bug#3714: 23.1.50; [NS/Cocoa] Crash when hovering mode-line-inactive face

[Ian Eure]

Emacs crashes when the mouse hovers the `mode-line-inactive' face in  
list-faces-display.

Steps to reproduce:
 1. Run /Application/Emacs.app/Contents/MacOS/Emacs -Q
 2. M-x list-faces-display RET
 3. Scroll down until mode-line-inactive is visible.
 4. Hover the sample text on the right with the mouse pointer.
 5. Emacs crashes.

The problem seems to be that the ns_lookup_indexed_color call in  
nsterm.m:2725 returns a bad pointer.

Backtrace:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0xc0000003
0x94f8f684 in objc_msgSend ()
(gdb) bt full
#0  0x94f8f684 in objc_msgSend ()
No symbol table info available.
#1  0x001ef5b5 in ns_draw_box (r={origin = {x = 264, y = 336}, size =  
{width = 308, height = 15}}, thickness=0, col=0xc0000003, left_p=1  
'\001', right_p=1 '\001') at nsterm.m:2571
        s = {
  origin = {
    x = 264,
    y = 336
  },
  size = {
    width = 308,
    height = 15
  }
}
#2  0x001efe13 in ns_dumpglyphs_box_or_relief (s=0xbfffd950) at  
nsterm.m:2724
        right_x = 571
        last_x = 572
        left_p = 1 '\001'
        right_p = 1 '\001'
        last_glyph = (struct glyph *) 0x21a47e0
        r = {
  origin = {
    x = 264,
    y = 336
  },
  size = {
    width = 308,
    height = 15
  }
}
        thickness = 0
        face = (struct face *) 0x1684b80
#3  0x001f135e in ns_draw_glyph_string (s=0xbfffd950) at nsterm.m:3027
        r = {{
    origin = {
      x = 12,
      y = 336
    },
    size = {
      width = 560,
      height = 15
    }
  }, {
    origin = {
      x = 1.2879323e-38,
      y = 0
    },
    size = {
      width = -1.99880123,
      height = 0
    }
  }}
        n = 1
        box_drawn_p = 0 '\0'
#4  0x0004e06c in draw_glyphs (w=0x162c1d0, x=573, row=0x212afc8,  
area=TEXT_AREA, start=36, end=80, hl=DRAW_MOUSE_FACE, overlaps=0) at  
xdisp.c:20451
        head = (struct glyph_string *) 0xbfffd950
        tail = (struct glyph_string *) 0xbfffd950
        s = (struct glyph_string *) 0xbfffd950
        clip_head = (struct glyph_string *) 0x0
        clip_tail = (struct glyph_string *) 0x0
        i = 80
        j = 204
        x_reached = 573
        last_x = 572
        area_left = 12
        f = (struct frame *) 0x8c3e50
#5  0x00054ea7 in show_mouse_face (dpyinfo=0x837450,  
draw=DRAW_MOUSE_FACE) at xdisp.c:22746
        start_hpos = 36
        end_hpos = 80
        start_x = 252
        phys_cursor_on_p = 1
        row = (struct glyph_row *) 0x212afc8
        first = (struct glyph_row *) 0x212afc8
        last = (struct glyph_row *) 0x212afc8
        w = (struct window *) 0x162c1d0
        f = (struct frame *) 0x8c3e50
#6  0x0005581a in mouse_face_from_buffer_pos (window=23249364,  
dpyinfo=0x837450, mouse_charpos=4047, start_charpos=4025,  
end_charpos=4078, before_string=25165833, after_string=25165833,  
display_string=25165833) at xdisp.c:23011
        w = (struct window *) 0x162c1d0
        first = (struct glyph_row *) 0x212ae00
        row = (struct glyph_row *) 0x212afc8
        glyph = (struct glyph *) 0x21a4800
        end = (struct glyph *) 0x21a4800
        ignore = 4048
        x = 561
#7  0x00057ca9 in note_mouse_highlight (f=0x8c3e50, x=419, y=63) at  
xdisp.c:23855
        before = 32200
        after = 32624
        before_string = 25165833
        after_string = 25165833
        buffer = 23528644
        display_string = 25165833
        hpos = 58
        i = -1
        dx = 2
        overlay_vec = (Lisp_Object *) 0xbfffddb0
        noverlays = 0
        obuf = (struct buffer *) 0x601678
        obegv = 1
        same_region = 0
        dy = 14
        area = 1
        position = 32376
        vpos = 3
        ozv = 5429
        pos = 4047
        glyph = (struct glyph *) 0x21a4540
        object = 23528644
        mouse_face = 25649105
        overlay = 25165833
        dpyinfo = (Display_Info *) 0x837450
        part = ON_TEXT
        window = 23249364
        w = (struct window *) 0x162c1d0
        cursor = (Cursor) 0x0
        pointer = 25165833
        b = (struct buffer *) 0x16704c0
#8  0x001eca9d in note_mouse_movement (frame=0x8c3e50, x=421, y=350)  
at nsterm.m:1765
No locals.
#9  0x001f76a4 in -[EmacsView mouseMoved:] (self=0x1605b00,  
_cmd=0x94faf684, e=0x16ce160) at nsterm.m:4942
        dpyinfo = (struct ns_display_info *) 0x837450
        frame = -1830347271
#10 0x92e71d6d in -[NSWindow sendEvent:] ()
No symbol table info available.
#11 0x92e3e3c5 in -[NSApplication sendEvent:] ()
No symbol table info available.
#12 0x001f4771 in -[EmacsApp sendEvent:] (self=0x81f980,  
_cmd=0x94f954b8, theEvent=0x16ce160) at nsterm.m:4098
        type = 5
        window = (NSWindow *) 0x161a7b0
        objc_super = {
  self = 0x81f980,
  cls = 0xa0449ea0
}
#13 0x92d9b62f in -[NSApplication run] ()
No symbol table info available.
#14 0x001f1b60 in ns_read_socket (terminal=0x837a50, expected=1,  
hold_quit=0xbfffe56c) at nsterm.m:3229
        ev = {
  kind = NO_EVENT,
  code = 0,
  part = scroll_bar_above_handle,
  modifiers = 0,
  x = 0,
  y = 0,
  timestamp = 0,
  padding = {0x0, 0x0},
  frame_or_window = 0,
  arg = 0
}
        nevents = -1790782963
#15 0x000d3a30 in read_avail_input (expected=1) at keyboard.c:7093
        nr = 50343304
        hold_quit = {
  kind = NO_EVENT,
  code = 0,
  part = scroll_bar_above_handle,
  modifiers = 0,
  x = 0,
  y = 0,
  timestamp = 0,
  padding = {0x0, 0x0},
  frame_or_window = 0,
  arg = 0
}
        next = (struct terminal *) 0x0
        nread = 0
        err = 0
        t = (struct terminal *) 0x837a50
