bug#54661: 29.0.50; Emacs SEGV in get_glyph_face_and

My Emacs has SEGVing a few times (twice today), from a fairly recent
build off `master`. Sometimes it seems to have happened when doing
autocompletion (using the `corfu` package), but it has definitely
happened when idle from a user perspective.

I'm afraid I have a lot of packages active including lsp, and it's way
too random and sporadic to be able to craft a cut-down config.

I will put the `bt full` output at the bottom of this email. I have
quite a few cores, but a quick check looks like they all have similar stack.
That `face = 0x0` looks ... ominous(?).

Please let me know if I can help generate more data.

Thanks, James.

----

In GNU Emacs 29.0.50 (build 2, x86_64-pc-linux-gnu, GTK+ Version 3.24.20, cairo version 1.16.0)
of 2022-03-23 built on jf-laptop
Repository revision: d74cd0cf1f96e256c479599939efacd11600c0c8
Repository branch: master
System Description: Ubuntu 20.04.4 LTS

Configured using:
'configure --with-native-compilation --with-pgtk'

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ JPEG
JSON LCMS2 LIBOTF LIBSELINUX LIBSYSTEMD LIBXML2 MODULES NATIVE_COMP
NOTIFY INOTIFY PDUMPER PGTK PNG RSVG SECCOMP SOUND THREADS TIFF
TOOLKIT_SCROLL_BARS XIM GTK3 ZLIB

Important settings:
value of $LANG: en_US.UTF-8
value of $XMODIFIERS: @im=ibus
locale-coding-system: utf-8-unix

Major mode: Dired by name

Minor modes in effect:
dap-tooltip-mode: t
dap-ui-many-windows-mode: t
dap-ui-controls-mode: t
dap-ui-mode: t
gdb-many-windows: t
gud-tooltip-mode: t
dap-auto-configure-mode: t
dap-mode: t
treemacs-filewatch-mode: t
treemacs-follow-mode: t
treemacs-git-mode: t
treemacs-fringe-indicator-mode: t
global-git-commit-mode: t
magit-auto-revert-mode: t
org-roam-db-autosync-mode: t
shell-dirtrack-mode: t
corfu-doc-mode: t
ws-butler-global-mode: t
ws-butler-mode: t
winner-mode: t
which-key-mode: t
vertico-mode: t
global-tree-sitter-mode: t
dired-omit-mode: t
async-bytecomp-package-mode: t
dired-async-mode: t
prescient-persist-mode: t
projectile-mode: t
minions-mode: t
marginalia-mode: t
textsize-mode: t
direnv-mode: t
corfu-global-mode: t
corfu-mode: t
pixel-scroll-precision-mode: t
savehist-mode: t
save-place-mode: t
recentf-mode: t
global-hl-line-mode: t
hl-line-mode: t
global-auto-revert-mode: t
electric-pair-mode: t
delete-selection-mode: t
straight-use-package-mode: t
straight-package-neutering-mode: t
override-global-mode: t
tooltip-mode: t
global-eldoc-mode: t
show-paren-mode: t
electric-indent-mode: t
mouse-wheel-mode: t
tab-bar-mode: t
file-name-shadow-mode: t
global-font-lock-mode: t
font-lock-mode: t
window-divider-mode: t
buffer-read-only: t
transient-mark-mode: t
auto-composition-mode: t
auto-encryption-mode: t
auto-compression-mode: t

Load-path shadows:
/home/james/.emacs.d/elpa/dpkg-dev-el-20190824.2314/debian-autoloads hides /home/james/.emacs.d/elpa/debian-el-20211006.1939/debian-autoloads
/home/james/.emacs.d/elpa/transient-20220314.1605/transient hides /usr/local/share/emacs/29.0.50/lisp/transient
/home/james/.emacs.d/my-packages/custom hides /usr/local/share/emacs/29.0.50/lisp/custom

