23.0.60; emacs segfaults when creating X display via emacsclient

[Lawrence Mitchell]

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

The following sequence of events causes Emacs to segfault
somewhere in x-create-frame.

Run emacs in a terminal

1) emacs -nw -Q --eval '(server-start)'

Create an X frame.
2) emacsclient -c -d :0.0

Delete the frame
3) C-x 5 0

Try and create another X frame.
4) emacsclient -c -d :0.0

leading to the following backtrace:

#0  abort () at /scratch/s0198183/src/emacs/src/emacs.c:432
No locals.
#1  0x08157c0e in internal_condition_case_2 (bfun=0x815a8b8 
<Frun_hook_with_args>, nargs=2, args=0xbff11018, handlers=137607417, 
hfun=0x805c0c8 <delete_frame_handler>) at 
/scratch/s0198183/src/emacs/src/eval.c:1568
        val = 1
        c = {
  tag = -1074720976, 
  val = 8, 
  next = 0xbff10f30, 
  gcpro = 0x833b8c9, 
  jmp = {{
      __jmpbuf = {140079216, -1074720900, -1074720936, 134598562, -1074720900, 
137807897}, 
      __mask_was_saved = 137607369, 
      __saved_mask = {
        __val = {159, 808726579, 858863672, 3220246272, 135656940, 137817233, 
147309573, 4232604, 140079216, 140079216, 3220246396, 3220246440, 134599434, 
140079216, 3220246396, 137607369, 147892985, 140064784, 3220246544, 1, 
147321917, 0, 3220246544, 3220246456, 3552600, 1511, 137608420, 3220246456, 
135715964, 137608420, 137607369, 78}
      }
    }}, 
  backlist = 0x16, 
  handlerlist = 0x81ad7ae, 
  lisp_eval_depth = 137608420, 
  pdlcount = -1074720792, 
  poll_suppress_count = 135728988, 
  interrupt_input_blocked = 137608420, 
  byte_stack = 0x81ad7ae
}
        h = {
  handler = 137807897, 
  var = 137607369, 
  chosen_clause = -1074721000, 
  tag = 0x805c9d0, 
  next = 0x8c7f445
}
#2  0x0805db35 in Fdelete_frame (frame=140079220, force=137607417) at 
/scratch/s0198183/src/emacs/src/frame.c:1412
        args = {137817425, 140079220}
        gcpro1 = {
  next = 0x85eef68, 
  var = 0x8428328, 
  nvars = -1074720680
}
        gcpro2 = {
  next = 0x83739c9, 
  var = 0x833b8f9, 
  nvars = 139882744
}
        f = (struct frame *) 0x8597070
        sf = (struct frame *) 0x835b868
        kb = Variable "kb" is not available.

Further stack frames:

