About a crash in copy_font_spec

[martin rudalics]

After boostrapping one of my patched trunk i686-pc-mingw32 Emacsen, it
reliably crashes with the following backtrace.


#0  terminate_due_to_signal (sig=22, backtrace_limit=2147483647) at emacs.c:350
#1  0x0115936a in die (msg=0x148c86c "CONSP (((suppress_checking || ((((enum Lisp_Type) ((tail) & ~(1 ? - (1 << 3) : 
(2147483647 >> (3 - 1))))) == Lisp_Cons)) ? (void) 0 : die (\"CONSP (tail)\", \"font.c\", 3895)), (struct 
Lisp_Cons *) ((void"..., file=0x148b2d8 "font.c", line=3895) at alloc.c:6670
#2  0x011920b2 in copy_font_spec (font=65038613) at font.c:3895
#3  0x0118f57a in font_clear_prop (attrs=0x82ca9c, prop=FONT_FAMILY_INDEX) at 
font.c:3000
#4  0x010d8c41 in merge_face_vectors (f=0x3e06380, from=0x82ca54, to=0x82ca9c, 
named_merge_points=0x0) at xfaces.c:2223
#5  0x010dfba9 in realize_named_face (f=0x3e06380, symbol=56234034, id=1) at 
xfaces.c:5385
#6  0x010df1df in realize_basic_faces (f=0x3e06380) at xfaces.c:5204
#7  0x010db733 in update_face_from_frame_parameter (f=0x3e06380, 
param=56224010, new_value=63853857) at xfaces.c:3313
#8  0x011e1587 in x_set_background_color (f=0x3e06380, arg=63853857, 
oldval=56557009) at w32fns.c:1295
#9  0x01016869 in x_set_frame_parameters (f=0x3e06380, alist=56191002) at 
frame.c:2760
#10 0x01015aea in Fmodify_frame_parameters (frame=65037189, alist=64058070) at 
frame.c:2321
#11 0x011e9e12 in x_create_tip_frame (dpyinfo=0x151ae20, parms=64440630, 
text=63853921) at w32fns.c:5772
#12 0x011ea5b1 in Fx_show_tip (string=63853921, frame=56936605, parms=64440590, 
timeout=40, dx=20, dy=80) at w32fns.c:6015
#13 0x011771bf in Ffuncall (nargs=7, args=0x82cef4) at eval.c:2810
#14 0x011b7333 in exec_byte_code (bytestr=20151721, vector=20151749, 
maxdepth=28, args_template=56191002, nargs=0, args=0x0) at bytecode.c:919
#15 0x011b6794 in Fbyte_code (bytestr=20151721, vector=20151749, maxdepth=28) 
at bytecode.c:482
#16 0x01175d3d in eval_sub (form=20151710) at eval.c:2165
#17 0x01173e29 in internal_lisp_condition_case (var=56245418, 
bodyform=20151710, handlers=20151838) at eval.c:1300
#18 0x011b8279 in exec_byte_code (bytestr=20151657, vector=20151677, 
maxdepth=12, args_template=56191002, nargs=0, args=0x0) at bytecode.c:1169
#19 0x01177c37 in funcall_lambda (fun=20151613, nargs=2, arg_vector=0x1337d7d) 
at eval.c:3023
#20 0x011772cd in Ffuncall (nargs=3, args=0x82d5f4) at eval.c:2838
#21 0x011b7333 in exec_byte_code (bytestr=20152889, vector=20152909, 
maxdepth=12, args_template=56191002, nargs=0, args=0x0) at bytecode.c:919
#22 0x01177c37 in funcall_lambda (fun=20152861, nargs=1, arg_vector=0x133824d) 
at eval.c:3023
#23 0x011772cd in Ffuncall (nargs=2, args=0x82da28) at eval.c:2838
#24 0x01176a40 in run_hook_with_args (nargs=2, args=0x82da28, funcall=0x1176d61 
<Ffuncall>) at eval.c:2525
#25 0x0117669c in Frun_hook_with_args_until_success (nargs=2, args=0x82da28) at 
eval.c:2407
#26 0x01176f85 in Ffuncall (nargs=3, args=0x82da24) at eval.c:2770
#27 0x011b7333 in exec_byte_code (bytestr=19376745, vector=20151469, 
maxdepth=12, args_template=56191002, nargs=0, args=0x0) at bytecode.c:919
#28 0x01177c37 in funcall_lambda (fun=20151437, nargs=1, arg_vector=0x1337cad) 
at eval.c:3023
#29 0x011772cd in Ffuncall (nargs=2, args=0x82de38) at eval.c:2838
#30 0x011761ef in Fapply (nargs=2, args=0x82de38) at eval.c:2275
#31 0x01176f85 in Ffuncall (nargs=3, args=0x82de34) at eval.c:2770
#32 0x011b7333 in exec_byte_code (bytestr=19940305, vector=19940333, 
maxdepth=16, args_template=56191002, nargs=0, args=0x0) at bytecode.c:919
#33 0x011b6794 in Fbyte_code (bytestr=19940305, vector=19940333, maxdepth=16) 
at bytecode.c:482
#34 0x01175d3d in eval_sub (form=19940294) at eval.c:2165