Features:
(shadow sort expand-region text-mode-expansions cc-mode-expansions
the-org-mode-expansions python-el-fgallina-expansions
er-basic-expansions expand-region-core expand-region-custom mail-extr
emacsbug mule-util lsp-diagnostics lsp-headerline lsp-icons lsp-modeline
dap-mouse dap-ui gdb-mi bindat gud bui bui-list bui-info bui-entry
bui-core bui-history bui-button bui-utils lsp-lens dap-mode dap-launch
posframe dap-overlays vc-git vc-dispatcher view lsp-zig lsp-steep
lsp-svelte lsp-sqls lsp-yaml lsp-xml lsp-vimscript lsp-vhdl lsp-volar
lsp-vetur lsp-html lsp-verilog lsp-vala lsp-v lsp-typeprof lsp-ttcn3
lsp-toml lsp-terraform lsp-tex lsp-sorbet lsp-solargraph lsp-rust lsp-rf
lsp-remark lsp-r lsp-purescript lsp-pylsp lsp-pyls lsp-pwsh lsp-php
lsp-perlnavigator lsp-perl lsp-ocaml lsp-magik lsp-nix lsp-nim lsp-nginx
lsp-markdown lsp-lua lsp-kotlin lsp-json lsp-_javascript_ lsp-idris
lsp-haxe lsp-groovy lsp-hack lsp-graphql lsp-go lsp-completion
lsp-gdscript lsp-fsharp lsp-fortran lsp-eslint lsp-erlang lsp-emmet
lsp-elixir lsp-elm lsp-dockerfile lsp-dhall lsp-d lsp-css lsp-csharp
lsp-crystal lsp-cmake lsp-clojure lsp-treemacs lsp-treemacs-themes
treemacs treemacs-header-line treemacs-compatibility treemacs-mode
treemacs-interface treemacs-extensions treemacs-mouse-interface
treemacs-tags treemacs-persistence treemacs-filewatch-mode
treemacs-follow-mode treemacs-rendering treemacs-async
treemacs-workspaces treemacs-dom treemacs-visuals
treemacs-fringe-indicator treemacs-scope pulse treemacs-faces
treemacs-icons treemacs-themes treemacs-core-utils pfuture
treemacs-logging treemacs-customization treemacs-macros
lsp-semantic-tokens lsp-clangd dom lsp-beancount lsp-bash lsp-ansible
lsp-angular lsp-ada lsp-actionscript ccls ccls-member-hierarchy
ccls-inheritance-hierarchy ccls-call-hierarchy ccls-tree ccls-code-lens
ccls-semantic-highlight ccls-common help-fns radix-tree elpy elpy-rpc
pyvenv eshell esh-cmd esh-ext esh-opt esh-proc esh-io esh-arg esh-module
esh-groups esh-util elpy-shell elpy-profile elpy-django elpy-refactor
ido hideshow files-x etags fileloop cus-edit cus-start sphinx-doc
worksplit forge-list forge-commands forge-semi forge-bitbucket buck
forge-gogs gogs forge-gitea gtea forge-gitlab glab forge-github
ghub-graphql treepy gsexp ghub let-alist gnutls forge-notify
forge-revnote forge-pullreq forge-issue forge-topic yaml parse-time
bug-reference forge-post forge-repo forge forge-core forge-db closql
magit-submodule magit-obsolete magit-blame magit-stash magit-reflog
magit-bisect magit-push magit-pull magit-fetch magit-clone magit-remote
magit-commit magit-sequence magit-notes magit-worktree magit-tag
magit-merge magit-branch magit-reset magit-files magit-refs magit-status
magit magit-repos magit-apply magit-wip magit-log which-func magit-diff
smerge-mode diff git-commit log-edit message sendmail yank-media rfc822
mml mml-sec epa gnus-util mm-decode mm-bodies mm-encode mailabbrev
mail-utils gmm-utils mailheader pcvs-util add-log magit-core
magit-autorevert magit-margin magit-transient magit-process with-editor
magit-mode transient magit-git magit-base crm lsp-pyright lsp-ui
lsp-ui-flycheck lsp-ui-doc goto-addr lsp-ui-imenu lsp-ui-peek
lsp-ui-sideline flycheck lsp-ui-util face-remap lsp-mode lsp-protocol
xref spinner network-stream markdown-mode color imenu ht inline f ewoc
epg rfc6068 epg-config cursor-sensor my-org-roam org-roam-dailies
org-roam-migrate org-roam-mode org-roam-capture org-roam-id
org-roam-node org-roam-db org-roam-utils org-roam-compat org-roam
org-capture org-id ox-reveal ox-odt rng-loc rng-uri rng-parse rng-match
rng-dt rng-util rng-pttrn nxml-parse nxml-ns nxml-enc xmltok nxml-util
ox-md ox-latex ox-icalendar org-agenda org-refile ox-html table ox-ascii
ox-publish ox org-element avl-tree generator ob-async org-variable-pitch
org org-macro org-footnote org-pcomplete org-list org-faces org-entities
noutline outline org-version ob-C cc-mode cc-fonts cc-guess cc-menus
cc-cmds cc-styles cc-align cc-engine cc-vars cc-defs ob-http
ob-http-mode ob-python py-isort python-black reformatter python ob-shell
shell pcomplete ob-ditaa ob-plantuml ob-dot ob ob-tangle org-src ob-ref
ob-lob ob-table ob-exp ob-comint ob-emacs-lisp ob-core ob-eval org-table
oc-basic bibtex iso8601 time-date ol org-keys oc org-compat org-macs
org-loaddefs format-spec find-func cal-menu calendar cal-loaddefs
emacsql-sqlite url-http url-auth mail-parse rfc2231 rfc2047 rfc2045
mm-util ietf-drums mail-prsvr url-gw nsm rmc puny emacsql
emacsql-compiler magit-section display-fill-column-indicator flyspell
ispell highlight-symbol cl yasnippet-snippets yasnippet corfu-doc
faff-theme init xterm-color ws-butler winner which-key vterm-autoloads
vertico tree-sitter-langs tree-sitter-langs-build tar-mode arc-mode
archive-mode pp tree-sitter-hl tree-sitter tree-sitter-load
tree-sitter-cli tsc tsc-dyn tsc-dyn-get dired-x dired-filetype-face
async-bytecomp dired-async dired-aux async dired dired-loaddefs
tsc-obsolete s prescient comp comp-cstr warnings projectile lisp-mnt
ibuffer-vc ibuf-macs ibuf-ext ibuffer ibuffer-loaddefs thingatpt project
orderless minions marginalia hydra lv grep-a-lot grep compile
text-property-search comint ansi-color advice textsize direnv pcase
diff-mode dash corfu dotenv-mode server pixel-scroll ring edmacro kmacro
savehist saveplace recentf tree-widget wid-edit hl-line autorevert
filenotify elec-pair delsel cus-load straight-autoloads cl-extra
help-mode straight use-package use-package-ensure use-package-delight
use-package-diminish use-package-bind-key bind-key easy-mmode
use-package-core derived finder-inf ede/auto eieio-base dpkg-dev-el
debian-el rx info package browse-url url url-proxy url-privacy
url-expand url-methods url-history url-cookie url-domsuf url-util
mailcap url-handlers url-parse auth-source cl-seq eieio eieio-core
cl-macs eieio-loaddefs password-cache json map url-vars seq gv subr-x
byte-opt bytecomp byte-compile cconv cl-loaddefs cl-lib iso-transl
tooltip eldoc paren electric uniquify ediff-hook vc-hooks
lisp-float-type elisp-mode mwheel term/pgtk-win pgtk-win term/common-win
tool-bar dnd fontset image regexp-opt fringe tabulated-list replace
newcomment text-mode lisp-mode prog-mode register page tab-bar menu-bar
rfn-eshadow isearch easymenu timer select scroll-bar mouse jit-lock
font-lock syntax font-core term/tty-colors frame minibuffer nadvice
simple cl-generic cham georgian utf-8-lang misc-lang vietnamese tibetan
thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek romanian
slovak czech european ethiopic indian cyrillic chinese composite
emoji-zwj charscript charprop case-table epa-hook jka-cmpr-hook help
abbrev obarray cl-preloaded button loaddefs faces cus-face macroexp
files window text-properties overlay sha1 md5 base64 format env
code-pages mule custom widget keymap hashtable-print-readable backquote
threads dbusbind inotify dynamic-setting system-font-setting
font-render-setting cairo gtk pgtk lcms2 multi-tty make-network-process
native-compile emacs)