#0  abort () at /scratch/s0198183/src/emacs/src/emacs.c:432
#1  0x08157c0e in internal_condition_case_2 (bfun=0x815a8b8 
<Frun_hook_with_args>, nargs=2, args=0xbff11018, handlers=137607417, 
hfun=0x805c0c8 <delete_frame_handler>) at 
/scratch/s0198183/src/emacs/src/eval.c:1568
#2  0x0805db35 in Fdelete_frame (frame=140079220, force=137607417) at 
/scratch/s0198183/src/emacs/src/frame.c:1412
#3  0x080d787a in x_connection_closed (dpy=0x8428328, error_message=0xbff11300 
"X protocol error: BadFont (invalid Font parameter) on protocol request 55") at 
/scratch/s0198183/src/emacs/src/xterm.c:8054
#4  0x080d7bf8 in x_error_quitter (display=0x8428328, error=0xbff115d0) at 
/scratch/s0198183/src/emacs/src/xterm.c:8187
#5  0x080d7c34 in x_error_handler (display=0x8428328, error=0x0) at 
/scratch/s0198183/src/emacs/src/xterm.c:8143
#6  0x00363f90 in _XError () from /usr/X11R6/lib/libX11.so.6
#7  0x003646a7 in _XReply () from /usr/X11R6/lib/libX11.so.6
#8  0x0035f266 in XSync () from /usr/X11R6/lib/libX11.so.6
#9  0x080d0cad in x_catch_errors (dpy=0x8428328) at 
/scratch/s0198183/src/emacs/src/xterm.c:7859
#10 0x080d7601 in x_connection_closed (dpy=0x8428328, error_message=0xbff11990 
"X protocol error: BadFont (invalid Font parameter) on protocol request 55") at 
/scratch/s0198183/src/emacs/src/xterm.c:8017
#11 0x080d7bf8 in x_error_quitter (display=0x8428328, error=0xbff11c60) at 
/scratch/s0198183/src/emacs/src/xterm.c:8187
#12 0x080d7c34 in x_error_handler (display=0x8428328, error=0x0) at 
/scratch/s0198183/src/emacs/src/xterm.c:8143
#13 0x00363f90 in _XError () from /usr/X11R6/lib/libX11.so.6
#14 0x003646a7 in _XReply () from /usr/X11R6/lib/libX11.so.6
#15 0x0035f266 in XSync () from /usr/X11R6/lib/libX11.so.6
#16 0x080d0cad in x_catch_errors (dpy=0x8428328) at 
/scratch/s0198183/src/emacs/src/xterm.c:7859
#17 0x080d7601 in x_connection_closed (dpy=0x8428328, error_message=0xbff12020 
"X protocol error: BadFont (invalid Font parameter) on protocol request 55") at 
/scratch/s0198183/src/emacs/src/xterm.c:8017
#18 0x080d7bf8 in x_error_quitter (display=0x8428328, error=0xbff122f0) at 
/scratch/s0198183/src/emacs/src/xterm.c:8187
#19 0x080d7c34 in x_error_handler (display=0x8428328, error=0x0) at 
/scratch/s0198183/src/emacs/src/xterm.c:8143
#20 0x00363f90 in _XError () from /usr/X11R6/lib/libX11.so.6
#21 0x003646a7 in _XReply () from /usr/X11R6/lib/libX11.so.6
#22 0x0034b528 in XAllocColor () from /usr/X11R6/lib/libX11.so.6
#23 0x001111a5 in xpmParseHeader () from /usr/X11R6/lib/libXpm.so.4
#24 0x0011123d in xpmParseHeader () from /usr/X11R6/lib/libXpm.so.4
#25 0x00111b36 in xpmParseHeader () from /usr/X11R6/lib/libXpm.so.4
#26 0x001136f9 in xpmParseDataAndCreate () from /usr/X11R6/lib/libXpm.so.4
#27 0x0011adeb in XpmCreateImageFromData () from /usr/X11R6/lib/libXpm.so.4
#28 0x00119fad in XpmCreatePixmapFromData () from /usr/X11R6/lib/libXpm.so.4
#29 0x080f063c in x_create_bitmap_from_xpm_data (f=0x8597070, bits=0x81c5e20) 
at /scratch/s0198183/src/emacs/src/image.c:3942
#30 0x080d4f15 in x_bitmap_icon (f=0x8597070, file=137607417) at 
/scratch/s0198183/src/emacs/src/xterm.c:7744
#31 0x080dad3d in x_set_icon_type (f=0x8597070, arg=137607417, 
oldval=137607369) at /scratch/s0198183/src/emacs/src/xfns.c:1250
#32 0x0805e45f in x_set_frame_parameters (f=0x8597070, alist=147322741) at 
/scratch/s0198183/src/emacs/src/frame.c:3052
#33 0x0806024c in x_default_parameter (f=0x8597070, alist=147309765, 