#16 0x000d387a in gobble_input (expected=1) at keyboard.c:7004
        mask = 0
#17 0x001f1e25 in ns_select (nfds=1, readfds=0xbfffe878, writefds=0x0,  
exceptfds=0x0, timeout=0xbfffe7f0) at nsterm.m:3302
        result = 0
        time = 29.999998999999999
        ev = (NSEvent *) 0xbfffe658
#18 0x001c57bc in wait_reading_process_output (time_limit=30,  
microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=25165833,  
wait_proc=0x0, just_wait_proc=0) at process.c:4828
        timeout_reduced_for_timers = 0
        channel = 3
        nfds = 204
        Available = {
  fds_bits = {0 <repeats 32 times>}
}
        Connecting = {
  fds_bits = {0 <repeats 32 times>}
}
        check_connect = 0
        check_delay = 0
        no_avail = 0
        xerrno = 0
        proc = 0
        timeout = {
  tv_sec = 29,
  tv_usec = 999999
}
        end_time = {
  tv_sec = 1246297824,
  tv_usec = 508699
}
        wait_channel = -1
        got_some_input = 0
        count = 2
#19 0x0000f606 in sit_for (timeout=240, reading=1, do_display=1) at  
dispnew.c:6644
        sec = 30
        usec = 0
#20 0x000cc34d in read_char (commandflag=1, nmaps=2, maps=0xbfffebd0,  
prev_event=25165833, used_mouse_menu=0xbfffed78, end_time=0x0) at  
keyboard.c:2950
        tem0 = 25165833
        timeout = 30
        delay_level = 4
        buffer_size = 1
        c = 25165833
        count = -1073747112
        jmpcount = 2
	local_getcjmp = {895, 114, 8099, 832972, 976980, -1073746448, 2,  
8133797, -1073747064, -1073747504, 31, 658, 834847, 23, 31, 31,  
1310720, 1900599}
        save_jump = {0 <repeats 18 times>}
        key_already_recorded = 0
        tem = 25165833
        save = 25165833
        previous_echo_area_message = 25165833
        also_record = 25165833
        reread = 0
        gcpro1 = {
  next = 0xbfffea68,
  var = 0x1da126,
  nvars = 8047189
}
        gcpro2 = {
  next = 0x18490fc,
  var = 0x1da134,
  nvars = 1398200
}
        polling_stopped_here = 0
        orig_kboard = (struct kboard *) 0x837b20
#21 0x000d7e4a in read_key_sequence (keybuf=0xbfffefa4, bufsize=30,  
prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1,  
fix_current_buffer=1) at keyboard.c:9460
        interrupted_kboard = (KBOARD *) 0x837b20
        interrupted_frame = (struct frame *) 0x8c3e50
        key = 372375
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 25165833
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 2
        nmaps_allocated = 2
        defs = (Lisp_Object * volatile) 0xbfffebb0
        submaps = (Lisp_Object * volatile) 0xbfffebd0
        orig_local_map = 8111925
        orig_keymap = 25165833
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 7488085,
  map = 7488085,
  start = 0,
  end = 0
}
        keytran = {
  parent = 4796285,
  map = 4796285,
  start = 0,
  end = 0
}
        indec = {
  parent = 7488141,
  map = 7488141,
  start = 0,
  end = 0
}
        shift_translated = 0
        delayed_switch_frame = 25165833
        original_uppercase = -1073746408
        original_uppercase_position = -1
        dummyflag = 0
        starting_buffer = (struct buffer *) 0x601678
        fake_prefixed_keys = 25165833
        gcpro1 = {
  next = 0x1a90661,
  var = 0x1800009,
  nvars = 6299772
}
#22 0x000c87a0 in command_loop_1 () at keyboard.c:1642
        cmd = 27854433
        lose = 6484
        nonundocount = 0
	keybuf = {25196513, 8109221, -1834555244, 4127024, -1754265160,  
-1880941672, -1880949728, -1073745796, 152, 0, -1797177049, 163,  
1179650, 253952, -1880941408, 230, 149, 41910564, -1797141688, 164, 9,  
0, -1073745904, -1073746208, 0, 524288, 25165833, 25598081, 2605860,  
4860453}
        i = 2
        prev_modiff = 10
        prev_buffer = (struct buffer *) 0x601678
        already_adjusted = 0
#23 0x00166b4c in internal_condition_case (bfun=0xc82f2  
<command_loop_1>, handlers=25205425, hfun=0xc79fb <cmd_error>) at  
eval.c:1512
        val = 4860453
        c = {
  tag = 25165833,
  val = 25165833,
  next = 0xbffff16c,
  gcpro = 0x0,
  jmp = {-1073806465, 76, 8098, 1468971, 33629184, 1467413, 0, 0,  
-1073745624, -1073745808, 31, 658, 1469137, -1797193705, 31, 31, 0, 55},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 0,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        h = {
  handler = 25205425,
  var = 25165833,
  chosen_clause = -1881116971,
  tag = 0xbffff0a8,
  next = 0x0
}
#24 0x000c7f22 in command_loop_2 () at keyboard.c:1359
        val = -1073741821
#25 0x001664dd in internal_catch (tag=25201545, func=0xc7eed  
<command_loop_2>, arg=25165833) at eval.c:1248
        c = {
  tag = 25201545,
  val = 25165833,
  next = 0x0,
  gcpro = 0x0,
  jmp = {895, 0, 8098, 1467413, -1797177195, 0, 0, 0, -1073745432,  
-1073745584, 25296927, 662, 1467598, 2228247, 25165855, -1073807329,  
25296896, 25296951},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 0,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
#26 0x000c7eab in command_loop () at keyboard.c:1338
No locals.
#27 0x000c747f in recursive_edit_1 () at keyboard.c:953
        count = 1
        val = 1484089
#28 0x000c7688 in Frecursive_edit () at keyboard.c:1015
        count = 0
        buffer = 25165833
#29 0x000c598d in main (argc=2, argv=0xbffff47c) at emacs.c:1853
        dummy = 0
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {
  rlim_cur = 8388608,
  rlim_max = 67104768
}
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
	dname_arg2 = "|???\002\000\000\000X???r\030?? 
\000\020\000\000\000\000\000\000\002\000\000\000|???????\030???", '\0'  
<repeats 39 times>
(gdb)