Memory information:
((conses 16 1238499 895807)
(symbols 48 64456 176)
(strings 32 340297 89952)
(string-bytes 1 12906406)
(vectors 16 116582)
(vector-slots 8 2891539 339078)
(floats 8 835 1260)
(intervals 56 6275 657)
(buffers 992 24))

----
bt full output:

(gdb) bt full
#0 raise (sig=sig@entry=11) at ../sysdeps/unix/sysv/linux/raise.c:50
set = {__val = {18446744067266837247, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 268435456, 0, 0, 93918994993472, 18446744067266838271}}
pid = <optimized out>
tid = <optimized out>
#1 0x0000556b38450782 in terminate_due_to_signal (sig=sig@entry=11, backtrace_limit=backtrace_limit@entry=40) at emacs.c:450
#2 0x0000556b38450cc7 in handle_fatal_signal (sig=sig@entry=11) at sysdep.c:1780
#3 0x0000556b385590ed in deliver_thread_signal (sig=sig@entry=11, handler=0x556b38450cb6 <handle_fatal_signal>) at sysdep.c:1772
#4 0x0000556b3855916d in deliver_fatal_thread_signal (sig=11) at sysdep.c:1792
fatal = <optimized out>
#5 handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>) at sysdep.c:1885
fatal = <optimized out>
#6 0x00007f7bd8ff13c0 in <signal handler called> () at /lib/x86_64-linux-gnu/libpthread.so.0
#7 prepare_face_for_display (f=0x556b3d9467e0, face=0x0) at xfaces.c:4439
#8 0x0000556b38475c59 in get_glyph_face_and_encoding (f=<optimized out>, glyph=glyph@entry=0x556b69564fb0, char2b=0x7ffe4893d7b0) at xdisp.c:28569
face = 0x0
code = 0
#9 0x0000556b384af7ce in fill_glyph_string
(s=s@entry=0x7ffe4893d850, face_id=face_id@entry=91, start=start@entry=0, end=end@entry=35, overlaps=overlaps@entry=0) at xdisp.c:28854
glyph = 0x556b69564fb0
last = 0x556b69565640
voffset = 0
glyph_not_available_p = false
#10 0x0000556b384b09e7 in draw_glyphs
(w=<optimized out>, x=<optimized out>, row=<optimized out>, area=<optimized out>, start=<optimized out>, end=<optimized out>, hl=<optimized out>, overla
ps=<optimized out>) at xdisp.c:29656
face_id = 91
char2b = <optimized out>
first_glyph = <optimized out>
head = 0x7ffe4893d850
tail = 0x7ffe4893d850
s = 0x7ffe4893d850
clip_head = 0x0
clip_tail = 0x0
i = <optimized out>
j = <optimized out>
x_reached = <optimized out>
last_x = <optimized out>
area_left = <optimized out>
f = <optimized out>
sa_avail = 16244
sa_count = {bytes = <optimized out>}
#11 0x0000556b384b3aa5 in gui_write_glyphs (w=0x556b3a491748, updated_row=<optimized out>, start=<optimized out>, updated_area=TEXT_AREA, len=35)
at xdisp.c:31863
x = <optimized out>
hpos = 0
chpos = 34
#12 0x0000556b3845b308 in update_text_area (vpos=0, updated_row=0x556b3f92e140, w=0x556b3a491748) at dispnew.c:3939
rif = <optimized out>
changed_p = false
current_row = 0x556b43b48410
desired_row = 0x556b3f92e140
rif = <optimized out>
changed_p = false
#13 update_window_line (w=w@entry=0x556b3a491748, vpos=vpos@entry=0, mouse_face_overwritten_p=mouse_face_overwritten_p@entry=0x7ffe4893dc67)
at dispnew.c:4182
current_row = 0x556b43b48410
desired_row = 0x556b3f92e140
rif = <optimized out>
changed_p = false
#14 0x0000556b38460ee6 in update_window (w=w@entry=0x556b3a491748, force_p=<optimized out>, force_p@entry=true) at dispnew.c:3682
vpos = <optimized out>
i = <optimized out>
end = <optimized out>
tab_line_row = <optimized out>
mouse_face_overwritten_p = false
n_updated = 0
mode_line_row = <optimized out>
changed_p = false
invisible_rows_marked = false
row = <optimized out>
header_line_row = <optimized out>
yb = <optimized out>
desired_matrix = <optimized out>
paused_p = <optimized out>
preempt_count = <optimized out>
rif = <optimized out>
#15 0x0000556b384627a3 in update_window_tree (w=0x556b3a491748, w@entry=0x556b485b24c8, force_p=force_p@entry=true) at dispnew.c:3407
paused_p = false
#16 0x0000556b384629db in update_frame (f=f@entry=0x556b3d9467e0, force_p=true, force_p@entry=false, inhibit_hairy_id_p=inhibit_hairy_id_p@entry=false)
at dispnew.c:3242
paused_p = <optimized out>
root_window = 0x556b485b24c8
#17 0x0000556b384a92e5 in redisplay_internal () at xdisp.c:16598
