bug#65198: 29.1; Emacs29.1 crash in function face_for_font

[张云峰]

more clear GDB info:

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
0x0000555555618c06 in produce_glyphless_glyph (it=0x7fffffff67d0,
for_no_font=for_no_font@entry=false, acronym=acronym@entry=0x0) at
xdisp.c:31791
31791 font = face->font ? face->font : FRAME_FONT (it->f);
(gdb) bt
#0  0x0000555555618c06 in produce_glyphless_glyph (it=0x7fffffff67d0,
for_no_font=for_no_font@entry=false, acronym=acronym@entry=0x0) at
xdisp.c:31791
#1  0x000055555563f321 in gui_produce_glyphs (it=0x7fffffff67d0) at
xdisp.c:32639
#2  0x00005555556232e5 in move_it_in_display_line_to
(it=it@entry=0x7fffffff67d0, to_charpos=to_charpos@entry=382,
to_x=to_x@entry=2147483647, op=op@entry=(MOVE_TO_X | MOVE_TO_POS))
    at xdisp.c:9906
#3  0x000055555562859a in move_it_to (it=0x7fffffff67d0,
to_charpos=382, to_x=<optimized out>, to_y=<optimized out>,
to_vpos=<optimized out>, op=11) at xdisp.c:10505
#4  0x000055555563d3ae in window_text_pixel_size
    (window=<optimized out>, from=<optimized out>, to=<optimized out>,
x_limit=0x1c9a, y_limit=<optimized out>, mode_lines=0x0,
ignore_line_at_end=0x0) at xdisp.c:11460
#5  0x000055555563e046 in Fwindow_text_pixel_size
(window=0x555556296d25, from=0x0, to=0x0, x_limit=0x1c9a,
y_limit=0xc32, mode_lines=0x0, ignore_line_at_end=0x0) at
xdisp.c:11634
#6  0x00007fffe7dc07a8 in
F6669742d6672616d652d746f2d6275666665722d31_fit_frame_to_buffer_1_0 ()
    at 
/home/zayfen/github.com/emacs/src/../native-lisp/29.1.50-24bd8136/preloaded/window-0d1b8b93-6f4eee58.eln
#7  0x00005555557650c2 in funcall_subr (subr=0x7fffe8360178,
numargs=5, args=<optimized out>) at eval.c:3049
#8  0x0000555555761d93 in Ffuncall (nargs=6, args=0x7fffffff9570) at eval.c:2995
#9  0x0000555555765a3d in eval_sub (form=<optimized out>) at eval.c:2470
#10 0x0000555555767ddd in Fprogn (body=0x0) at eval.c:436
#11 FletX (args=0x55555af1ff63) at eval.c:958
#12 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#13 0x0000555555766ded in Fprogn (body=0x0) at eval.c:436
#14 funcall_lambda (fun=0x55555af1fe93, nargs=3,
arg_vector=0x7fffffff9830) at eval.c:3233
#15 0x000055555576739f in apply_lambda (fun=<optimized out>,
args=<optimized out>, count=...) at eval.c:3103
#16 0x000055555576550b in eval_sub (form=<optimized out>) at eval.c:2588
#17 0x0000555555767ddd in Fprogn (body=0x555559f14b83) at eval.c:436
#18 FletX (args=0x555559f15073) at eval.c:958
#19 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#20 0x0000555555766ded in Fprogn (body=0x0) at eval.c:436
#21 funcall_lambda (fun=0x555559f13a93, nargs=0,
arg_vector=0x7fffffff9b40) at eval.c:3233
--Type <RET> for more, q to quit, c to continue without paging--
#22 0x000055555576739f in apply_lambda (fun=<optimized out>,
args=<optimized out>, count=...) at eval.c:3103
#23 0x000055555576550b in eval_sub (form=<optimized out>) at eval.c:2588
#24 0x00005555557679c5 in Fprogn (body=0x0) at eval.c:436
#25 Flet (args=<optimized out>) at eval.c:1026
#26 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#27 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#28 0x0000555555767ddd in Fprogn (body=0x0) at eval.c:436
#29 FletX (args=0x555559f15d73) at eval.c:958
#30 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#31 0x0000555555765f4d in Fprogn (body=0x0) at eval.c:436
