bug#3082: Crash in ns_draw_glyph_string

[David Reitter]

Emacs -Q
M-x list-faces-display
C-x o
C-x 1
M-: (setq scroll-step 1 scroll-conservatively 1)
(enlarge frame a bit)

Now scroll down (with Down/Home) repeatedly.  In two out of three  
trials this produced the crash below for me.





Process:         Emacs [27021]
Path:            /Users/dr/sv.aquamacs-emacs.git/nextstep/Emacs.app/ 
Contents/MacOS/Emacs
Identifier:      org.gnu.Emacs
Version:         Version 23.0.92 (9.0)
Code Type:       X86 (Native)
Parent Process:  bash [27007]

Date/Time:       2009-04-22 13:15:56.129 -0400
OS Version:      Mac OS X 10.5.6 (9G55)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGABRT)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000c0000003
Crashed Thread:  0

Thread 0 Crashed:
0   libSystem.B.dylib                   0x94f84e42 __kill + 10
1   org.gnu.Emacs                       0x000b582a fatal_error_signal + 314
2   libSystem.B.dylib                   0x94f832bb _sigtramp + 43
3   ???                                 0xffffffff 0 + 4294967295
4   libSystem.B.dylib                   0x94ff723a raise + 26
5   libSystem.B.dylib                   0x95003679 abort + 73
6   org.gnu.Emacs                       0x001a7d65 ns_term_shutdown + 117
7   org.gnu.Emacs                       0x000b587f fatal_error_signal + 399
8   libSystem.B.dylib                   0x94f832bb _sigtramp + 43
9   ???                                 0xffffffff 0 + 4294967295
10  org.gnu.Emacs                 	0x001b4383 ns_draw_glyph_string +  
2387
11  org.gnu.Emacs                       0x0004f415 draw_glyphs + 293
12  org.gnu.Emacs                       0x00054ee9 show_mouse_face + 409
13  org.gnu.Emacs                 	0x00056dda note_mouse_highlight +  
6698
14  org.gnu.Emacs                       0x001a5d11 ns_frame_up_to_date + 129
15  org.gnu.Emacs                       0x00047417 redisplay_internal + 2087
16  org.gnu.Emacs                       0x000c68b5 read_char + 4101
17  org.gnu.Emacs                       0x000c9103 read_key_sequence + 3107
18  org.gnu.Emacs                       0x000cb480 command_loop_1 + 656
19  org.gnu.Emacs                 	0x0013baed internal_condition_case  
+ 253
20  org.gnu.Emacs                       0x000b7798 command_loop_2 + 72
21  org.gnu.Emacs                       0x0013b9cc internal_catch + 172
22  org.gnu.Emacs                       0x000be27b recursive_edit_1 + 363
23  org.gnu.Emacs                       0x000be434 Frecursive_edit + 324
24  org.gnu.Emacs                       0x000b68fb main + 4059
25  org.gnu.Emacs                       0x00002b46 start + 54

Thread 0 crashed with X86 Thread State (32-bit):
  eax: 0x00000000  ebx: 0x000b56fe  ecx: 0xbfffd27c  edx: 0x94f84e42
  edi: 0x00000006  esi: 0x00000006  ebp: 0xbfffd298  esp: 0xbfffd27c
   ss: 0x0000001f  efl: 0x00000282  eip: 0x94f84e42   cs: 0x00000007
   ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037
  cr2: 0xc0000003


Process:         Emacs [27037]
Path:            /Users/dr/sv.aquamacs-emacs.git/nextstep/Emacs.app/ 
Contents/MacOS/Emacs
Identifier:      org.gnu.Emacs
Version:         Version 23.0.92 (9.0)
Code Type:       X86 (Native)
Parent Process:  bash [27007]

Date/Time:       2009-04-22 13:18:17.570 -0400
OS Version:      Mac OS X 10.5.6 (9G55)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGABRT)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000c0000003
Crashed Thread:  0

Thread 0 Crashed:
0   libSystem.B.dylib                   0x94f84e42 __kill + 10
1   org.gnu.Emacs                       0x000b582a fatal_error_signal + 314
2   libSystem.B.dylib                   0x94f832bb _sigtramp + 43
3   ???                                 0xffffffff 0 + 4294967295
4   libSystem.B.dylib                   0x94ff723a raise + 26
5   libSystem.B.dylib                   0x95003679 abort + 73
6   org.gnu.Emacs                       0x001a7d65 ns_term_shutdown + 117
7   org.gnu.Emacs                       0x000b587f fatal_error_signal + 399
8   libSystem.B.dylib                   0x94f832bb _sigtramp + 43
9   ???                                 0xffffffff 0 + 4294967295
10  org.gnu.Emacs                 	0x001b4383 ns_draw_glyph_string +  
2387
11  org.gnu.Emacs                       0x0004f415 draw_glyphs + 293
12  org.gnu.Emacs                       0x00054ee9 show_mouse_face + 409
13  org.gnu.Emacs                 	0x00056dda note_mouse_highlight +  
6698
14  org.gnu.Emacs                 	0x001aa692 -[EmacsView mouseMoved:]  
+ 338
15  com.apple.AppKit              	0x90246ddd -[NSWindow sendEvent:] +  
8511
16  com.apple.AppKit              	0x90213435 -[NSApplication  
sendEvent:] + 4713
17  org.gnu.Emacs                 	0x001a7ed5 -[EmacsApp sendEvent:] +  
165
18  com.apple.AppKit                    0x9017069f -[NSApplication run] + 847
19  org.gnu.Emacs                       0x001a62c3 ns_read_socket + 307
20  org.gnu.Emacs                       0x000c0a21 read_avail_input + 305
21  org.gnu.Emacs                       0x000c0b95 gobble_input + 69
22  org.gnu.Emacs                       0x001a6694 ns_select + 484
23  org.gnu.Emacs                 	0x00185c92  
wait_reading_process_output + 1090
24  org.gnu.Emacs                       0x000047f6 sit_for + 214
25  org.gnu.Emacs                       0x000c75ed read_char + 7485
26  org.gnu.Emacs                       0x000c9103 read_key_sequence + 3107
27  org.gnu.Emacs                       0x000cb480 command_loop_1 + 656