In GNU Emacs 23.1.50.1 (i386-apple-darwin9.7.0, NS apple-appkit-949.46)
 of 2009-06-29 on neutron.local
Windowing system distributor `Apple', version 10.3.949
configured using `configure  '--with-ns''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  value of $XMODIFIERS: nil
  locale-coding-system: nil
  default-enable-multibyte-characters: t

Major mode: ERC

Minor modes in effect:
  diff-auto-refine-mode: t
  erc-track-mode: t
  erc-track-minor-mode: t
  erc-spelling-mode: t
  flyspell-mode: t
  erc-ring-mode: t
  erc-pcomplete-mode: t
  erc-netsplit-mode: t
  erc-match-mode: t
  erc-button-mode: t
  erc-fill-mode: t
  erc-autojoin-mode: t
  erc-irccontrols-mode: t
  erc-noncommands-mode: t
  erc-readonly-mode: t
  erc-scrolltobottom-mode: t
  test-case-global-mode: t
  which-function-mode: t
  shell-dirtrack-mode: t
  ime-bindings: t
  show-paren-mode: t
  recentf-mode: t
  iswitchb-mode: t
  cua-mode: t
  auto-insert-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  size-indication-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t
  abbrev-mode: t

Recent input:
M-x r e p <tab> o r <tab> <tab> b <tab>
<return>

Recent messages:
Mark set [2 times]
Quit [2 times]
call-interactively: Command attempted to use minibuffer while in  
minibuffer
Quit [2 times]
Undo!
Making completion list...
Quit [2 times]
Undo!
Mark set
Making completion list... [2 times]