bug#17753: Cygwin emacs-X11 core dump

[Eli Zaretskii <eliz@gnu.org>]

> Date: Thu, 09 Oct 2014 13:47:34 +0200
> From: Markus Hoenicka <markus.hoenicka@mhoenicka.de>
> Cc: kbrown@cornell.edu, 17753@debbugs.gnu.org
> 
> Am 2014-10-09 13:22, schrieb Eli Zaretskii:
> >> Date: Thu, 09 Oct 2014 12:44:44 +0200
> >> From: Markus Hoenicka <markus.hoenicka@mhoenicka.de>
> >> Cc: kbrown@cornell.edu, 17753@debbugs.gnu.org
> >> 
> >> (gdb) print (it->f)->face_cache->used
> >> $4 = 31
> > 
> > ??? That's unexpected.  What about this one:
> > 
> >   (gdb) print (it->f)->face_cache->faces_by_id[it->face_id]
> > 
> > (The above is the expansion of the call to the FACE_FROM_ID macro,
> > which, judging by your backtrace, yielded a NULL pointer.)
> 
> This one yields:
> 
> (gdb) print (it->f)->face_cache->faces_by_id[it->face_id]
> $5 = (struct face *) 0x60128bad0

So maybe this crash _is_ for the same reason that caused the other
crashes in this bug report.  Observe what the relevant portion of
get_next_display_element (the function in frame #1 of your backtrace)
does:

  if ((it->what == IT_CHARACTER || it->what == IT_COMPOSITION)
      && it->multibyte_p
      && success_p
      && FRAME_WINDOW_P (it->f))
    {
      struct face *face = FACE_FROM_ID (it->f, it->face_id);

      if (it->what == IT_COMPOSITION && it->cmp_it.ch >= 0)
	{
	  /* Automatic composition with glyph-string.   */
	  Lisp_Object gstring = composition_gstring_from_id (it->cmp_it.id);

	  it->face_id = face_for_font (it->f, LGSTRING_FONT (gstring), face);
	}
      else
	{
	  ptrdiff_t pos = (it->s ? -1
		     : STRINGP (it->string) ? IT_STRING_CHARPOS (*it)
		     : IT_CHARPOS (*it));
	  int c;

	  if (it->what == IT_CHARACTER)
	    c = it->char_to_display;
	  else
	    {
	      struct composition *cmp = composition_table[it->cmp_it.id];
	      int i;

	      c = ' ';
	      for (i = 0; i < cmp->glyph_len; i++)
		/* TAB in a composition means display glyphs with
		   padding space on the left or right.  */
		if ((c = COMPOSITION_GLYPH (cmp, i)) != '\t')
		  break;
	    }
	  it->face_id = FACE_FOR_CHAR (it->f, face, c, pos, it->string);

The last line is the one that called face_for_char with the 'face'
argument a NULL pointer.  But the value of 'face' was computed by this
line:

      struct face *face = FACE_FROM_ID (it->f, it->face_id);

which, if you repeat it in GDB, yields a non-NULL pointer.  So how
could it become a NULL pointer when the code was executed??  Am I
missing something here?