bug#17889: 24.3; Crash setting the font on a separate frame with no minibuffer

bug#17889: 24.3; Crash setting the font on a separate frame with no minibuffer

[Mat Smiglarski]

Emacs crashes when setting the font on a frame with no minibuffer
after initialising color-mode. This does not occur when running in a 
terminal.

The crash only occurs with certain fonts (eg. Monaco, or DejaVu Sans
Mono, but not Courier) and can be reproduced with a small amount of code 
from color-mode and no dependent packages, as demonstrated below.

To Reproduce:

1: Create the following 50 line file for initialisation. (This is mostly
from color-mode, and you may like to comment out the last two lines 
which are not, in order to avoid the immediate crash.)

(defun color-theme-install-faces (faces)
   ;; clear all previous faces
   ;; install new faces
   (let ((frame nil))
     (dolist (entry faces)
       (let ((face (nth 0 entry))
	    (spec (nth 1 entry)))
	(or (facep face)
	    (make-empty-face face))
	;; remove weird properties from the default face only
	(if (and (functionp 'face-spec-reset-face)
		 (equal spec '((t (nil)))))
	    (face-spec-reset-face face frame)
	  (condition-case var
	      (progn
		(face-spec-set face spec frame)
                 (put face 'face-defface-spec spec))
	    (error (message "Error using spec %S: %S" spec var))))))))

(defun color-theme-canonic (theme)
   "Return the canonic form of THEME.
This deals with all the backwards compatibility stuff."
   (let (function frame-params variables faces)
     (when (functionp (car theme))
       (setq function (car theme)
	    theme (cdr theme)))
     (setq frame-params (car theme)
	  theme (cdr theme))
     ;; optional variable defintions (for backwards compatibility)
     (when (listp (caar theme))
       (setq variables (car theme)
	    theme (cdr theme)))
     ;; face definitions
     (setq faces theme)
     (list function frame-params variables faces)))

(defun color-theme-faces (theme)
   "Return faces defined by THEME."
   (nth 3 theme))

(color-theme-install-faces
  (color-theme-faces (color-theme-canonic
                      '(color-theme-crash-crash-crash
                        (italic ((t (:italic t))))
                        (underline ((t (:underline t))))
                        ))))

(with-selected-frame (make-frame '((minibuffer . nil)))
   (set-frame-font (font-spec :family "Monaco"))) ;; "DejaVu San Mono" 
also causes the crash

2. Start emacs

$ emacs -Q -l ~/crash.el

Emacs now crashes.

Only the last two lines of the script are not taken from color-mode and
they can be run at any time. The issue only occurs when running in a 
GUI.

Regards,
Mat

A short stack trace follows:

Starting program: /usr/bin/emacs24-x -Q -l ~/bug-consistent-crash.el
[Thread debugging using libthread_db enabled]
Using host libthread_db library 
"/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe9cff700 (LWP 12593)]
[New Thread 0x7fffe94fe700 (LWP 12594)]

Program received signal SIGSEGV, Segmentation fault.
font_open_for_lface (f=f@entry=0x115fe00, entity=18342333,
     attrs=attrs@entry=0x1155f20, spec=spec@entry=18243669) at 
font.c:3244
3244	font.c: No such file or directory.
#0  font_open_for_lface (f=f@entry=0x115fe00, entity=18342333,
     attrs=attrs@entry=0x1155f20, spec=spec@entry=18243669) at 
font.c:3244
         def = 0x0
         height = <error reading variable height (Cannot access memory at 
address 0x90)>
         pt = <optimized out>
         size = <optimized out>
#1  0x0000000000565b41 in font_load_for_lface (f=0x115fe00,
     f@entry=<error reading variable: Cannot access memory at address 
0x7fffffffc8c0>, attrs=0x1155f20, spec=spec@entry=18243669) at 
font.c:3285
         entity = <optimized out>
         name = <optimized out>
#2  0x00000000004a88b2 in Finternal_set_lisp_face_attribute 
(face=12154754,
     face@entry=<error reading variable: Cannot access memory at address 
0x7fffffffc908>, attr=12152626, value=18243669, frame=18218501) at 
xfaces.c:3148
         attrs = <optimized out>
         font_object = <optimized out>
         f = <error reading variable f (Cannot access memory at address 
0x7fffffffc8c0)>
         lface = 18177813
         old_value = 12154610
         prop_index = FONT_TYPE_INDEX

In GNU Emacs 24.3.1 (x86_64-pc-linux-gnu, GTK+ Version 3.10.7)
  of 2014-03-07 on lamiak, modified by Debian
Windowing system distributor `The X.Org Foundation', version 
11.0.11501000
System Description:	Ubuntu 14.04 LTS

Configured using:
  `configure '--build' 'x86_64-linux-gnu' '--build' 'x86_64-linux-gnu'
  '--prefix=/usr' '--sharedstatedir=/var/lib' '--libexecdir=/usr/lib'
  '--localstatedir=/var/lib' '--infodir=/usr/share/info'
  '--mandir=/usr/share/man' '--with-pop=yes'
  
'--enable-locallisppath=/etc/emacs24:/etc/emacs:/usr/local/share/emacs/24.3/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/24.3/site-lisp:/usr/share/emacs/site-lisp'
  '--with-crt-dir=/usr/lib/x86_64-linux-gnu' '--with-x=yes'
  '--with-x-toolkit=gtk3' '--with-toolkit-scroll-bars'
  'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fstack-protector
  --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wall'
  'LDFLAGS=-Wl,-Bsymbolic-functions -Wl,-z,relro'
  'CPPFLAGS=-D_FORTIFY_SOURCE=2''

Important settings:
   value of $LC_CTYPE: en_US.UTF-8
   value of $LANG: en_US.UTF-8
   value of $XMODIFIERS: @im=ibus
   locale-coding-system: utf-8-unix
   default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
   tooltip-mode: t
   mouse-wheel-mode: t
   tool-bar-mode: t
   menu-bar-mode: t
   file-name-shadow-mode: t
   global-font-lock-mode: t
   font-lock-mode: t
   blink-cursor-mode: t
   auto-composition-mode: t
   auto-encryption-mode: t
   auto-compression-mode: t
   line-number-mode: t
   transient-mark-mode: t

Recent input:
M-x r e p o r t - e <tab> <return>

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr emacsbug message format-spec rfc822 mml
easymenu mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils time-date tooltip ediff-hook vc-hooks
lisp-float-type mwheel x-win x-dnd tool-bar dnd fontset image regexp-opt
fringe tabulated-list newcomment lisp-mode register page menu-bar
rfn-eshadow timer select scroll-bar mouse jit-lock font-lock syntax
facemenu font-core frame cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese hebrew greek romanian slovak
czech european ethiopic indian cyrillic chinese case-table epa-hook
jka-cmpr-hook help simple abbrev minibuffer loaddefs button faces
cus-face macroexp files text-properties overlay sha1 md5 base64 format
env code-pages mule custom widget hashtable-print-readable backquote
make-network-process dbusbind dynamic-setting system-font-setting
font-render-setting move-toolbar gtk x-toolkit x multi-tty emacs)

bug#17889: 24.3; Crash setting the font on a separate frame with no minibuffer

[Dmitry Antipov]

On 07/01/2014 03:26 AM, Mat Smiglarski wrote:

> Emacs crashes when setting the font on a frame with no minibuffer
> after initialising color-mode. This does not occur when running in a terminal.

Should be fixed in emacs-24 revision 117331.

Dmitry