bug#65198: 29.1; Emacs29.1 crash in function face_for_font

[Eli Zaretskii]

> From: 张云峰 <zhangyunfeng0101@gmail.com>
> Date: Thu, 10 Aug 2023 17:57:20 +0800
> 
> ;;;;; GDB INFO ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; 
> 
> Thread 1 "emacs" received signal SIGSEGV, Segmentation fault. 
> 0x00005555556859b8 in face_for_font (f=0x555561746d40, 
> font_object=0x555558465ec5,
> base_face=base_face@entry=0x0) at xfaces.c:4931 
> 4931 base_face = base_face->ascii_face; 
> (gdb) bt 
> #0 0x00005555556859b8 in face_for_font (f=0x555561746d40, 
> font_object=0x555558465ec5,
> base_face=base_face@entry=0x0) at xfaces.c:4931 
> #1 0x00005555555ee682 in get_next_display_element 
> (it=it@entry=0x7fffffff6c90) at xdisp.c:8322 
> #2 0x00005555555eacb0 in move_it_in_display_line_to 
> (it=it@entry=0x7fffffff6c90,
> to_charpos=to_charpos@entry=412, to_x=to_x@entry=2147483647, 
> op=op@entry=(MOVE_TO_X
> | MOVE_TO_POS)) 
> at xdisp.c:9829 
> #3 0x00005555555f002a in move_it_to (it=0x7fffffff6c90, to_charpos=412, 
> to_x=<optimized out>,
> to_y=<optimized out>, to_vpos=<optimized out>, op=11) at xdisp.c:10500 
> #4 0x0000555555604e4e in window_text_pixel_size 
> (window=<optimized out>, from=<optimized out>, to=<optimized out>, 
> x_limit=0x1ce2,
> y_limit=<optimized out>, mode_lines=0x0, ignore_line_at_end=0x0) at 
> xdisp.c:11455 
> #5 0x0000555555605ae6 in Fwindow_text_pixel_size (window=0x555561746f95, 
> from=0x0,
> to=0x0, x_limit=0x1ce2, y_limit=0xaf2, mode_lines=0x0, 
> ignore_line_at_end=0x0) at xdisp.c:11629 
> #6 0x0000555555771442 in funcall_subr (subr=0x555555d0e5a0 
> <Swindow_text_pixel_size>,
> numargs=numargs@entry=5, args=args@entry=0x7ffff0bff1f0) at eval.c:3046 

Thanks.  Any chance of a recipe to reproduce this crash?

The backtrace indicates that the code which crashed was called from a
timer function -- any idea what timer was that?