bug#18162: 24.3.92; segfault on null face pointer in face_for_char

[Eli Zaretskii]

> Date: Sat, 02 Aug 2014 13:41:12 +0300
> From: Eli Zaretskii <eliz@gnu.org>
> Cc: 18162@debbugs.gnu.org
> 
> > From: Ken Raeburn <raeburn@permabit.com>
> > Date: Sat, 2 Aug 2014 06:00:34 -0400
> > Cc: 18162@debbugs.gnu.org
> > 
> >   emacs -Q
> >   M-x list-faces-display RET
> > Type into the scratch buffer:
> >   (progn (clear-face-cache t) (internal-char-font nil 8230))
> > Hit C-j to evaluate. This generally works the first time. Move the cursor 
> > back up to the end of the expression and hit C-j again. The second time 
> > usually crashes for me.
> 
> It didn't crash for me.

Moreover, even if I force the call to clear_font_cache by invoking
clear-font-cache in the progn, I don't see a crash, and the use count
of the frame's face cache is not zero.

So one way of tracking this down would be to put a breakpoint in
Fclear_face_cache, and when it breaks, step through the function until
it assigns the frame pointer to 'f', and put a watchpoint on
f->face_cache->used, to see which code zeroes it.  My guess would be
that some code calls free_realized_faces (I misremembered earlier:
clear_face_cache doesn't do that).