bug#11541: 24.0.97; Crash when visiting file on OS X 10.7.3

[Chong Yidong <cyd@gnu.org>]

"C. Florian Ebeling" <florian.ebeling@gmail.com> writes:

> (gdb) p scratch_font_spec
> $1 = 4338015181
> (gdb) xtype
> Lisp_Vectorlike
> PVEC_FONT
> (gdb) pp scratch_font_spec
> #<font-spec ns apple nil nil iso10646-1 nil nil nil nil nil nil nil
> ((:script . symbol))>

Interesting.  We need to pin down where the stack clobbering is taking
place; I don't see an obvious problem in the code, so let's just do it
by brute force.  Could you apply the following patch (which adds three
abort conditions to the code), trigger the bug again, then see where the
abort takes place?



=== modified file 'src/nsfont.m'
*** src/nsfont.m	2012-01-19 07:21:25 +0000
--- src/nsfont.m	2012-05-30 13:32:44 +0000
***************
*** 511,519 ****
--- 511,529 ----
  	debug_print (font_spec);
        }
  
+     if (!FONT_SPEC_P (font_spec))
+       abort ();
+ 
      cFamilies = ns_get_covering_families (ns_get_req_script (font_spec), 0.90);
  
+     if (!FONT_SPEC_P (font_spec))
+       abort ();
+ 
      fdesc = ns_spec_to_descriptor (font_spec);
+ 
+     if (!FONT_SPEC_P (font_spec))
+       abort ();
+ 
      fkeys = [NSMutableSet setWithArray: [[fdesc fontAttributes] allKeys]];
      if (isMatch)
  	[fkeys removeObject: NSFontFamilyAttribute];