bug#3255: 23.0.93; occasional abort() in check_glyph_memory

[Markus Triska]

Let ~/frame.el consist of:

   (while t
     (delete-frame (make-frame-on-display (getenv "DISPLAY"))))

When I run "emacs -Q -nw ~/frame.el" and evaluate that expression, then
wait a few seconds, and then press C-g C-x C-c, sometimes Emacs exits
normally, and sometimes it exits with a fatal error. Backtrace:

(gdb) r -Q -nw ~/frame.el
Starting program: /Users/mt/emacs/src/emacs -Q -nw ~/frame.el
Reading symbols for shared libraries .... done

Program received signal SIGABRT, Aborted.
0x96621e42 in __kill ()
(gdb) bt
#0  0x96621e42 in __kill ()
#1  0x96621e34 in kill$UNIX2003 ()
#2  0x9669423a in raise ()
#3  0x966a0679 in abort ()
#4  0x000053c5 in check_glyph_memory () at dispnew.c:2613
#5  0x000ec825 in shut_down_emacs (sig=0, no_x=0, stuff=41943049) at 
emacs.c:2248
#6  0x000ec8fe in Fkill_emacs (arg=<value temporarily unavailable, due to 
optimizations>) at emacs.c:2155
#7  0x00165081 in Ffuncall (nargs=1, args=0xbfffefd0) at eval.c:3051
#8  0x001a036b in Fbyte_code (bytestr=2184555, vector=2184572, maxdepth=5) at 
bytecode.c:678
#9  0x00164931 in funcall_lambda (fun=2184508, nargs=1, arg_vector=0xbffff164) 
at eval.c:3232
#10 0x00164e7b in Ffuncall (nargs=2, args=0xbffff160) at eval.c:3102
#11 0x001a036b in Fbyte_code (bytestr=2184851, vector=2184868, maxdepth=3) at 
bytecode.c:678
#12 0x00164931 in funcall_lambda (fun=2184804, nargs=1, arg_vector=0xbffff334) 
at eval.c:3232
#13 0x00164e7b in Ffuncall (nargs=2, args=0xbffff330) at eval.c:3102
#14 0x00161222 in Fcall_interactively (function=42435881, record_flag=41943049, 
keys=37757052) at callint.c:868
#15 0x00165081 in Ffuncall (nargs=4, args=0xbffff520) at eval.c:3051
#16 0x00165239 in call3 (fn=42057345, arg1=42435881, arg2=41943049, 
arg3=41943049) at eval.c:2875
#17 0x00100141 in command_loop_1 () at keyboard.c:1901
#18 0x00162fbd in internal_condition_case (bfun=0xffcc0 <command_loop_1>, 
handlers=41982641, hfun=0xf6540 <cmd_error>) at eval.c:1512
#19 0x000ef1e8 in command_loop_2 () at keyboard.c:1359
#20 0x00162b9c in internal_catch (tag=0, func=0xef1a0 <command_loop_2>, 
arg=41943049) at eval.c:1248
#21 0x000eef3e in command_loop () at keyboard.c:1338
#22 0x000ef002 in recursive_edit_1 () at keyboard.c:953
#23 0x000ef181 in Frecursive_edit () at keyboard.c:1015
#24 0x000edeeb in main (argc=4, argv=0xbffff970) at emacs.c:1852
(gdb) bt full
#0  0x96621e42 in __kill ()
No symbol table info available.
#1  0x96621e34 in kill$UNIX2003 ()
No symbol table info available.
#2  0x9669423a in raise ()
No symbol table info available.
#3  0x966a0679 in abort ()
No symbol table info available.
#4  0x000053c5 in check_glyph_memory () at dispnew.c:2613
        tail = <value temporarily unavailable, due to optimizations>
#5  0x000ec825 in shut_down_emacs (sig=0, no_x=0, stuff=41943049) at 
emacs.c:2248
No locals.
#6  0x000ec8fe in Fkill_emacs (arg=<value temporarily unavailable, due to 
optimizations>) at emacs.c:2155
No locals.
#7  0x00165081 in Ffuncall (nargs=1, args=0xbfffefd0) at eval.c:3051
        fun = <value temporarily unavailable, due to optimizations>
        original_fun = 1
        funcar = <value temporarily unavailable, due to optimizations>
        numargs = 0
        val = <value temporarily unavailable, due to optimizations>
        backtrace = {
  next = 0xbffff11c, 
  function = 0xbfffefd0, 
  args = 0xbfffefd4, 
  nargs = 0, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x2800009