#32 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#33 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#34 0x0000555555766ded in Fprogn (body=0x0) at eval.c:436
#35 funcall_lambda (fun=0x555559f15b63, nargs=1,
arg_vector=0x7fffffffa1e0) at eval.c:3233
#36 0x000055555576739f in apply_lambda (fun=<optimized out>,
args=<optimized out>, count=...) at eval.c:3103
#37 0x000055555576550b in eval_sub (form=<optimized out>) at eval.c:2588
#38 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#39 0x0000555555765f4d in Fprogn (body=0x0) at eval.c:436
#40 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#41 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#42 0x0000555555767ddd in Fprogn (body=0x0) at eval.c:436
#43 FletX (args=0x55555aa10d93) at eval.c:958
#44 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#45 0x0000555555765f4d in Fprogn (body=0x0, body@entry=0x55555aa10d63)
at eval.c:436
#46 0x0000555555751d6c in Fsave_current_buffer (args=0x55555aa10d63)
at editfns.c:874
#47 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#48 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#49 0x0000555555767ddd in Fprogn (body=0x0) at eval.c:436
#50 FletX (args=0x55555aa10ce3) at eval.c:958
#51 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#52 0x0000555555767ddd in Fprogn (body=0x0) at eval.c:436
#53 FletX (args=0x55555aa10cb3) at eval.c:958
#54 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#55 0x0000555555766ded in Fprogn (body=0x0) at eval.c:436
#56 funcall_lambda (fun=0x55555aa10b93, nargs=2,
arg_vector=0x7fffffffab80) at eval.c:3233
#57 0x000055555576739f in apply_lambda (fun=<optimized out>,
args=<optimized out>, count=...) at eval.c:3103
#58 0x000055555576550b in eval_sub (form=<optimized out>) at eval.c:2588
#59 0x00005555557685cb in Feval (form=0x5555591dcf83,
lexical=<optimized out>) at eval.c:2361
#60 0x0000555555765d23 in eval_sub (form=<optimized out>) at eval.c:2501
#61 0x0000555555766ded in Fprogn (body=0x55555a5f1ee3) at eval.c:436
#62 funcall_lambda (fun=0x55555a5f1a73, nargs=1,
arg_vector=0x7fffffffaed8) at eval.c:3233
#63 0x0000555555761d93 in Ffuncall (nargs=2, args=0x7fffffffaed0) at eval.c:2995
#64 0x0000555555762282 in Fapply (nargs=2, args=0x7fffffffaed0) at eval.c:2623
#65 0x0000555555765a3d in eval_sub (form=<optimized out>) at eval.c:2470
#66 0x0000555555767c26 in FletX (args=0x55555bdb6543) at
/home/zayfen/github.com/emacs/src/lisp.h:1529
#67 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#68 0x0000555555768379 in internal_lisp_condition_case (var=<optimized
out>, bodyform=<optimized out>, handlers=<optimized out>) at
eval.c:1428
#69 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449
#70 0x000055555576688d in Fprogn (body=0x0) at eval.c:436
#71 Fcond (args=<optimized out>) at eval.c:416
#72 0x0000555555765be8 in eval_sub (form=<optimized out>) at eval.c:2449

张云峰 <zhangyunfeng0101@gmail.com> 于2023年8月11日周五 08:15写道：
>
> I've tested this patch, unfortunately, it doesn't work, still crashes
>
> GDB information:
> Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
> 0x0000555555619516 in produce_glyphless_glyph ()
> (gdb) bt
> #0  0x0000555555619516 in produce_glyphless_glyph ()
> #1  0x0000555555640789 in gui_produce_glyphs ()
> #2  0x0000555555623f70 in move_it_in_display_line_to ()
> #3  0x000055555562935a in move_it_to ()
