bug#20802: Segfault when showing non-GTK+ tooltip

[martin rudalics]

> Breakpoint 1, x_free_frame_resources (f=0x124fd70) at xterm.c:10970
> 10970      {
> (gdb) bt
> #0  x_free_frame_resources (f=0x124fd70) at xterm.c:10970
> #1  0x00000000004c9715 in unwind_create_frame (frame=19201397) at xfns.c:2842
> #2  0x00000000004c9759 in unwind_create_tip_frame (frame=<optimized out>) at 
xfns.c:4997
> #3  0x0000000000557b2e in unbind_to (count=<optimized out>, 
value=value@entry=0) at eval.c:3211
> #4  0x0000000000557cf9 in unwind_to_catch (catch=catch@entry=0x140a040, 
value=value@entry=19849283)
>      at eval.c:1157
> #5  0x00000000005592ed in Fsignal (error_symbol=error_symbol@entry=18624, 
data=<optimized out>)
>      at eval.c:1557
> #6  0x00000000005595f9 in xsignal (error_symbol=error_symbol@entry=18624, 
data=<optimized out>)
>      at eval.c:1581
> #7  0x0000000000559c6d in signal_error (s=s@entry=0x5e3d1d "Undefined color", 
arg=19849315,
>      arg@entry=34016084) at eval.c:1636
> #8  0x00000000004ccc57 in x_decode_color (f=<optimized out>, 
color_name=34016084,
>      mono_color=<optimized out>) at xfns.c:495
> #9  0x00000000004ce96c in x_set_foreground_color (f=0x124fd70, arg=34016084, 
oldval=<optimized out>)
>      at xfns.c:602
> #10 0x0000000000426ff6 in x_set_frame_parameters (f=f@entry=0x124fd70, 
alist=alist@entry=140737488338931)
>      at frame.c:3152
> #11 0x0000000000429ac7 in x_default_parameter (f=f@entry=0x124fd70, 
alist=alist@entry=19856675,
>      prop=prop@entry=22320, deflt=34090788, xprop=xprop@entry=0x5db8ca 
"foreground",
>      xclass=xclass@entry=0x5e3f61 "Foreground", type=RES_TYPE_STRING) at 
frame.c:4374
> #12 0x00000000004cd200 in x_create_tip_frame (dpyinfo=0x173c900, 
parms=19856675, parms@entry=19857043,
>      text=text@entry=34092084) at xfns.c:5181
> #13 0x00000000004cd94d in Fx_show_tip (string=34092084, frame=18429029, 
parms=19857043, timeout=42, dx=22,
>      dy=82) at xfns.c:5540

Why am I not surprised?  xfns.c sets image_cache_refcount on line 5192,
that is, after it processes the foreground parameter on line 5181 so
probably line 5192 is not executed.  I initially tried to set it right
after the record_unwind_protect on line 5061 but that got me a(nother?)
segfault as well.  Funnily I coudn't get a crash after my patch.

Can you try whether my conjecture is true by putting a breakpoint on
line 5192 and check whether the refcount gets set there for the tooltip
frame?  If it isn't, then could you experimentally try to move the

  image_cache_refcount =
    FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
#ifdef GLYPH_DEBUG
  dpyinfo_refcount = dpyinfo->reference_count;
#endif /* GLYPH_DEBUG */

block from line 5192 somewhere up in the code, first before line 5172,
later maybe a bit further up and check whether it helps?

Thanks, martin