gcscrollbars = <optimized out>
f_redisplay_flag = <optimized out>
f = 0x556b3d9467e0
w = <optimized out>
sw = <optimized out>
fr = <optimized out>
pending = false
must_finish = <optimized out>
match_p = <optimized out>
tlbufpos = {charpos = <optimized out>, bytepos = <optimized out>}
tlendpos = {charpos = <optimized out>, bytepos = <optimized out>}
number_of_visible_frames = <optimized out>
sf = <optimized out>
polling_stopped_here = true
tail = 0x556b3aef20c3
frame = 0x556b3d9467e5
hscroll_retries = <optimized out>
garbaged_frame_retries = 0
consider_all_windows_p = <optimized out>
update_miniwindow_p = <optimized out>
#18 0x0000556b384aa9c4 in redisplay_preserve_echo_area (from_where=from_where@entry=2) at xdisp.c:16867
#19 0x0000556b3845cadd in Fredisplay (force=<optimized out>) at dispnew.c:6188
count = {bytes = <optimized out>}
#20 Fredisplay (force=0x2a109a6911c8) at dispnew.c:6168
#21 0x00007f7bd0688d62 in F636f7266752d2d6d616b652d6672616d65_corfu__make_frame_0 ()
at /home/james/.emacs.d/eln-cache/29.0.50-d0d7c8d0/corfu-7d809953-f87af7f9.eln
#22 0x0000556b385c8050 in Ffuncall (nargs=6, args=0x7ffe4893f5f0) at eval.c:2939
val = <optimized out>
#23 0x00007f7bd0689596 in F636f7266752d2d706f7075702d73686f77_corfu__popup_show_0 ()
at /home/james/.emacs.d/eln-cache/29.0.50-d0d7c8d0/corfu-7d809953-f87af7f9.eln
#24 0x0000556b385ca072 in funcall_subr (subr=0x556b3babcfa0, numargs=7, args=<optimized out>) at eval.c:2989
argbuf = {0x192, 0x4e2, 0x5e, 0x192, 0x5e, 0x3e, 0x5e, 0x192}
a = <optimized out>
fun = <optimized out>
#25 0x0000556b385c8050 in Ffuncall (nargs=8, args=0x7ffe4893f770) at eval.c:2939
val = <optimized out>
#26 0x0000556b385c8458 in Fapply (nargs=2, args=0x7f7bd1790040) at eval.c:2546
i = <optimized out>
funcall_nargs = 8
funcall_args = <optimized out>
spread_arg = 0x0
fun = <optimized out>
sa_avail = <optimized out>
sa_count = {bytes = 576}
numargs = <optimized out>
retval = <optimized out>
#27 0x0000556b38613177 in exec_byte_code (fun=<optimized out>, args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>)
at bytecode.c:809
call_nargs = 2
call_fun = <optimized out>
template = <optimized out>
val = <optimized out>
call_args = 0x7f7bd1790040
original_fun = 0x2c70
bytecode = <optimized out>
op = 2
type = <optimized out>
targets =
{0x556b38454e9d <exec_byte_code-1825811>, 0x556b386133c9 <exec_byte_code+2329>, 0x556b386133c0 <exec_byte_code+2320>, 0x556b386133b7 <exec_byte_co
de+2311>, 0x556b38612c80 <exec_byte_code+464>, 0x556b38612c84 <exec_byte_code+468>, 0x556b3861337f <exec_byte_code+2255>, 0x556b38613347 <exec_byte_code+219
9>, 0x556b38613b6f <exec_byte_code+4287>, 0x556b38613b66 <exec_byte_code+4278>, 0x556b38613b5d <exec_byte_code+4269>, 0x556b38613b54 <exec_byte_code+4260>,
0x556b38612cb7 <exec_byte_code+519>, 0x556b38612cc0 <exec_byte_code+528>, 0x556b38613b42 <exec_byte_code+4242>, 0x556b38613abd <exec_byte_code+4109>, 0x556b
38613c26 <exec_byte_code+4470>, 0x556b38613c1d <exec_byte_code+4461>, 0x556b38613c14 <exec_byte_code+4452>, 0x556b38613c0b <exec_byte_code+4443>, 0x556b3861
2c11 <exec_byte_code+353>, 0x556b38612c18 <exec_byte_code+360>, 0x556b38613be7 <exec_byte_code+4407>, 0x556b38613bf9 <exec_byte_code+4425>, 0x556b38613b8a <
exec_byte_code+4314>, 0x556b38613b81 <exec_byte_code+4305>, 0x556b38613b78 <exec_byte_code+4296>, 0x556b386141f0 <exec_byte_code+5952>, 0x556b38612f14 <exec
_byte_code+1124>, 0x556b38612f20 <exec_byte_code+1136>, 0x556b38613ba5 <exec_byte_code+4341>, 0x556b38613b93 <exec_byte_code+4323>, 0x556b386141c3 <exec_byt
e_code+5907>, 0x556b386141ba <exec_byte_code+5898>, 0x556b386141b1 <exec_byte_code+5889>, 0x556b386141a8 <exec_byte_code+5880>, 0x556b38612d28 <exec_byte_co
de+632>, 0x556b38612d30 <exec_byte_code+640>, 0x556b386141de <exec_byte_code+5934>, 0x556b386141cc <exec_byte_code+5916>, 0x556b3861417b <exec_byte_code+583
