23.0.60; SEGV in font_score()

[James Cloos]

Please write in English if possible, because the Emacs maintainers
usually do not have translators to read other languages for them.

Your bug report will be posted to the address@hidden mailing list.

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

Since upgrading from an early May CVS tip to this past weekend's tip
I've had Emacs crash four times.  I attached gdb and caught the most
recent one.  The backtrace is:

[Switching to Thread 0xb73a96c0 (LWP 13397)]
0x081847bb in font_score ()
(gdb) where
#0  0x081847bb in font_score ()
#1  0x08187015 in font_sort_entites ()
#2  0x08189724 in font_find_for_lface ()
#3  0x080f0abf in fontset_find_font ()
#4  0x080f0d7f in fontset_font ()
#5  0x080f0efb in face_for_char ()
#6  0x08073fba in face_before_or_after_it_pos ()
#7  0x0807891d in get_next_display_element ()
#8  0x08079c2f in display_string ()
#9  0x0807ff6d in display_mode_element ()
#10 0x08080c39 in display_mode_element ()
#11 0x08080c39 in display_mode_element ()
#12 0x080812da in display_mode_line ()
#13 0x08081541 in display_mode_lines ()
#14 0x08087e04 in redisplay_window ()
#15 0x0808a0a3 in redisplay_window_0 ()
#16 0x08174908 in internal_condition_case_1 ()
#17 0x08075fe7 in redisplay_windows ()
#18 0x0c486734 in ?? ()
#19 0x08367625 in ?? ()
#20 0x080666e0 in ?? ()
#21 0x000022c8 in ?? ()
#22 0x0adc1748 in ?? ()
#23 0xbfc610b8 in ?? ()
#24 0x08075f9a in redisplay_windows ()
#25 0x00000000 in ?? ()

(As you can see, my default compile is with -O2 and no -g options.)

Every crash has occured when displaying gnus' *Article* buffer with a
new message.  This last time the only difference from the default font
choices is the resource 'emacs.font: DejaVu Sans Mono:pixelsize=14'.

The checkout has revision 1.33 of src/font.c.  Nothing stands out to me
as relevant in the diff between 1.33 and 1.38 as seen in viewvc.

If Emacs crashed, and you have the Emacs process in the gdb debugger,
please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
If you would like to further debug the crash, please read the file
/usr/share/emacs/23.0.60/etc/DEBUG for instructions.

I did have gdb generate a core, but the bt info from the core is less
complete even than what I pasted above....

In GNU Emacs 23.0.60.2 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2008-06-01 on lugabout
Windowing system distributor `The X.Org Foundation', version 11.0.10599001
configured using `configure  '--prefix=/usr' '--host=i686-pc-linux-gnu' 
'--mandir=/usr/share/man' '--infodir=/usr/share/info' '--datadir=/usr/share' 
'--sysconfdir=/etc' '--localstatedir=/var/lib' '--program-suffix=-emacs-23' 
'--infodir=/usr/share/info/emacs-23' '--without-carbon' '--with-sound' 
'--with-x' '--with-toolkit-scroll-bars' '--with-gif' '--with-jpeg' '--with-png' 
'--with-rsvg' '--with-tiff' '--with-xpm' '--enable-font-backend' 
'--with-freetype' '--with-xft' '--with-libotf' '--with-m17n-flt' 
'--with-x-toolkit=athena' '--without-hesiod' '--with-kerberos' 
'--with-kerberos5' '--with-gpm' '--with-dbus' '--build=i686-pc-linux-gnu' 
'build_alias=i686-pc-linux-gnu' 'host_alias=i686-pc-linux-gnu' 
'CC=i686-pc-linux-gnu-gcc' 'CFLAGS=-march=pentium3 -O2 -Wno-error' 'LDFLAGS= 
-Wl,--as-needed ''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: C
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: C
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  show-paren-mode: t
  display-time-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t

Recent input:
M-x r e p o r <tab> <return>

Recent messages:
Loading /usr/share/emacs/site-lisp/site-gentoo.d/51boxquote-gentoo.el 
(source)...done
Loading /usr/share/emacs/site-lisp/site-gentoo.d/60auctex-gentoo.el 
(source)...done
Loading /usr/share/emacs/site-lisp/70emacs-w3m-gentoo.el (source)...done
Loading /usr/share/emacs/site-lisp/site-gentoo.d/70ngnus-gentoo.el 
(source)...done
Loading /usr/share/emacs/site-lisp/site-gentoo.d/70svn-gentoo.el (source)...done
Loading /usr/share/emacs/site-lisp/70xrdb-mode-gentoo.el (source)...done
Loading delsel...done
Loading time...done
Loading paren...done
For information about GNU Emacs and the GNU system, type C-h C-a.