bug#50571: 28.0.50; Redisplay segfaults with empty face cache

[Eli Zaretskii <eliz@gnu.org>]

> Date: Tue, 14 Sep 2021 16:03:02 +0300
> From: Eli Zaretskii <eliz@gnu.org>
> Cc: 50571@debbugs.gnu.org
> 
> Thanks, I see the reason now.  It's because we allow to have arbitrary
> Lisp to be registered in jit-lock-functions, and then that arbitrary
> Lisp is called in the middle of redisplay, and in this case creates a
> whole new frame with faces.  As luck would have it, we decide right
> there and then perform routine maintenance and release all the faces
> on all the frames...
> 
> I'm thinking about the best solution for this.

Does the patch below give good results?

diff --git a/src/frame.h b/src/frame.h
index a8ad011..3dd7680 100644
--- a/src/frame.h
+++ b/src/frame.h
@@ -449,8 +449,8 @@ #define EMACS_FRAME_H
   /* Non-zero if this frame's faces need to be recomputed.  */
   bool_bf face_change : 1;
 
-  /* Non-zero if this frame's image cache cannot be freed because the
-     frame is in the process of being redisplayed.  */
+  /* Non-zero if this frame's image cache and face cache cannot be
+     freed because the frame is in the process of being redisplayed.  */
   bool_bf inhibit_clear_image_cache : 1;
 
   /* True when new_width or new_height were set by change_frame_size,
diff --git a/src/xdisp.c b/src/xdisp.c
index d30a685..2e72f6b 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -16061,12 +16061,13 @@ #define AINC(a,i)							\
 	      if (FRAME_VISIBLE_P (f) && !FRAME_OBSCURED_P (f))
 		{
 
-		  /* Don't allow freeing images for this frame as long
-		     as the frame's update wasn't completed.  This
-		     prevents crashes when some Lisp that runs from
-		     the various hooks or font-lock decides to clear
-		     the frame's image cache, when the images in that
-		     cache are referenced by the desired matrix.  */
+		  /* Don't allow freeing images and faces for this
+		     frame as long as the frame's update wasn't
+		     completed.  This prevents crashes when some Lisp
+		     that runs from the various hooks or font-lock
+		     decides to clear the frame's image cache and face
+		     cache, when the images and faces in those caches
+		     are referenced by the desired matrix.  */
 		  f->inhibit_clear_image_cache = true;
 		  redisplay_windows (FRAME_ROOT_WINDOW (f));
 		}
diff --git a/src/xfaces.c b/src/xfaces.c
index 2273fb4..aefed54 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -674,7 +674,8 @@ clear_face_cache (bool clear_fonts_p)
 	{
 	  struct frame *f = XFRAME (frame);
 	  if (FRAME_WINDOW_P (f)
-	      && FRAME_DISPLAY_INFO (f)->n_fonts > CLEAR_FONT_TABLE_NFONTS)
+	      && FRAME_DISPLAY_INFO (f)->n_fonts > CLEAR_FONT_TABLE_NFONTS
+	      && !f->inhibit_clear_image_cache)
 	    {
 	      clear_font_cache (f);
 	      free_all_realized_faces (frame);