        i = <value temporarily unavailable, due to optimizations>
#8  0x001a036b in Fbyte_code (bytestr=2184555, vector=2184572, maxdepth=5) at 
bytecode.c:678
        op = <value temporarily unavailable, due to optimizations>
        vectorp = (Lisp_Object *) 0x215580
        stack = {
  pc = 0x2f8fb8 "?", 
  top = 0xbfffefd0, 
  bottom = 0xbfffefd0, 
  byte_string = 2184555, 
  byte_string_start = 0x2f8f57 "?\b?\"????? \">?\025", 
  constants = 2184572, 
  next = 0xbffff1d4
}
        top = (Lisp_Object *) 0xbfffefd0
        result = <value temporarily unavailable, due to optimizations>
#9  0x00164931 in funcall_lambda (fun=2184508, nargs=1, arg_vector=0xbffff164) 
at eval.c:3232
        val = <value temporarily unavailable, due to optimizations>
        syms_left = 2184504
        next = <value temporarily unavailable, due to optimizations>
        i = 1
        optional = 1
        rest = 0
#10 0x00164e7b in Ffuncall (nargs=2, args=0xbffff160) at eval.c:3102
        fun = 2184504
        original_fun = 42435809
        funcar = <value temporarily unavailable, due to optimizations>
        numargs = 1
        val = <value temporarily unavailable, due to optimizations>
        backtrace = {
  next = 0xbffff29c, 
  function = 0xbffff160, 
  args = 0xbffff164, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0xbffff164
        i = <value temporarily unavailable, due to optimizations>
#11 0x001a036b in Fbyte_code (bytestr=2184851, vector=2184868, maxdepth=3) at 
bytecode.c:678
        op = <value temporarily unavailable, due to optimizations>
        vectorp = (Lisp_Object *) 0x2156a8
        stack = {
  pc = 0x2f8eaa "?", 
  top = 0xbffff164, 
  bottom = 0xbffff160, 
  byte_string = 2184851, 
  byte_string_start = 0x2f8e9b "?? ?\"?\f", 
  constants = 2184868, 
  next = 0x0
}
        top = (Lisp_Object *) 0xbffff160
        result = <value temporarily unavailable, due to optimizations>
#12 0x00164931 in funcall_lambda (fun=2184804, nargs=1, arg_vector=0xbffff334) 
at eval.c:3232
        val = <value temporarily unavailable, due to optimizations>
        syms_left = 2184800
        next = <value temporarily unavailable, due to optimizations>
        i = 1
        optional = 1
        rest = 0
#13 0x00164e7b in Ffuncall (nargs=2, args=0xbffff330) at eval.c:3102
        fun = 2184800
        original_fun = 42435881
        funcar = <value temporarily unavailable, due to optimizations>
        numargs = 1
        val = <value temporarily unavailable, due to optimizations>
        backtrace = {
  next = 0xbffff4cc, 
  function = 0xbffff330, 
  args = 0xbffff334, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0xbffff334
        i = <value temporarily unavailable, due to optimizations>
#14 0x00161222 in Fcall_interactively (function=42435881, record_flag=41943049, 
keys=37757052) at callint.c:868
        val = <value temporarily unavailable, due to optimizations>
        specs = <value temporarily unavailable, due to optimizations>
        filter_specs = 2184899
        teml = <value temporarily unavailable, due to optimizations>
        up_event = 41943049
        enable = 41943049
        next_event = 2
        prefix_arg = 41943049
        string = (unsigned char *) 0x2 <Address 0x2 out of bounds>
        tem = (unsigned char *) 0x1cb1a4 ""
        i = <value temporarily unavailable, due to optimizations>
        j = 1
        foo = <value temporarily unavailable, due to optimizations>