5>, 0x556b38614172 <exec_byte_code+5826>, 0x556b38614169 <exec_byte_code+5817>, 0x556b38614160 <exec_byte_code+5808>, 0x556b38612ec9 <exec_byte_code+1049>,
0x556b38612ed0 <exec_byte_code+1056>, 0x556b38614196 <exec_byte_code+5862>, 0x556b38614184 <exec_byte_code+5844>, 0x556b38613d9c <exec_byte_code+4844>, 0x55
6b38613dcb <exec_byte_code+4891>, 0x556b38613e40 <exec_byte_code+5008>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x
556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38615145 <exec_byte_code+9877
>, 0x556b386150e2 <exec_byte_code+9778>, 0x556b386150a3 <exec_byte_code+9715>, 0x556b38615064 <exec_byte_code+9652>, 0x556b38615021 <exec_byte_code+9585>, 0
x556b38613ca4 <exec_byte_code+4596>, 0x556b38613c66 <exec_byte_code+4534>, 0x556b38614ff3 <exec_byte_code+9539>, 0x556b38613acf <exec_byte_code+4127>, 0x556
b38613c2f <exec_byte_code+4479>, 0x556b38614fb5 <exec_byte_code+9477>, 0x556b38614f89 <exec_byte_code+9433>, 0x556b38614f4b <exec_byte_code+9371>, 0x556b386
14f11 <exec_byte_code+9313>, 0x556b38614ed3 <exec_byte_code+9251>, 0x556b38614e67 <exec_byte_code+9143>, 0x556b38614df4 <exec_byte_code+9028>, 0x556b38614d7
e <exec_byte_code+8910>, 0x556b38614d52 <exec_byte_code+8866>, 0x556b38614d26 <exec_byte_code+8822>, 0x556b38614ce8 <exec_byte_code+8760>, 0x556b38614caa <e
xec_byte_code+8698>, 0x556b38614c6c <exec_byte_code+8636>, 0x556b38614c2a <exec_byte_code+8570>, 0x556b38614bf3 <exec_byte_code+8515>, 0x556b38614bbc <exec_
byte_code+8460>, 0x556b38614b85 <exec_byte_code+8405>, 0x556b38614aec <exec_byte_code+8252>, 0x556b38614a93 <exec_byte_code+8163>, 0x556b38614a44 <exec_byte
_code+8084>, 0x556b386149f2 <exec_byte_code+8002>, 0x556b386149a0 <exec_byte_code+7920>, 0x556b3861494e <exec_byte_code+7838>, 0x556b386148fc <exec_byte_cod
e+7756>, 0x556b386148a5 <exec_byte_code+7669>, 0x556b3861484b <exec_byte_code+7579>, 0x556b386147f4 <exec_byte_code+7492>, 0x556b3861479d <exec_byte_code+74
05>, 0x556b38614746 <exec_byte_code+7318>, 0x556b386146ee <exec_byte_code+7230>, 0x556b38614603 <exec_byte_code+6995>, 0x556b38612f64 <exec_byte_code+1204>,
0x556b386145d7 <exec_byte_code+6951>, 0x556b386145a6 <exec_byte_code+6902>, 0x556b3861451f <exec_byte_code+6767>, 0x556b386144d8 <exec_byte_code+6696>, 0x5
56b386144ac <exec_byte_code+6652>, 0x556b3861447d <exec_byte_code+6605>, 0x556b3861444e <exec_byte_code+6558>, 0x556b38614417 <exec_byte_code+6503>, 0x556b3
86143e9 <exec_byte_code+6457>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b386143ba <exec_byte_code+6410>, 0x556b3861438b <exec_byte_code+6363>, 0x556b38
61435c <exec_byte_code+6316>, 0x556b3861432d <exec_byte_code+6269>, 0x556b386142fe <exec_byte_code+6222>, 0x556b386142d2 <exec_byte_code+6178>, 0x556b38612f
68 <exec_byte_code+1208>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b3861428f <exec_byte_code+6111>, 0x556b38614263 <exec_byte_code+6067>, 0x556b3861423
7 <exec_byte_code+6023>, 0x556b386141f9 <exec_byte_code+5961>, 0x556b38613a4b <exec_byte_code+3995>, 0x556b38613a1f <exec_byte_code+3951>, 0x556b386139f3 <e
xec_byte_code+3907>, 0x556b386139b5 <exec_byte_code+3845>, 0x556b38613977 <exec_byte_code+3783>, 0x556b38613939 <exec_byte_code+3721>, 0x556b3861390a <exec_
byte_code+3674>, 0x556b386138de <exec_byte_code+3630>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38613f41 <exec_byte_code+5265>, 0x556b386140ea <exec_b
yte_code+5690>, 0x556b38613b04 <exec_byte_code+4180>, 0x556b386140ac <exec_byte_code+5628>, 0x556b38614071 <exec_byte_code+5569>, 0x556b38614036 <exec_byte_
code+5510>, 0x556b38613f9a <exec_byte_code+5354>, 0x556b38613f79 <exec_byte_code+5321>, 0x556b38613bb7 <exec_byte_code+4359>, 0x556b38613f21 <exec_byte_code
+5233>, 0x556b38613ec2 <exec_byte_code+5138>, 0x556b38613e92 <exec_byte_code+5090>, 0x556b38613e4d <exec_byte_code+5021>, 0x556b38613d4d <exec_byte_code+476
5>, 0x556b3861522f <exec_byte_code+10111>, 0x556b386151e8 <exec_byte_code+10040>, 0x556b3861518d <exec_byte_code+9949>, 0x556b38454ea1 <exec_byte_code-18258