#35 0x01173e29 in internal_lisp_condition_case (var=58384506, 
bodyform=19940294, handlers=19940358) at eval.c:1300
#36 0x011b8279 in exec_byte_code (bytestr=19940153, vector=19940173, 
maxdepth=20, args_template=56191002, nargs=0, args=0x0) at bytecode.c:1169
#37 0x01177c37 in funcall_lambda (fun=19940133, nargs=1, arg_vector=0x130434d) 
at eval.c:3023
#38 0x011772cd in Ffuncall (nargs=2, args=0x82e548) at eval.c:2838
#39 0x01176b80 in call1 (fn=56237058, arg1=64807197) at eval.c:2588
#40 0x010f0cdd in timer_check_2 (timers=56191002, idle_timers=64440494) at 
keyboard.c:4519
#41 0x010f0dc8 in timer_check () at keyboard.c:4586
#42 0x010eedcd in readable_events (flags=1) at keyboard.c:3453
#43 0x010f4f57 in get_input_pending (flags=1) at keyboard.c:6763
#44 0x010fb2bd in detect_input_pending_run_timers (do_display=false) at 
keyboard.c:9881
#45 0x010ed14f in read_char (commandflag=0, map=56191002, prev_event=56191026, 
used_mouse_menu=0x0, end_time=0x0) at keyboard.c:2827
#46 0x011a00a5 in read_filtered_event (no_switch_frame=false, 
ascii_required=false, error_nonascii=false, input_method=false, 
seconds=56191002) at lread.c:632
#47 0x011a032d in Fread_event (prompt=56191002, inherit_input_method=56191002, 
seconds=56191002) at lread.c:744
#48 0x011770ee in Ffuncall (nargs=1, args=0x82e9a8) at eval.c:2796
#49 0x011b7333 in exec_byte_code (bytestr=19920521, vector=64148301, 
maxdepth=28, args_template=0, nargs=0, args=0x82ece4) at bytecode.c:919
#50 0x01177873 in funcall_lambda (fun=64148429, nargs=0, arg_vector=0x82ece4) 
at eval.c:2957
#51 0x011772cd in Ffuncall (nargs=1, args=0x82ece0) at eval.c:2838
#52 0x01175bdf in eval_sub (form=64197998) at eval.c:2131
#53 0x01171870 in Fprogn (body=64198006) at eval.c:447
#54 0x010e9d7c in Ftrack_mouse (args=64198006) at keyboard.c:1265
#55 0x01175a50 in eval_sub (form=64198014) at eval.c:2107
#56 0x0117558f in Feval (form=64198014, lexical=56191002) at eval.c:1977
#57 0x011770bf in Ffuncall (nargs=2, args=0x82f030) at eval.c:2792
#58 0x011b7333 in exec_byte_code (bytestr=19920313, vector=19920333, 
maxdepth=136, args_template=2056, nargs=2, args=0x82f3a4) at bytecode.c:919
#59 0x01177873 in funcall_lambda (fun=19920293, nargs=2, arg_vector=0x82f39c) 
at eval.c:2957
#60 0x011772cd in Ffuncall (nargs=3, args=0x82f398) at eval.c:2838
#61 0x011b7333 in exec_byte_code (bytestr=19318521, vector=19920725, 
maxdepth=16, args_template=1028, nargs=1, args=0x82f718) at bytecode.c:919
#62 0x01177873 in funcall_lambda (fun=19920693, nargs=1, arg_vector=0x82f714) 
at eval.c:2957
#63 0x011772cd in Ffuncall (nargs=2, args=0x82f710) at eval.c:2838
#64 0x01170901 in Fcall_interactively (function=60891786, record_flag=56191002, 
keys=56238085) at callint.c:836
#65 0x011770ee in Ffuncall (nargs=4, args=0x82f94c) at eval.c:2796
#66 0x011b7333 in exec_byte_code (bytestr=19722009, vector=19722029, 
maxdepth=52, args_template=4100, nargs=1, args=0x82fc90) at bytecode.c:919
#67 0x01177873 in funcall_lambda (fun=19721989, nargs=1, arg_vector=0x82fc8c) 
at eval.c:2957
#68 0x011772cd in Ffuncall (nargs=2, args=0x82fc88) at eval.c:2838
#69 0x01176b80 in call1 (fn=56236874, arg1=60891786) at eval.c:2588
#70 0x010ea712 in command_loop_1 () at keyboard.c:1557
#71 0x01173f46 in internal_condition_case (bfun=0x10e9ee7 <command_loop_1>, 
handlers=56245418, hfun=0x10e9770 <cmd_error>) at eval.c:1331
#72 0x010e9b9c in command_loop_2 (ignore=56191002) at keyboard.c:1158
#73 0x01173509 in internal_catch (tag=56235322, func=0x10e9b78 
<command_loop_2>, arg=56191002) at eval.c:1097
#74 0x010e9b56 in command_loop () at keyboard.c:1137
#75 0x010e930d in recursive_edit_1 () at keyboard.c:776
#76 0x010e94c9 in Frecursive_edit () at keyboard.c:840
#77 0x010e7867 in main (argc=1, argv=0xa33fe0) at emacs.c:1581