prop=137816825, deflt=137607417, xprop=0x81b3ece "bitmapIcon", xclass=0x81b3ec3 
"BitmapIcon", type=RES_TYPE_SYMBOL) at 
/scratch/s0198183/src/emacs/src/frame.c:4043
#34 0x080dec07 in Fx_create_frame (parms=147309765) at 
/scratch/s0198183/src/emacs/src/xfns.c:3560
#35 0x08159773 in Ffuncall (nargs=2, args=0xbff17314) at 
/scratch/s0198183/src/emacs/src/eval.c:3028
#36 0x08181491 in Fbyte_code (bytestr=136311699, vector=136311716, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:679
#37 0x081591f7 in funcall_lambda (fun=Variable "fun" is not available.
) at /scratch/s0198183/src/emacs/src/eval.c:3212
#38 0x08159622 in Ffuncall (nargs=2, args=0xbff17440) at 
/scratch/s0198183/src/emacs/src/eval.c:3082
#39 0x08181491 in Fbyte_code (bytestr=136562403, vector=136562420, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:679
#40 0x081591f7 in funcall_lambda (fun=Variable "fun" is not available.
) at /scratch/s0198183/src/emacs/src/eval.c:3212
#41 0x08159622 in Ffuncall (nargs=2, args=0xbff17580) at 
/scratch/s0198183/src/emacs/src/eval.c:3082
#42 0x08181491 in Fbyte_code (bytestr=136561147, vector=136561164, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:679
#43 0x081591f7 in funcall_lambda (fun=Variable "fun" is not available.
) at /scratch/s0198183/src/emacs/src/eval.c:3212
#44 0x08159622 in Ffuncall (nargs=3, args=0xbff176b0) at 
/scratch/s0198183/src/emacs/src/eval.c:3082
#45 0x08181491 in Fbyte_code (bytestr=143330219, vector=146520924, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:679
#46 0x081591f7 in funcall_lambda (fun=Variable "fun" is not available.
) at /scratch/s0198183/src/emacs/src/eval.c:3212
#47 0x08159622 in Ffuncall (nargs=4, args=0xbff177f0) at 
/scratch/s0198183/src/emacs/src/eval.c:3082
#48 0x08181491 in Fbyte_code (bytestr=143340787, vector=146500140, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:679
#49 0x08158d9b in Feval (form=147592405) at 
/scratch/s0198183/src/emacs/src/eval.c:2356
#50 0x0815ae35 in internal_lisp_condition_case (var=138048433, 
bodyform=147592405, handlers=147591637) at 
/scratch/s0198183/src/emacs/src/eval.c:1439
#51 0x08181886 in Fbyte_code (bytestr=143341411, vector=146743916, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:869
#52 0x08158d9b in Feval (form=147594205) at 
/scratch/s0198183/src/emacs/src/eval.c:2356
#53 0x081577c1 in internal_catch (tag=140559425, func=0x8158924 <Feval>, 
arg=147594205) at /scratch/s0198183/src/emacs/src/eval.c:1230
#54 0x081818cd in Fbyte_code (bytestr=143341459, vector=145934812, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:854
#55 0x081591f7 in funcall_lambda (fun=Variable "fun" is not available.
) at /scratch/s0198183/src/emacs/src/eval.c:3212
#56 0x08159622 in Ffuncall (nargs=3, args=0xbff17e10) at 
/scratch/s0198183/src/emacs/src/eval.c:3082
#57 0x0815aa24 in Fapply (nargs=2, args=0xbff17ea0) at 
/scratch/s0198183/src/emacs/src/eval.c:2513
#58 0x0815ab61 in apply1 (fn=140558777, arg=147242837) at 
/scratch/s0198183/src/emacs/src/eval.c:2777
#59 0x081860be in read_process_output_call (fun_and_args=147242829) at 
/scratch/s0198183/src/emacs/src/process.c:4974
#60 0x081578c8 in internal_condition_case_1 (bfun=0x81860a8 
<read_process_output_call>, arg=147242829, handlers=137651601, hfun=0x81860c0 
<read_process_output_error_handler>) at 
/scratch/s0198183/src/emacs/src/eval.c:1542