        prompt1 = '\0' <repeats 99 times>
        arg_from_tty = 0
        key_count = 2
        record_then_fail = 0
        save_this_command = 42435881
        save_last_command = 42107193
        save_this_original_command = 42435881
        save_real_this_command = 42435881
#15 0x00165081 in Ffuncall (nargs=4, args=0xbffff520) at eval.c:3051
        fun = <value temporarily unavailable, due to optimizations>
        original_fun = 42057345
        funcar = <value temporarily unavailable, due to optimizations>
        numargs = 3
        val = <value temporarily unavailable, due to optimizations>
        backtrace = {
  next = 0x0, 
  function = 0xbffff520, 
  args = 0xbffff524, 
  nargs = 3, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0xbffff524
        i = <value temporarily unavailable, due to optimizations>
#16 0x00165239 in call3 (fn=42057345, arg1=42435881, arg2=41943049, 
arg3=41943049) at eval.c:2875
        ret_ungc_val = 0
#17 0x00100141 in command_loop_1 () at keyboard.c:1901
        cmd = <value temporarily unavailable, due to optimizations>
        lose = <value temporarily unavailable, due to optimizations>
        nonundocount = 0
        keybuf = {192, 24, 3519248, 41943049, -1073744392, 1009184, 27599845, 
-1073744466, 41943049, 37763836, -1073744152, 25201104, -1073744466, 41943049, 
2216256, 2216260, -1073744392, 18752, 16, 41943049, 7, 850045863, 1, 0, 
-1073744420, -1073744608, 0, 0, 41943049, 42297857}
        i = 2
        prev_modiff = 12
        prev_buffer = (struct buffer *) 0x1822270
        already_adjusted = 0
#18 0x00162fbd in internal_condition_case (bfun=0xffcc0 <command_loop_1>, 
handlers=41982641, hfun=0xf6540 <cmd_error>) at eval.c:1512
        val = <value temporarily unavailable, due to optimizations>
        c = {
  tag = 41943049, 
  val = 41943049, 
  next = 0xbffff71c, 
  gcpro = 0x0, 
  jmp = {2163583, -1073744252, 8096, 1453755, 41943049, 41943049, 3518492, 
3518572, -1073744200, -1073744384, 31, 662, 1453911, 1638423, 3473439, 3473439, 
-1073807360, -1073807305}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 41982641, 
  var = 41943049, 
  chosen_clause = 41943097, 
  tag = 0xbffff618, 
  next = 0x0
}
#19 0x000ef1e8 in command_loop_2 () at keyboard.c:1359
        val = 0
#20 0x00162b9c in internal_catch (tag=0, func=0xef1a0 <command_loop_2>, 
arg=41943049) at eval.c:1248
        c = {
  tag = 41978761, 
  val = 41943049, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {-1772420225, 0, 8096, 1452793, -1772400371, 0, 3518640, 3518572, 
-1073743976, -1073744128, 42074143, 662, 1452943, 42074135, 42074143, 41943071, 
37748736, 22413367}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
#21 0x000eef3e in command_loop () at keyboard.c:1338
No locals.
#22 0x000ef002 in recursive_edit_1 () at keyboard.c:953
        val = <value temporarily unavailable, due to optimizations>
#23 0x000ef181 in Frecursive_edit () at keyboard.c:1015
        buffer = 41943049
#24 0x000edeeb in main (argc=4, argv=0xbffff970) at emacs.c:1852
        dummy = -1881143876
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = 1
        skip_args = 1
        rlim = {
  rlim_cur = 8388608, 
  rlim_max = 67104768
}
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0

In GNU Emacs 23.0.93.1 (i386-apple-darwin9.6.1, GTK+ Version 2.14.7)
 of 2009-05-11 on mt-imac.local
Windowing system distributor `The X.Org Foundation', version 11.0.10402000
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t