07>, 0x556b3861389c <exec_byte_code+3564>, 0x556b38613870 <exec_byte_code+3520>, 0x556b38613844 <exec_byte_code+3476>, 0x556b38613818 <exec_byte_code+3432>,
0x556b386137ec <exec_byte_code+3388>, 0x556b386137ae <exec_byte_code+3326>, 0x556b38613770 <exec_byte_code+3264>, 0x556b38613732 <exec_byte_code+3202>, 0x5
56b386136f4 <exec_byte_code+3140>, 0x556b386136a5 <exec_byte_code+3061>, 0x556b38613667 <exec_byte_code+2999>, 0x556b38613629 <exec_byte_code+2937>, 0x556b3
8613600 <exec_byte_code+2896>, 0x556b386135a1 <exec_byte_code+2801>, 0x556b38613542 <exec_byte_code+2706>, 0x556b3861350b <exec_byte_code+2651>, 0x556b38613
4d4 <exec_byte_code+2596>, 0x556b386134a0 <exec_byte_code+2544>, 0x556b38614697 <exec_byte_code+7143>, 0x556b3861464a <exec_byte_code+7066>, 0x556b38613436
<exec_byte_code+2438>, 0x556b386133d2 <exec_byte_code+2338>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea
1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556
b38614e93 <exec_byte_code+9187>, 0x556b38614b45 <exec_byte_code+8341>, 0x556b38614566 <exec_byte_code+6838>, 0x556b38613304 <exec_byte_code+2132>, 0x556b386
132c1 <exec_byte_code+2065>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b3861327d <exec_byte_code+1997>, 0x556b3
8613220 <exec_byte_code+1904>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x
556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38454ea1 <exec_byte_code-1825
807>, 0x556b38454ea1 <exec_byte_code-1825807>, 0x556b38613a89 <exec_byte_code+4057> <repeats 64 times>}
quitcounter = 1 '\001'
bc = 0x556b38a42150 <main_thread+496>
top = <optimized out>
pc = <optimized out>
bytestr = <optimized out>
vector = <optimized out>
maxdepth = <optimized out>
bytestr_length = <optimized out>
vectorp = 0x556b47357a78
frame_base = <optimized out>
fp = <optimized out>
bytestr_data = <optimized out>
rest = <optimized out>
mandatory = <optimized out>
nonrest = <optimized out>
pushedargs = <optimized out>
result = <optimized out>
#28 0x0000556b385c8050 in Ffuncall (nargs=8, args=0x7ffe4893fa70) at eval.c:2939
val = <optimized out>
#29 0x00007f7bd068d1b4 in F636f7266752d2d63616e646964617465732d706f707570_corfu__candidates_popup_0 ()
at /home/james/.emacs.d/eln-cache/29.0.50-d0d7c8d0/corfu-7d809953-f87af7f9.eln
#30 0x0000556b385c8050 in Ffuncall (nargs=2, args=0x7ffe4893fb88) at eval.c:2939
val = <optimized out>
#31 0x00007f7bd068dde2 in F636f7266752d2d757064617465_corfu__update_0 () at /home/james/.emacs.d/eln-cache/29.0.50-d0d7c8d0/corfu-7d809953-f87af7f9.eln
#32 0x0000556b385c8050 in Ffuncall (nargs=1, args=0x7ffe4893fc90) at eval.c:2939
val = <optimized out>
#33 0x00007f7bd0691492 in F636f7266752d2d6175746f2d636f6d706c657465_corfu__auto_complete_0 ()
at /home/james/.emacs.d/eln-cache/29.0.50-d0d7c8d0/corfu-7d809953-f87af7f9.eln
#34 0x0000556b385c8050 in Ffuncall (nargs=2, args=0x7ffe4893fde0) at eval.c:2939
val = <optimized out>
#35 0x0000556b385c85e2 in Fapply (nargs=2, args=0x7ffe4893fde0) at eval.c:2503
i = <optimized out>
funcall_nargs = <optimized out>
funcall_args = 0x0
spread_arg = 0x556b3ba2f243
fun = 0x2fcfd80
sa_avail = 16384
sa_count = {bytes = 320}
numargs = <optimized out>
retval = <optimized out>
#36 0x0000556b385c8050 in Ffuncall (nargs=3, args=0x7ffe4893fdd8) at eval.c:2939
val = <optimized out>
#37 0x00007f7bd2769de1 in F74696d65722d6576656e742d68616e646c6572_timer_event_handler_0 ()
at /usr/local/libexec/emacs/29.0.50/x86_64-pc-linux-gnu/../../../../bin/../lib/emacs/29.0.50/native-lisp/29.0.50-d0d7c8d0/preloaded/timer-3ee7cfd9-76499
eee.eln
#38 0x0000556b385c8050 in Ffuncall (nargs=2, args=0x7ffe4893fe70) at eval.c:2939
val = <optimized out>
#39 0x0000556b385c81de in call1 (fn=fn@entry=0xed60, arg1=arg1@entry=0x556b3d890c55) at eval.c:2776
#40 0x0000556b38540597 in timer_check_2 (idle_timers=<optimized out>, timers=<optimized out>) at lisp.h:1155
old_deactivate_mark = 0x0
idle_timer_ripe = <optimized out>
timer = <optimized out>
