeout = 30
	delay_level = 4
	buffer_size = 1
	c = 25165833
	count = -1073747112
	jmpcount = 2
	local_getcjmp = {895, 114, 8099, 832972, 976980, -1073746448, 2,  
8133797, -1073747064, -1073747504, 31, 658, 834847, 23, 31, 31,  
1310720, 1900599}
	save_jump = {0 <repeats 18 times>}
	key_already_recorded = 0
	tem = 25165833
	save = 25165833
	previous_echo_area_message = 25165833
	also_record = 25165833
	reread = 0
	gcpro1 = {
   next = 0xbfffea68,
   var = 0x1da126,
   nvars = 8047189
}
	gcpro2 = {
   next = 0x18490fc,
   var = 0x1da134,
   nvars = 1398200
}
	polling_stopped_here = 0
	orig_kboard = (struct kboard *) 0x837b20
#21 0x000d7e4a in read_key_sequence (keybuf=0xbfffefa4, bufsize=30,  
prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1,  
fix_current_buffer=1) at keyboard.c:9460
	interrupted_kboard = (KBOARD *) 0x837b20
	interrupted_frame = (struct frame *) 0x8c3e50
	key = 372375
	used_mouse_menu = 0
	echo_local_start = 0
	last_real_key_start = 0
	keys_local_start = 0
	local_first_binding = 0
	from_string = 25165833
	count = 2
	t = 0
	echo_start = 0
	keys_start = 0
	nmaps = 2
	nmaps_allocated = 2
	defs = (Lisp_Object * volatile) 0xbfffebb0
	submaps = (Lisp_Object * volatile) 0xbfffebd0
	orig_local_map = 8111925
	orig_keymap = 25165833
	localized_local_map = 0
	first_binding = 0
	first_unbound = 31
	mock_input = 0
	fkey = {
   parent = 7488085,
   map = 7488085,
   start = 0,
   end = 0
}
	keytran = {
   parent = 4796285,
   map = 4796285,
   start = 0,
   end = 0
}
	indec = {
   parent = 7488141,
   map = 7488141,
   start = 0,
   end = 0
}
	shift_translated = 0
	delayed_switch_frame = 25165833
	original_uppercase = -1073746408
	original_uppercase_position = -1
	dummyflag = 0
	starting_buffer = (struct buffer *) 0x601678
	fake_prefixed_keys = 25165833
	gcpro1 = {
   next = 0x1a90661,
   var = 0x1800009,
   nvars = 6299772
}
#22 0x000c87a0 in command_loop_1 () at keyboard.c:1642
	cmd = 27854433
	lose = 6484
	nonundocount = 0
	keybuf = {25196513, 8109221, -1834555244, 4127024, -1754265160,  
-1880941672, -1880949728, -1073745796, 152, 0, -1797177049, 163,  
1179650, 253952, -1880941408, 230, 149, 41910564, -1797141688, 164, 9,  
0, -1073745904, -1073746208, 0, 524288, 25165833, 25598081, 2605860,  
4860453}
	i = 2
	prev_modiff = 10
	prev_buffer = (struct buffer *) 0x601678
	already_adjusted = 0
#23 0x00166b4c in internal_condition_case (bfun=0xc82f2  
<command_loop_1>, handlers=25205425, hfun=0xc79fb <cmd_error>) at  
eval.c:1512
	val = 4860453
	c = {
   tag = 25165833,
   val = 25165833,
   next = 0xbffff16c,
   gcpro = 0x0,
   jmp = {-1073806465, 76, 8098, 1468971, 33629184, 1467413, 0, 0,  
-1073745624, -1073745808, 31, 658, 1469137, -1797193705, 31, 31, 0, 55},
   backlist = 0x0,
   handlerlist = 0x0,
   lisp_eval_depth = 0,
   pdlcount = 2,
   poll_suppress_count = 0,
   interrupt_input_blocked = 0,
   byte_stack = 0x0
}
	h = {
   handler = 25205425,
   var = 25165833,
   chosen_clause = -1881116971,
   tag = 0xbffff0a8,
   next = 0x0
}
#24 0x000c7f22 in command_loop_2 () at keyboard.c:1359
	val = -1073741821
#25 0x001664dd in internal_catch (tag=25201545, func=0xc7eed  
<command_loop_2>, arg=25165833) at eval.c:1248
	c = {
   tag = 25201545,
   val = 25165833,
   next = 0x0,
   gcpro = 0x0,
   jmp = {895, 0, 8098, 1467413, -1797177195, 0, 0, 0, -1073745432,  
-1073745584, 25296927, 662, 1467598, 2228247, 25165855, -1073807329,  
25296896, 25296951},
   backlist = 0x0,
   handlerlist = 0x0,
   lisp_eval_depth = 0,
   pdlcount = 2,
   poll_suppress_count = 0,
   interrupt_input_blocked = 0,
   byte_stack = 0x0
}
#26 0x000c7eab in command_loop () at keyboard.c:1338
No locals.
#27 0x000c747f in recursive_edit_1 () at keyboard.c:953
	count = 1
	val = 1484089
#28 0x000c7688 in Frecursive_edit () at keyboard.c:1015
	count = 0
	buffer = 25165833
#29 0x000c598d in main (argc=2, argv=0xbffff47c) at emacs.c:1853
	dummy = 0
	stack_bottom_variable = 0 '\0'
	do_initial_setlocale = 1
	skip_args = 0
	rlim = {
   rlim_cur = 8388608,
   rlim_max = 67104768
}
	no_loadup = 0
	junk = 0x0
	dname_arg = 0x0
	dname_arg2 = "|???\002\000\000\000X???r\030?? 
\000\020\000\000\000\000\000\000\002\000\000\000|???????\030???", '\0'  
<repeats 39 times>
(gdb)

