bug#43700: 28.0.50; Crash creating a second frame

[Eli Zaretskii]

> From: Andy Moreton <andrewjmoreton@gmail.com>
> Date: Tue, 29 Sep 2020 11:46:48 +0100
> 
> After loading emacs (and files saved by desktop), do C-x 5 2 to create a
> new frame. Emacs crashes, and gdb shows the following backtrace.

Is this repeatable?  Does it happen with "emacs -Q", per chance?  Or
with unoptimized builds?

> This seems to have something to do with toolbars, but ~/.emacs.d/init.el 
> contains "(tool-bar-mode 0)" so it shouldn't be doing anything with toolbars.

Creating a frame makes a keymap for the tool bar, whether it's
displayed or not.

But look at this part:

> #9  0x00000004001e76b1 in FACE_FROM_ID (id=0x162880, f=0x154e25ed5d860000) at 
> C:/emacs/git/emacs/master/src/frame.h:1460
> No locals.
> #10 lookup_image (f=0x154e25ed5d860000, f@entry=0x6edbab0, spec=XIL(0), 
> spec@entry=XIL(0xcd2b873), face_id=0x162880, face_id@entry=0xffffffff) at 
> C:/emacs/git/emacs/master/src/image.c:2332
>          img = <optimized out>
>          hash = <optimized out>
>          face = <optimized out>
>          foreground = <optimized out>
>          background = <optimized out>
> #11 0x00000004001e8235 in Fimage_mask_p (spec=XIL(0xcd2b873), frame=XIL(0)) 
> at 
> C:/emacs/git/emacs/master/src/image.c:1114
>          f = 0x6edbab0

Look at the reasonable values of the arguments at entry to
lookup_image, and the garbled values at the crash site.  The line that
calls FACE_FROM_ID is the first executable line of lookup_image, so
this could have happened only if the optimizations moved some
non-trivial code between the entry to the function and that line.  Or
maybe something else is at work here.