bug#17771: 24.3.91; SIGSEGV in cleanup_vector

[Eli Zaretskii <eliz@gnu.org>]

> From: Stephen Berman <stephen.berman@gmx.net>
> Cc: 17771@debbugs.gnu.org
> Date: Fri, 13 Jun 2014 15:53:35 +0200
> 
> On Fri, 13 Jun 2014 16:44:39 +0300 Eli Zaretskii <eliz@gnu.org> wrote:
> 
> >> From: Stephen Berman <stephen.berman@gmx.net>
> >> Cc: 17771@debbugs.gnu.org
> >> Date: Fri, 13 Jun 2014 15:34:12 +0200
> >> 
> >> On Fri, 13 Jun 2014 16:28:54 +0300 Eli Zaretskii <eliz@gnu.org> wrote:
> >> 
> >> >> From: Stephen Berman <stephen.berman@gmx.net>
> >> >> Cc: 17771@debbugs.gnu.org
> >> >> Date: Fri, 13 Jun 2014 14:39:42 +0200
> >> >> 
> >> >> Program received signal SIGSEGV, Segmentation fault.
> >> >> 0x00000000005aa564 in cleanup_vector (vector=0x413c318)
> >> >>     at ../../../../bzr/emacs/emacs-24/src/alloc.c:2929
> >> >> 2929          ((struct font *) vector)->driver->close ((struct font *) vector);
> >> >> (gdb) p vector
> >> >> $1 = (struct Lisp_Vector *) 0x413c318
> >> >> (gdb) p vector->driver
> >> >> There is no member named driver.
> >> >> (gdb) p vector->driver->close
> >> >> There is no member named driver.
> >> >
> >> >  (gdb) p ((struct font *) vector)->driver
> >> >  (gdb) p ((struct font *) vector)->driver->close
> >> 
> >> (gdb) p ((struct font *) vector)->driver
> >> $4 = (struct font_driver *) 0x0
> >> (gdb) p ((struct font *) vector)->driver->close
> >> Cannot access memory at address 0x40
> >
> > IOW, the font driver is NULL.
> 
> Could that be due to my typing `C-g'?

It evidently is.  My current theory is that the font driver was not
fully set up, before Emacs got interrupted by C-g.

> If I don't do that, the file does get displayed.  But `C-g'
> shouldn't make Emacs crash.  Do you see what the problem is, or can
> I provide further information?

The immediate problem is clearly that we dereference a NULL pointer.

I installed a trivial workaround for that in r117235 on the emacs-24
branch.  The diffs are below.  Can you try this and see if the problem
is solved?  It's possible that the real problem is somewhere else, in
which case you will probably see it when you apply the patch.

Thanks.

=== modified file 'src/alloc.c'
--- src/alloc.c	2014-05-30 20:19:29 +0000
+++ src/alloc.c	2014-06-13 13:53:24 +0000
@@ -2924,9 +2924,16 @@ cleanup_vector (struct Lisp_Vector *vect
       && ((vector->header.size & PSEUDOVECTOR_SIZE_MASK)
 	  == FONT_OBJECT_MAX))
     {
-      /* Attempt to catch subtle bugs like Bug#16140.  */
-      eassert (valid_font_driver (((struct font *) vector)->driver));
-      ((struct font *) vector)->driver->close ((struct font *) vector);
+      struct font_driver *drv = ((struct font *) vector)->driver;
+
+      /* The font driver might sometimes be NULL, e.g. if Emacs was
+	 interrupted before it had time to set it up.  */
+      if (drv)
+	{
+	  /* Attempt to catch subtle bugs like Bug#16140.  */
+	  eassert (valid_font_driver (drv));
+	  drv->close ((struct font *) vector);
+	}
     }
 }