bug#968: 23.0.60; CVS Emacs.app crashes randomly

[pat.maddox@gmail.com]

Emacs.app randomly crashes on me when in normal use.  I can be editing code, using gnus, or simply composing an email.  It's happened when I try to save a file, when I switch to emacs from another app, or when I hit return a couple times.  So it just seems to happen randomly.  It doesn't hang, it just exits immediately (without prompting me to save any files)

When I run it in gdb, instead of crashing instantly, it hangs.  I assume this is the point where the crash usually happens, but gdb is preventing it from quitting entirely.  Here's the message I see in gdb when it crashes:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000070
ns_free_indexed_color (idx=0, f=0x0) at nsterm.m:1302
1302      struct ns_color_table *color_table = FRAME_NS_DISPLAY_INFO (f)->color_table;

***********************************
** Output of 'bt full'

(gdb) bt full
#0  ns_free_indexed_color (idx=0, f=0x3a) at nsterm.m:1302
	color_table = <value temporarily unavailable, due to optimizations>
#1  0x0018917a in x_clear_image_1 (f=<value temporarily unavailable, due to optimizations>, img=0x2ebc2c0, pixmap_p=<value temporarily unavailable, due to optimizations>, mask_p=1, colors_p=1) at image.c:1627
No locals.
#2  0x00188bd3 in free_image (f=0x0, img=0x2ebc2c0) at image.c:1322
	c = (struct image_cache *) 0x2e11280
#3  0x0018951b in clear_image_cache (f=0x8a0510, filter=25165833) at image.c:1836
	img = (struct image *) 0x2ebc2c0
	t = {
  tv_sec = 1221201734, 
  tv_usec = 151573
}
	old = 1221199934
	i = 0
	nfreed = 0
	c = (struct image_cache *) 0x2e11280
#4  0x001895f6 in clear_image_caches (filter=25165833) at image.c:1873
	tail = 4055040
#5  0x00036378 in redisplay_internal (preserve_echo_area=<value temporarily unavailable, due to optimizations>) at xdisp.c:11981
	w = (struct window *) 0x8a0690
	f = <value temporarily unavailable, due to optimizations>
	pause = 0
	must_finish = 1
	tlbufpos = {
  charpos = 1, 
  bytepos = 25328521
}
	number_of_visible_frames = 1
	polling_stopped_here = 1
	old_frame = 9045268
	consider_all_windows_p = <value temporarily unavailable, due to optimizations>
#6  0x0009c6cc in read_char (commandflag=1, nmaps=7, maps=0xbffff210, prev_event=25165833, used_mouse_menu=0xbffff318, end_time=0x0) at keyboard.c:2649
	echo_current = 1
	c = 25165833
	count = <value temporarily unavailable, due to optimizations>
	jmpcount = 25193345
	local_getcjmp = {25165833, 594240, 25165833, 717563, 1408420, 80, 426214788, -1073745496, 1408757, 426214784, 80, 99, 965706, 966718, 25253257, -1073745544, 33359185, -1073745524}
	save_jump = {25193345, 426214788, 594257, 56713426, -1073745284, -1073745640, 1064427, 25278009, 25278008, -1073745608, 1064739, 25278009, 25165833, 426214784, 1, -1073745504, 3466748, 25165833}
	key_already_recorded = 0
	tem = <value temporarily unavailable, due to optimizations>
	save = <value temporarily unavailable, due to optimizations>
	previous_echo_area_message = 25165833
	also_record = 25165833
	reread = 0
	polling_stopped_here = <value temporarily unavailable, due to optimizations>
	orig_kboard = (struct kboard *) 0x83dec0
#7  0x0009f124 in read_key_sequence (keybuf=0xbffff3d8, bufsize=30, prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9340
	interrupted_kboard = (KBOARD *) 0x83dec0
	key = 0
	used_mouse_menu = 0
	echo_local_start = 0
	last_real_key_start = 0
	keys_local_start = 0
	local_first_binding = 0
	from_string = 25165833
	count = 2
	t = 0
	echo_start = 0
	keys_start = 0
	nmaps = 7
	nmaps_allocated = 7
	defs = (Lisp_Object * volatile) 0xbffff1e0
	submaps = (Lisp_Object * volatile) 0xbffff210
	orig_local_map = 20866517
	orig_keymap = 25165833
	localized_local_map = 0
	first_binding = 0
	first_unbound = 31
	mock_input = 0
	fkey = {
  parent = 8031565, 
  map = 8031565, 
  start = 0, 
  end = 0
}
	keytran = {
  parent = 4140925, 
  map = 4140925, 
  start = 0, 
  end = 0
}
	indec = {
  parent = 8031573, 
  map = 8031573, 
  start = 0, 
  end = 0
}
	shift_translated = 0
	delayed_switch_frame = 25165833
	original_uppercase = 3202432
	original_uppercase_position = -1
	starting_buffer = (struct buffer *) 0x19678580
	fake_prefixed_keys = 25165833
#8  0x000a164a in command_loop_1 () at keyboard.c:1621
	cmd = <value temporarily unavailable, due to optimizations>
	lose = <value temporarily unavailable, due to optimizations>
	nonundocount = 0
	keybuf = {104, 384, 3467432, 25165833, -1073744792, 622864, 50056877, -1073744866, -1073744840, -1880941348, 4055049, 152, -1073744866, 25165833, 17, 9, 0, -1895817508, 5258902, 1, -1073744776, -1773935801, 50389008, 0, -1073744820, -1073745008, 0, 3866624, 25165833, 33429633}
	i = 1
	prev_modiff = 22
	prev_buffer = (struct buffer *) 0x19678580
	already_adjusted = 0
#9  0x0010382d in internal_condition_case (bfun=0xa1410 <command_loop_1>, handlers=25205497, hfun=0x98030 <cmd_error>) at eval.c:1511
	val = <value temporarily unavailable, due to optimizations>
	c = {
  tag = 25165833, 
  val = 25165833, 
  next = 0xbffff58c, 
  gcpro = 0x0, 
  jmp = {-1073806465, -1880940836, 8098, 1062715, 25165833, 25165833, 3466684, 3466748, -1073744600, -1073744784, 31, 658, 1062858, 1245207, 3407903, 3407903, -1073807360, -1073807305}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
	h = {
  handler = 25205497, 
  var = 25165833, 
  chosen_clause = 25165881, 
  tag = 0xbffff488, 
  next = 0x0
}
#10 0x00091528 in command_loop_2 () at keyboard.c:1338
	val = 58
#11 0x0010370c in internal_catch (tag=58, func=0x914e0 <command_loop_2>, arg=25165833) at eval.c:1247
	c = {
  tag = 25201569, 
  val = 25165833, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {-1773993089, 0, 8098, 1062505, -1773935635, 22000, 3466816, 3466748, -1073744376, -1073744528, 25296927, 658, 1062655, 25296919, 25296927, 25165855, 5242880, 3997751}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
#12 0x0009127e in command_loop () at keyboard.c:1317
No locals.
#13 0x00091342 in recursive_edit_1 () at keyboard.c:942
	val = <value temporarily unavailable, due to optimizations>
#14 0x000914c1 in Frecursive_edit () at keyboard.c:1004
	buffer = 25165833
#15 0x0009015b in main (argc=1, argv=0xbffff7d8) at emacs.c:1693
	dummy = 0
	stack_bottom_variable = 0 '\000'
	do_initial_setlocale = 1
	skip_args = 0
	rlim = {
  rlim_cur = 8388608, 
  rlim_max = 67104768
}
	no_loadup = 0
	junk = 0x0
Current language:  auto; currently objective-c



