bug#43700: 28.0.50; Crash creating a second frame

[Andy Moreton]

On 02/10/2020 12:49, Eli Zaretskii wrote:
> > Cc: 43700@debbugs.gnu.org
> > From: Andy Moreton <andrewjmoreton@gmail.com>
> > Date: Fri, 2 Oct 2020 01:38:25 +0100
> >
> > On 01/10/2020 13:53, Eli Zaretskii wrote:
> > > If you put a breakpoint in lookup_image, on the line indicated below:
> > >
> > >     ptrdiff_t
> > >     lookup_image (struct frame *f, Lisp_Object spec, int face_id)
> > >     {
> > >       struct image *img;
> > >       EMACS_UINT hash;
> > >
> > >       struct face *face = (face_id >= 0) ? FACE_FROM_ID (f, face_id)
> > >         : FACE_FROM_ID (f, DEFAULT_FACE_ID);
> > >       unsigned long foreground = FACE_COLOR_TO_PIXEL (face->foreground, f); <<<<
> > >       unsigned long background = FACE_COLOR_TO_PIXEL (face->background, f);
> > >
> > > and condition the breakpoint by face == 0, does it break before the
> > > crash when you perform the steps that reproduces the problem?
> >
> > Yes it does.
>
> So the next question is: how come the default face is not available?
> When that breakpoint breaks, what is the value of
>
>     FRAME_FACE_CACHE (f)->used
>
> Is it zero, per chance?  If so, I'd be interested to understand which
> code resets the frame's face cache in this recipe.

Yes: let me know what else you would like to look at.

(gdb) break src/image.c:2334 if face == 0
Breakpoint 2 at 0x4002c8931: file C:/emacs/git/emacs/master/src/image.c, 
line 2334.
(gdb) run --no-desktop
Starting program: 
C:\emacs\git\emacs\master\build\mingw64-x86_64-O0\src\emacs.exe --no-desktop

Thread 1 hit Breakpoint 2, lookup_image (f=0x5862600, 
spec=XIL(0xa74e1a3), face_id=-1) at 
C:/emacs/git/emacs/master/src/image.c:2334
2334      unsigned long foreground = FACE_COLOR_TO_PIXEL 
(face->foreground, f);
(gdb) p face
$1 = (struct face *) 0x0
(gdb) p FRAME_FACE_CACHE (f)->used
$2 = 0
(gdb) p *FRAME_FACE_CACHE (f)
$3 = {
  buckets = 0x4f750a0,
  f = 0x5862600,
  faces_by_id = 0x58632e0,
  size = 50,
  used = 0,
  menu_face_changed_p = 0
}