timer_time = {tv_sec = 1648759560, tv_nsec = 744690755}
timer_difference = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
idle_timer_difference = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
ripe = <optimized out>
idle_timer = <optimized out>
idle_timer_time = {tv_sec = 0, tv_nsec = 200000000}
timer_ripe = <optimized out>
nexttime = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
now = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
idleness_now = {tv_sec = 0, tv_nsec = <optimized out>}
chosen_timer = 0x556b3d890c55
nexttime = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
timers = 0x556b3bca5603
idle_timers = 0x556b3bca5563
tem = <optimized out>
#41 timer_check () at keyboard.c:4591
nexttime = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
timers = 0x556b3bca5603
idle_timers = 0x556b3bca5563
tem = <optimized out>
#42 0x0000556b385408ad in readable_events (flags=flags@entry=1) at keyboard.c:3478
#43 0x0000556b38541b28 in get_input_pending (flags=flags@entry=1) at keyboard.c:7156
#44 0x0000556b38547fa8 in detect_input_pending_run_timers (do_display=do_display@entry=true) at keyboard.c:10686
old_timers_run = <optimized out>
#45 0x0000556b3862ae64 in wait_reading_process_output
(time_limit=time_limit@entry=0, nsecs=nsecs@entry=0, read_kbd=read_kbd@entry=-1, do_display=true, wait_for_cell=wait_for_cell@entry=0x0, wait_proc=wait_
proc@entry=0x0, just_wait_proc=0) at process.c:5695
leave = false
process_skipped = <optimized out>
wrapped = <optimized out>
channel_start = <optimized out>
child_fd = <optimized out>
last_read_channel = 31
channel = <optimized out>
nfds = <optimized out>
Available = {fds_bits = {3128957144, 0 <repeats 15 times>}}
Writeok = {fds_bits = {0 <repeats 16 times>}}
check_write = true
check_delay = <optimized out>
no_avail = false
xerrno = 11
proc = <optimized out>
timeout = {tv_sec = 0, tv_nsec = 53672081}
end_time = {tv_sec = 2, tv_nsec = 140169898299554}
timer_delay = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
got_output_end_time = {tv_sec = 1648859560, tv_nsec = 616005816}
wait = FOREVER
got_some_output = -1
prev_wait_proc_nbytes_read = 0
retry_for_async = <optimized out>
now = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
#46 0x0000556b385420cc in kbd_buffer_get_event (end_time=0x0, used_mouse_menu=0x7ffe489409bb, kbp=<synthetic pointer>) at lisp.h:1155
do_display = <optimized out>
obj = <optimized out>
str = <optimized out>
c = 0x0
count = {bytes = <optimized out>}
save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
kb = <optimized out>
nextevt = <optimized out>
frame = <optimized out>
terminal = <optimized out>
events =
{0xffffffe2, 0x1, 0x556b38ac4d60 <mpz>, 0x556b38ac4d60 <mpz>, 0x1, 0x7f7bd8e4b5e2 <__gmpz_fdiv_q_ui+98>, 0x7ffe48940530, 0xe8d4a51000, 0x0, 0x556b
3855d658 <mpz_to_intmax+24>, 0x7735940, 0x0, 0x556b3d890c55, 0x556b3863a516 <lisp_to_timespec+310>, 0x0, 0xe615180648e71f00}
n = 0
#47 read_event_from_main_queue (used_mouse_menu=0x7ffe489409bb, local_getcjmp=0x7ffe48940720, end_time=0x0) at keyboard.c:2230
c = 0x0
count = {bytes = <optimized out>}
save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
kb = <optimized out>
nextevt = <optimized out>
frame = <optimized out>
terminal = <optimized out>
events =
{0xffffffe2, 0x1, 0x556b38ac4d60 <mpz>, 0x556b38ac4d60 <mpz>, 0x1, 0x7f7bd8e4b5e2 <__gmpz_fdiv_q_ui+98>, 0x7ffe48940530, 0xe8d4a51000, 0x0, 0x556b
3855d658 <mpz_to_intmax+24>, 0x7735940, 0x0, 0x556b3d890c55, 0x556b3863a516 <lisp_to_timespec+310>, 0x0, 0xe615180648e71f00}
n = 0
#48 read_decoded_event_from_main_queue (end_time=0x0, local_getcjmp=0x7ffe48940720, prev_event=0x0, used_mouse_menu=0x7ffe489409bb) at keyboard.c:2294
nextevt = <optimized out>
frame = <optimized out>
terminal = <optimized out>
events =
{0xffffffe2, 0x1, 0x556b38ac4d60 <mpz>, 0x556b38ac4d60 <mpz>, 0x1, 0x7f7bd8e4b5e2 <__gmpz_fdiv_q_ui+98>, 0x7ffe48940530, 0xe8d4a51000, 0x0, 0x556b