In GNU Emacs 23.0.60.1 (i386-apple-darwin9.4.0, *Step 9.0)
 of 2008-09-09 on baggio.local
Windowing system distributor `Apple', version 49.46.48
configured using `configure  '--with-ns''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Emacs-Lisp

Minor modes in effect:
  shell-dirtrack-mode: t
  yas/minor-mode: t
  window-number-meta-mode: t
  window-number-mode: t
  show-paren-mode: t
  global-auto-revert-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
C-x C-f m y <backspace> <backspace> n u <backspace> 
<backspace> g n u <return> y M-x e v a l - b u f <tab> 
<return> M-x r e p o <tab> r - e m <tab> <return>

Recent messages:
Loading /Users/pergesu/.emacs.d/site-lisp/textmate.el (source)...done
Loading /Users/pergesu/.emacs.d/my-textmate.el (source)...done
Ido mode enabled
For information about GNU Emacs and the GNU system, type C-h C-a.
Loading vc-git...done
Symbolic link to Git-controlled source file; follow link? (y or n) 
Loading /Users/pergesu/myconfig/.emacs-project...done
Followed link to /Users/pergesu/myconfig/dot.gnus.el
Loading /Users/pergesu/.emacs.private.d/smtp-account-info.el (source)...done
Making completion list...