> #4  0x000055555563e84f in window_text_pixel_size ()
> #5  0x000055555563f526 in Fwindow_text_pixel_size ()
> #6  0x00007fffe7dc07a8 in
> F6669742d6672616d652d746f2d6275666665722d31_fit_frame_to_buffer_1_0 ()
>     at 
> /home/zayfen/github.com/emacs/src/../native-lisp/29.1.50-9e9f496f/preloaded/window-0d1b8b93-6f4eee58.eln
> #7  0x000055555576a032 in funcall_subr ()
> #8  0x0000555555766ba1 in Ffuncall ()
> #9  0x000055555576aa04 in eval_sub ()
> #10 0x000055555576ce6d in FletX ()
> #11 0x000055555576aba7 in eval_sub ()
> #12 0x000055555576be0d in funcall_lambda ()
> #13 0x000055555576c3ee in apply_lambda ()
> #14 0x000055555576a49b in eval_sub ()
> #15 0x000055555576ce6d in FletX ()
> #16 0x000055555576aba7 in eval_sub ()
> #17 0x000055555576be0d in funcall_lambda ()
> #18 0x000055555576c3ee in apply_lambda ()
> #19 0x000055555576a49b in eval_sub ()
> #20 0x000055555576ca2d in Flet ()
> #21 0x000055555576aba7 in eval_sub ()
> #22 0x000055555576aba7 in eval_sub ()
> #23 0x000055555576ce6d in FletX ()
> #24 0x000055555576aba7 in eval_sub ()
> #25 0x000055555576af0d in Fprogn ()
> #26 0x000055555576aba7 in eval_sub ()
> #27 0x000055555576aba7 in eval_sub ()
> #28 0x000055555576be0d in funcall_lambda ()
> #29 0x000055555576c3ee in apply_lambda ()
> #30 0x000055555576a49b in eval_sub ()
> #31 0x000055555576aba7 in eval_sub ()
> #32 0x000055555576af0d in Fprogn ()
> #33 0x000055555576aba7 in eval_sub ()
> #34 0x000055555576aba7 in eval_sub ()
> #35 0x000055555576ce6d in FletX ()
> #36 0x000055555576aba7 in eval_sub ()
> #37 0x000055555576af0d in Fprogn ()
> #38 0x000055555575666c in Fsave_current_buffer ()
> #39 0x000055555576aba7 in eval_sub ()
> #40 0x000055555576aba7 in eval_sub ()
> #41 0x000055555576ce6d in FletX ()
> #42 0x000055555576aba7 in eval_sub ()
> #43 0x000055555576ce6d in FletX ()
> #44 0x000055555576aba7 in eval_sub ()
> #45 0x000055555576be0d in funcall_lambda ()
> #46 0x000055555576c3ee in apply_lambda ()
> #47 0x000055555576a49b in eval_sub ()
> #48 0x000055555576d66b in Feval ()
> #49 0x000055555576ace1 in eval_sub ()
>
> Eli Zaretskii <eliz@gnu.org> 于2023年8月11日周五 02:36写道：
> >
> > > From: 张云峰 <zhangyunfeng0101@gmail.com>
> > > Date: Fri, 11 Aug 2023 01:58:34 +0800
> > > Cc: 65198@debbugs.gnu.org
> > >
> > > 2023-08-11_01-53.png
> > > when popup frame has the warning-icon (marked in picture) , emacs will 
> > > crash immediately.
> >
> > Can you try the patch below and see if it prevents the crash in these
> > cases?
> >
> > diff --git a/src/xdisp.c b/src/xdisp.c
> > index 9cddcfe..b25bdc7 100644
> > --- a/src/xdisp.c
> > +++ b/src/xdisp.c
> > @@ -8312,9 +8312,14 @@ get_next_display_element (struct it *it)
> >        && success_p
> >        && FRAME_WINDOW_P (it->f))
> >      {
> > -      struct face *face = FACE_FROM_ID (it->f, it->face_id);
> > +      struct face *face = FACE_FROM_ID_OR_NULL (it->f, it->face_id);
> >
> > -      if (it->what == IT_COMPOSITION && it->cmp_it.ch >= 0)
> > +      if (!face)
> > +       {
> > +         it->what = IT_GLYPHLESS;
> > +         it->glyphless_method = GLYPHLESS_DISPLAY_EMPTY_BOX;
> > +       }
> > +      else if (it->what == IT_COMPOSITION && it->cmp_it.ch >= 0)
> >         {
> >           /* Automatic composition with glyph-string.   */
> >           Lisp_Object gstring = composition_gstring_from_id (it->cmp_it.id);