#61 0x081864d7 in read_process_output (proc=139920596, channel=Variable 
"channel" is not available.
) at /scratch/s0198183/src/emacs/src/process.c:5200
#62 0x08187dcb in wait_reading_process_output (time_limit=30, microsecs=0, 
read_kbd=-1, do_display=1, wait_for_cell=137607369, wait_proc=0x0, 
just_wait_proc=0) at /scratch/s0198183/src/emacs/src/process.c:4808
#63 0x08059e35 in sit_for (timeout=240, reading=1, do_display=1) at 
/scratch/s0198183/src/emacs/src/dispnew.c:6608
#64 0x081001c3 in read_char (commandflag=1, nmaps=2, maps=0xbff196c0, 
prev_event=137607369, used_mouse_menu=0xbff19708, end_time=0x0) at 
/scratch/s0198183/src/emacs/src/keyboard.c:2969
#65 0x081025ab in read_key_sequence (keybuf=0xbff19840, bufsize=30, 
prompt=137607369, dont_downcase_last=0, can_return_switch_frame=1, 
fix_current_buffer=1) at /scratch/s0198183/src/emacs/src/keyboard.c:9460
#66 0x0810435d in command_loop_1 () at 
/scratch/s0198183/src/emacs/src/keyboard.c:1655
#67 0x08157ae2 in internal_condition_case (bfun=0x81041b4 <command_loop_1>, 
handlers=137651601, hfun=0x80fd00c <cmd_error>) at 
/scratch/s0198183/src/emacs/src/eval.c:1494
#68 0x080f7cc2 in command_loop_2 () at 
/scratch/s0198183/src/emacs/src/keyboard.c:1370
#69 0x081577c1 in internal_catch (tag=137746577, func=0x80f7ca4 
<command_loop_2>, arg=137607369) at /scratch/s0198183/src/emacs/src/eval.c:1230
#70 0x080f7a8a in command_loop () at 
/scratch/s0198183/src/emacs/src/keyboard.c:1335
#71 0x080f7b70 in recursive_edit_1 () at 
/scratch/s0198183/src/emacs/src/keyboard.c:958
#72 0x080f7c8f in Frecursive_edit () at 
/scratch/s0198183/src/emacs/src/keyboard.c:1020
#73 0x0815977e in Ffuncall (nargs=1, args=0xbff19bb0) at 
/scratch/s0198183/src/emacs/src/eval.c:3022
#74 0x08181491 in Fbyte_code (bytestr=143490955, vector=138050540, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:679
#75 0x08158d9b in Feval (form=138941941) at 
/scratch/s0198183/src/emacs/src/eval.c:2356
#76 0x0815905b in Fprogn (args=0) at /scratch/s0198183/src/emacs/src/eval.c:451
#77 0x08091604 in Fsave_window_excursion (args=138942085) at 
/scratch/s0198183/src/emacs/src/window.c:6746
#78 0x0818190e in Fbyte_code (bytestr=143492347, vector=137799884, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:840
#79 0x081591f7 in funcall_lambda (fun=Variable "fun" is not available.
) at /scratch/s0198183/src/emacs/src/eval.c:3212
#80 0x08159622 in Ffuncall (nargs=3, args=0xbff19ee0) at 
/scratch/s0198183/src/emacs/src/eval.c:3082
#81 0x0815aa24 in Fapply (nargs=2, args=0xbff19f70) at 
/scratch/s0198183/src/emacs/src/eval.c:2513
#82 0x0815ab61 in apply1 (fn=137746721, arg=138944981) at 
/scratch/s0198183/src/emacs/src/eval.c:2777
#83 0x08158572 in call_debugger (arg=138944981) at 
/scratch/s0198183/src/emacs/src/eval.c:308
#84 0x081586c3 in maybe_call_debugger (conditions=137596837, sig=137651769, 
data=138944957) at /scratch/s0198183/src/emacs/src/eval.c:1984
#85 0x0815885a in find_handler_clause (handlers=137651601, 
conditions=137596837, sig=137651769, data=138944957) at 
/scratch/s0198183/src/emacs/src/eval.c:1912
#86 0x081599d1 in Fsignal (error_symbol=137651769, data=138944957) at 
/scratch/s0198183/src/emacs/src/eval.c:1683
#87 0x08159aed in xsignal (error_symbol=137651769, data=138944957) at 
/scratch/s0198183/src/emacs/src/eval.c:1733
#88 0x08159dd5 in xsignal1 (error_symbol=137651769, arg=147806537) at 
/scratch/s0198183/src/emacs/src/eval.c:1750