3855d658 <mpz_to_intmax+24>, 0x7735940, 0x0, 0x556b3d890c55, 0x556b3863a516 <lisp_to_timespec+310>, 0x0, 0xe615180648e71f00}
n = 0
#49 0x0000556b3854919f in read_char (commandflag=1, map=0x556b3ba3c083, prev_event=0x0, used_mouse_menu=0x7ffe489409bb, end_time=0x0) at keyboard.c:2923
c = <optimized out>
local_getcjmp =
{{__jmpbuf = {0, -4895500374767776984, 2864, 93919082997733, 0, 93919050449027, 4896307181911821096, 1646572476972288808}, __mask_was_saved
= 0, __saved_mask = {__val = {16579184018506325760, 0, 93918996393848, 96, 0, 0, 93919274685501, 35280, 93918995445234, 93919274685501, 93919052362800, 1, 9
3918995366673, 93919052345907, 93918994974232, 93919000722016}}}}
save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
tem = <optimized out>
save = <optimized out>
previous_echo_area_message = 0x0
also_record = 0x0
reread = false
recorded = false
polling_stopped_here = true
orig_kboard = 0x556b3b04cb80
#50 0x0000556b3854a848 in read_key_sequence
(keybuf=<optimized out>, prompt=0x0, dont_downcase_last=<optimized out>, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=<optim
ized out>) at keyboard.c:9863
interrupted_kboard = 0x556b3b04cb80
interrupted_frame = 0x556b3d9467e0
key = <optimized out>
used_mouse_menu = false
echo_local_start = 0
last_real_key_start = 0
keys_local_start = 0
new_binding = <optimized out>
t = 0
echo_start = 0
keys_start = 0
current_binding = 0x556b3ba3c083
first_unbound = 31
mock_input = 0
used_mouse_menu_history = {false <repeats 30 times>}
fkey = {parent = 0x556b3aef4283, map = 0x556b3aef4283, start = 0, end = 0}
keytran = {parent = 0x7f7bd361f71b, map = 0x7f7bd361f71b, start = 0, end = 0}
indec = {parent = 0x556b3aef4293, map = 0x556b3aef4293, start = 0, end = 0}
shift_translated = false
delayed_switch_frame = 0x0
original_uppercase = 0x0
original_uppercase_position = -1
dummyflag = false
fake_prefixed_keys = 0x0
first_event = 0x0
second_event = <optimized out>
#51 0x0000556b3854c4bb in command_loop_1 () at lisp.h:1155
cmd = <optimized out>
keybuf =
{0xba, 0x18a, 0x1de, 0xe615180648e71f00, 0x3, 0x556b386aef78, 0x60, 0x0, 0x0, 0x7f7bd35236c5, 0xe190, 0x556b385c75f2 <unbind_to+306>, 0x0, 0x556b3
85cc418 <call3+56>, 0xb, 0xe190, 0x30, 0x7f7bd35236c5, 0x556b38acfa60 <lispsym>, 0x0, 0x556b3f9ff1e3, 0x60, 0x7ffe48940ba0, 0x0, 0x0, 0x556b3853fab6 <cmd_er
ror+390>, 0x8e00, 0x556b385c75f2 <unbind_to+306>, 0x0, 0xe615180648e71f00}
i = <optimized out>
prev_modiff = 5800
prev_buffer = 0x556b49015438
#52 0x0000556b385c68d7 in internal_condition_case
(bfun=bfun@entry=0x556b3854c280 <command_loop_1>, handlers=handlers@entry=0x90, hfun=hfun@entry=0x556b3853f930 <cmd_error>) at eval.c:1446
val = <optimized out>
c = 0x556b39f6d2d0
#53 0x0000556b385389ea in command_loop_2 (handlers=handlers@entry=0x90) at keyboard.c:1137
val = <optimized out>
#54 0x0000556b385c6819 in internal_catch (tag=tag@entry=0xf060, func=func@entry=0x556b385389c0 <command_loop_2>, arg=arg@entry=0x90) at eval.c:1176
val = <optimized out>
c = 0x556b39e33600
#55 0x0000556b38538986 in command_loop () at lisp.h:1155
#56 0x0000556b3853f4e3 in recursive_edit_1 () at keyboard.c:724
val = <optimized out>
#57 0x0000556b3853f870 in Frecursive_edit () at keyboard.c:807
buffer = <optimized out>
#58 0x0000556b384588c1 in main (argc=<optimized out>, argv=<optimized out>) at emacs.c:2434
stack_bottom_variable = 0x1d1
no_loadup = false
junk = 0x0
dname_arg = 0x7ffe4894247b "2"
ch_to_dir = 0x0
original_pwd = <optimized out>
dump_mode = <optimized out>
skip_args = 1
temacs = 0x0
attempt_load_pdump = <optimized out>
rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
lc_all = <optimized out>
sockfd = -1
module_assertions = <optimized out>
(gdb) bt full > tmp/bt_full.txt
A syntax error in _expression_, near `> tmp/bt_full.txt'.
(gdb)

From:	James Ferguson
Subject:	bug#54661: 29.0.50; Emacs SEGV in get_glyph_face_and_encoding
Date:	Thu, 31 Mar 2022 17:19:03 -0400

bug#54661: 29.0.50; Emacs SEGV in get_glyph_face_and_encoding