In GNU Emacs 23.1.50.1 (i386-apple-darwin9.7.0, NS apple-appkit-949.46)
  of 2009-06-29 on neutron.local
Windowing system distributor `Apple', version 10.3.949
configured using `configure  '--with-ns''

Important settings:
   value of $LC_ALL: nil
   value of $LC_COLLATE: nil
   value of $LC_CTYPE: nil
   value of $LC_MESSAGES: nil
   value of $LC_MONETARY: nil
   value of $LC_NUMERIC: nil
   value of $LC_TIME: nil
   value of $LANG: nil
   value of $XMODIFIERS: nil
   locale-coding-system: nil
   default-enable-multibyte-characters: t

Major mode: ERC

Minor modes in effect:
   diff-auto-refine-mode: t
   erc-track-mode: t
   erc-track-minor-mode: t
   erc-spelling-mode: t
   flyspell-mode: t
   erc-ring-mode: t
   erc-pcomplete-mode: t
   erc-netsplit-mode: t
   erc-match-mode: t
   erc-button-mode: t
   erc-fill-mode: t
   erc-autojoin-mode: t
   erc-irccontrols-mode: t
   erc-noncommands-mode: t
   erc-readonly-mode: t
   erc-scrolltobottom-mode: t
   test-case-global-mode: t
   which-function-mode: t
   shell-dirtrack-mode: t
   ime-bindings: t
   show-paren-mode: t
   recentf-mode: t
   iswitchb-mode: t
   cua-mode: t
   auto-insert-mode: t
   tooltip-mode: t
   mouse-wheel-mode: t
   menu-bar-mode: t
   file-name-shadow-mode: t
   global-font-lock-mode: t
   font-lock-mode: t
   blink-cursor-mode: t
   global-auto-composition-mode: t
   auto-composition-mode: t
   auto-encryption-mode: t
   auto-compression-mode: t
   size-indication-mode: t
   column-number-mode: t
   line-number-mode: t
   transient-mark-mode: t
   abbrev-mode: t

Recent input:
M-x r e p <tab> o r <tab> <tab> b <tab>
<return>

Recent messages:
Mark set [2 times]
Quit [2 times]
call-interactively: Command attempted to use minibuffer while in  
minibuffer
Quit [2 times]
Undo!
Making completion list...
Quit [2 times]
Undo!
Mark set
Making completion list... [2 times]