#89 0x08148e7f in Fsymbol_value (symbol=147806537) at 
/scratch/s0198183/src/emacs/src/data.c:1121
#90 0x08158bca in Feval (form=147806537) at 
/scratch/s0198183/src/emacs/src/eval.c:2237
#91 0x08159773 in Ffuncall (nargs=2, args=0xbff1a1d4) at 
/scratch/s0198183/src/emacs/src/eval.c:3028
#92 0x08181491 in Fbyte_code (bytestr=136690955, vector=136690972, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:679
#93 0x081591f7 in funcall_lambda (fun=Variable "fun" is not available.
) at /scratch/s0198183/src/emacs/src/eval.c:3212
#94 0x08159622 in Ffuncall (nargs=2, args=0xbff1a300) at 
/scratch/s0198183/src/emacs/src/eval.c:3082
#95 0x08181491 in Fbyte_code (bytestr=136691203, vector=136691220, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:679
#96 0x081591f7 in funcall_lambda (fun=Variable "fun" is not available.
) at /scratch/s0198183/src/emacs/src/eval.c:3212
#97 0x08159622 in Ffuncall (nargs=2, args=0xbff1a430) at 
/scratch/s0198183/src/emacs/src/eval.c:3082
#98 0x08181491 in Fbyte_code (bytestr=136689403, vector=136689420, 
maxdepth=Variable "maxdepth" is not available.
) at /scratch/s0198183/src/emacs/src/bytecode.c:679
#99 0x081591f7 in funcall_lambda (fun=Variable "fun" is not available.
) at /scratch/s0198183/src/emacs/src/eval.c:3212
#100 0x08159622 in Ffuncall (nargs=1, args=0xbff1a580) at 
/scratch/s0198183/src/emacs/src/eval.c:3082
#101 0x0815ab72 in apply1 (fn=143338897, arg=137607369) at 
/scratch/s0198183/src/emacs/src/eval.c:2766
#102 0x08155fcd in Fcall_interactively (function=143338897, 
record_flag=137607369, keys=137645788) at 
/scratch/s0198183/src/emacs/src/callint.c:386
#103 0x0815974f in Ffuncall (nargs=4, args=0xbff1a760) at 
/scratch/s0198183/src/emacs/src/eval.c:3028
#104 0x0815987c in call3 (fn=137770177, arg1=143338897, arg2=137607369, 
arg3=137607369) at /scratch/s0198183/src/emacs/src/eval.c:2855
#105 0x080fc766 in Fcommand_execute (cmd=143338897, record_flag=137607369, 
keys=137607369, special=137607369) at 
/scratch/s0198183/src/emacs/src/keyboard.c:10444
#106 0x0810451a in command_loop_1 () at 
/scratch/s0198183/src/emacs/src/keyboard.c:1910
#107 0x08157ae2 in internal_condition_case (bfun=0x81041b4 <command_loop_1>, 
handlers=137651601, hfun=0x80fd00c <cmd_error>) at 
/scratch/s0198183/src/emacs/src/eval.c:1494
#108 0x080f7cc2 in command_loop_2 () at 
/scratch/s0198183/src/emacs/src/keyboard.c:1370
#109 0x081577c1 in internal_catch (tag=137646449, func=0x80f7ca4 
<command_loop_2>, arg=137607369) at /scratch/s0198183/src/emacs/src/eval.c:1230
#110 0x080f7ad4 in command_loop () at 
/scratch/s0198183/src/emacs/src/keyboard.c:1349
#111 0x080f7b70 in recursive_edit_1 () at 
/scratch/s0198183/src/emacs/src/keyboard.c:958
#112 0x080f7c8f in Frecursive_edit () at 
/scratch/s0198183/src/emacs/src/keyboard.c:1020
#113 0x080f6e49 in main (argc=5, argv=0xbff1ade4) at 
/scratch/s0198183/src/emacs/src/emacs.c:1793


Lisp Backtrace:
"x-create-frame" (0xbff17318)
"x-create-frame-with-faces" (0xbff17444)
"make-frame" (0xbff17584)
"make-frame-on-display" (0xbff176b4)
"server-create-window-system-frame" (0xbff177f4)
"byte-code" (0xbff178e0)
"byte-code" (0xbff17b50)
"server-process-filter" (0xbff17e14)
"recursive-edit" (0xbff19bb4)
"byte-code" (0xbff19c60)
"debug" (0xbff19ee4)
"eval" (0xbff1a1d8)
"eval-last-sexp-1" (0xbff1a304)
"eval-last-sexp" (0xbff1a434)
"eval-print-last-sexp" (0xbff1a584)
"call-interactively" (0xbff1a764)


-- 
Lawrence Mitchell <address@hidden>