bug#17889: 24.3; Crash setting the font on a separate frame with no minibuffer

[Mat Smiglarski]

Emacs crashes when setting the font on a frame with no minibuffer
after initialising color-mode. This does not occur when running in a 
terminal.

The crash only occurs with certain fonts (eg. Monaco, or DejaVu Sans
Mono, but not Courier) and can be reproduced with a small amount of code 
from color-mode and no dependent packages, as demonstrated below.

To Reproduce:

1: Create the following 50 line file for initialisation. (This is mostly
from color-mode, and you may like to comment out the last two lines 
which are not, in order to avoid the immediate crash.)

(defun color-theme-install-faces (faces)
  ;; clear all previous faces
  ;; install new faces
  (let ((frame nil))
    (dolist (entry faces)
      (let ((face (nth 0 entry))
            (spec (nth 1 entry)))
        (or (facep face)
            (make-empty-face face))
        ;; remove weird properties from the default face only
        (if (and (functionp 'face-spec-reset-face)
                 (equal spec '((t (nil)))))
            (face-spec-reset-face face frame)
          (condition-case var
              (progn
                (face-spec-set face spec frame)
                (put face 'face-defface-spec spec))
            (error (message "Error using spec %S: %S" spec var))))))))

(defun color-theme-canonic (theme)
  "Return the canonic form of THEME.
This deals with all the backwards compatibility stuff."
  (let (function frame-params variables faces)
    (when (functionp (car theme))
      (setq function (car theme)
            theme (cdr theme)))
    (setq frame-params (car theme)
          theme (cdr theme))
    ;; optional variable defintions (for backwards compatibility)
    (when (listp (caar theme))
      (setq variables (car theme)
            theme (cdr theme)))
    ;; face definitions
    (setq faces theme)
    (list function frame-params variables faces)))

(defun color-theme-faces (theme)
  "Return faces defined by THEME."
  (nth 3 theme))

(color-theme-install-faces
 (color-theme-faces (color-theme-canonic
                     '(color-theme-crash-crash-crash
                       (italic ((t (:italic t))))
                       (underline ((t (:underline t))))
                       ))))

(with-selected-frame (make-frame '((minibuffer . nil)))
  (set-frame-font (font-spec :family "Monaco"))) ;; "DejaVu San Mono" 
also causes the crash

2. Start emacs

$ emacs -Q -l ~/crash.el

Emacs now crashes.

Only the last two lines of the script are not taken from color-mode and
they can be run at any time. The issue only occurs when running in a 
GUI.

Regards,
Mat

A short stack trace follows:

Starting program: /usr/bin/emacs24-x -Q -l ~/bug-consistent-crash.el
[Thread debugging using libthread_db enabled]
Using host libthread_db library 
"/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe9cff700 (LWP 12593)]
[New Thread 0x7fffe94fe700 (LWP 12594)]

Program received signal SIGSEGV, Segmentation fault.
font_open_for_lface (f=f@entry=0x115fe00, entity=18342333,
    attrs=attrs@entry=0x1155f20, spec=spec@entry=18243669) at 
font.c:3244
3244    font.c: No such file or directory.
#0  font_open_for_lface (f=f@entry=0x115fe00, entity=18342333,
    attrs=attrs@entry=0x1155f20, spec=spec@entry=18243669) at 
font.c:3244
        def = 0x0
        height = <error reading variable height (Cannot access memory at 
address 0x90)>
        pt = <optimized out>
        size = <optimized out>
#1  0x0000000000565b41 in font_load_for_lface (f=0x115fe00,
    f@entry=<error reading variable: Cannot access memory at address 
0x7fffffffc8c0>, attrs=0x1155f20, spec=spec@entry=18243669) at 
font.c:3285
        entity = <optimized out>
        name = <optimized out>
#2  0x00000000004a88b2 in Finternal_set_lisp_face_attribute 
(face=12154754,
    face@entry=<error reading variable: Cannot access memory at address 
0x7fffffffc908>, attr=12152626, value=18243669, frame=18218501) at 
xfaces.c:3148
        attrs = <optimized out>
        font_object = <optimized out>
        f = <error reading variable f (Cannot access memory at address 
0x7fffffffc8c0)>
        lface = 18177813
        old_value = 12154610
        prop_index = FONT_TYPE_INDEX

In GNU Emacs 24.3.1 (x86_64-pc-linux-gnu, GTK+ Version 3.10.7)
 of 2014-03-07 on lamiak, modified by Debian
Windowing system distributor `The X.Org Foundation', version 
11.0.11501000
System Description:     Ubuntu 14.04 LTS

Configured using:
 `configure '--build' 'x86_64-linux-gnu' '--build' 'x86_64-linux-gnu'
 '--prefix=/usr' '--sharedstatedir=/var/lib' '--libexecdir=/usr/lib'
 '--localstatedir=/var/lib' '--infodir=/usr/share/info'
 '--mandir=/usr/share/man' '--with-pop=yes'
 
'--enable-locallisppath=/etc/emacs24:/etc/emacs:/usr/local/share/emacs/24.3/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/24.3/site-lisp:/usr/share/emacs/site-lisp'
 '--with-crt-dir=/usr/lib/x86_64-linux-gnu' '--with-x=yes'
 '--with-x-toolkit=gtk3' '--with-toolkit-scroll-bars'
 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2 -fstack-protector
 --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wall'
 'LDFLAGS=-Wl,-Bsymbolic-functions -Wl,-z,relro'
 'CPPFLAGS=-D_FORTIFY_SOURCE=2''

Important settings:
  value of $LC_CTYPE: en_US.UTF-8
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x r e p o r t - e <tab> <return>

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr emacsbug message format-spec rfc822 mml
easymenu mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils time-date tooltip ediff-hook vc-hooks
lisp-float-type mwheel x-win x-dnd tool-bar dnd fontset image regexp-opt
fringe tabulated-list newcomment lisp-mode register page menu-bar
rfn-eshadow timer select scroll-bar mouse jit-lock font-lock syntax
facemenu font-core frame cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese hebrew greek romanian slovak
czech european ethiopic indian cyrillic chinese case-table epa-hook
jka-cmpr-hook help simple abbrev minibuffer loaddefs button faces
cus-face macroexp files text-properties overlay sha1 md5 base64 format
env code-pages mule custom widget hashtable-print-readable backquote
make-network-process dbusbind dynamic-setting system-font-setting
font-render-setting move-toolbar gtk x-toolkit x multi-tty emacs)