Lisp Backtrace:
"x-show-tip" (0x82cef8)
"byte-code" (0x82d190)
"tooltip-show" (0x82d5f8)
"tooltip-help-tips" (0x82da2c)
"run-hook-with-args-until-success" (0x82da28)
"tooltip-timeout" (0x82de3c)
"apply" (0x82de38)
"byte-code" (0x82e0d0)
"timer-event-handler" (0x82e54c)
"read-event" (0x82e9ac)
0x3d2d3c8 PVEC_COMPILED
"funcall" (0x82ece0)
"track-mouse" (0x82eea4)
"eval" (0x82f034)
"mouse-drag-line" (0x82f39c)
"mouse-drag-mode-line" (0x82f714)
"call-interactively" (0x82f950)
"command-execute" (0x82fc8c)


Since the crash happens in an area completely unrelated to my changes, I
suppose it might be related to


revno: 114735
revision-id: address@hidden
parent: address@hidden
committer: Dmitry Antipov <address@hidden>
branch nick: trunk
timestamp: Mon 2013-10-21 18:11:25 +0400
message:
  Do not allow font caches to grow too large.
  * alloc.c (compact_font_cache_entry, compact_font_caches):
  New functions or stub if not HAVE_WINDOW_SYSTEM.
  (compact_undo_list): Factor out from Fgarbage_collect.
  Add comment.
  (mark_face_cache): Mark face font.  Move down to avoid
  extra prototypes.
  (mark_terminals): Do not mark font cache here.
  (Fgarbage_collect): Call compaction functions described
  above.  Adjust comment.


Can someone please enlighten me what might happen here?

Thanks in advance, martin