bug#44502: 28.0.50; Emacs crash using new frame

[Andy Moreton]

Emacs crashed when using a new frame. After a bootstrap of master, I
could repeat the crash witht he following recipe:
  - Run "emacs -Q"
  - Type "C-x 5 2 RET" to create a new frame (which becomes selected)
  - Type "C-x C-f" and emacs crashes

I bisected this using the recipe above, with:
  git checkout master
  git bisect start
  git bisect bad
  git bisect good c3a20804a8

Bisect reports the bad commit as:
  2ecbf4cfae Allow minibuffer to stay in its original frame.
             (2020-11-05 Alan Mackenzie)

Looking in gdb, the backtrace is:

Thread 1 received signal SIGTRAP, Trace/breakpoint trap.
[Switching to Thread 5768.0x1dd0]
0x00007ffb807493e3 in KERNELBASE!DebugBreak () from 
C:\WINDOWS\System32\KernelBase.dll
(gdb) bt
#0  0x00007ffb807493e3 in KERNELBASE!DebugBreak () from 
C:\WINDOWS\System32\KernelBase.dll
#1  0x000000040021673c in emacs_abort () at 
C:/emacs/git/emacs/master/src/w32fns.c:10832
#2  0x00000004000e9a9e in terminate_due_to_signal (sig=11, 
backtrace_limit=12553480) at C:/emacs/git/emacs/master/src/emacs.c:408
#3  0x000000040010a7bc in deliver_fatal_thread_signal () at 
C:/msys64/mingw64/x86_64-w64-mingw32/include/stdio.h:443
#4  0x00000004002a7962 in _gnu_exception_handler 
(exception_data=0xbf8dc0) at 
C:/_/M/mingw-w64-crt-git/src/mingw-w64/mingw-w64-crt/crt/crt_handler.c:223
#5  0x00007ffb80fd7ff8 in msvcrt!__C_specific_handler () from 
C:\WINDOWS\System32\msvcrt.dll
#6  0x00007ffb82cb10ef in ntdll!.chkstk () from 
C:\WINDOWS\SYSTEM32\ntdll.dll
#7  0x00007ffb82c5b474 in ntdll!RtlRaiseException () from 
C:\WINDOWS\SYSTEM32\ntdll.dll
#8  0x00007ffb82cafc1e in ntdll!KiUserExceptionDispatcher () from 
C:\WINDOWS\SYSTEM32\ntdll.dll
#9  0x0000000400245e50 in stat_worker (path=<optimized out>, 
path@entry=0x9358ae0 "c:/home/ajm/.emacs.d/gnus/.newsrc-dribble", 
buf=buf@entry=0xbfa910, follow_symlinks=13303808, 
follow_symlinks@entry=1) at C:/emacs/git/emacs/master/src/w32.c:5441
#10 0x00000004002466df in fstatat (fd=fd@entry=-3041965, 
name=name@entry=0x9358ae0 "c:/home/ajm/.emacs.d/gnus/.newsrc-dribble", 
st=st@entry=0xbfa910, flags=flags@entry=0) at 
C:/emacs/git/emacs/master/src/w32.c:5658
#11 0x000000040010ba6d in emacs_fstatat (dirfd=dirfd@entry=-3041965, 
filename=0x9358ae0 "c:/home/ajm/.emacs.d/gnus/.newsrc-dribble", 
st=st@entry=0xbfa910, flags=flags@entry=0) at 
C:/emacs/git/emacs/master/src/sysdep.c:2300
#12 0x0000000400134f6a in auto_save_1 () at 
C:/emacs/git/emacs/master/src/lisp.h:1508
#13 0x0000000400185f5d in internal_condition_case 
(bfun=bfun@entry=0x400134ec0 <auto_save_1>, handlers=<optimized out>, 
hfun=hfun@entry=0x400129430 <auto_save_error>) at 
C:/emacs/git/emacs/master/src/eval.c:1359
#14 0x0000000400132a40 in Fdo_auto_save 
(no_message=no_message@entry=XIL(0x30), 
current_only=current_only@entry=XIL(0)) at 
C:/emacs/git/emacs/master/src/lisp.h:1007
#15 0x00000004000e9919 in shut_down_emacs (sig=sig@entry=22, 
stuff=XIL(0)) at C:/emacs/git/emacs/master/src/lisp.h:1007
#16 0x00000004000e9ad1 in terminate_due_to_signal (sig=22, 
backtrace_limit=2147483647) at C:/emacs/git/emacs/master/src/lisp.h:1007
#17 0x0000000400156e04 in die (msg=0x4006c2a42 <null_glyph_slice+3762> 
"EQ (window, selected_window)", file=0x4006c24b0 <null_glyph_slice+2336> 
"C:/emacs/git/emacs/master/src/window.c", line=554) at 
C:/emacs/git/emacs/master/src/alloc.c:7341
#18 0x000000040007f2c2 in select_window (window=XIL(0x5127715), 
norecord=norecord@entry=XIL(0x30), 
inhibit_point_swap=inhibit_point_swap@entry=false) at 
C:/emacs/git/emacs/master/src/lisp.h:1373
#19 0x000000040007f2d8 in Fselect_window (window=<optimized out>, 
norecord=norecord@entry=XIL(0x30)) at 
C:/emacs/git/emacs/master/src/window.c:630
#20 0x000000040004c588 in gui_consider_frame_title 
(frame=XIL(0x51274c5)) at C:/emacs/git/emacs/master/src/lisp.h:1007
#21 0x000000040005c41d in prepare_menu_bars () at 
C:/emacs/git/emacs/master/src/xdisp.c:12679
#22 redisplay_internal () at C:/emacs/git/emacs/master/src/xdisp.c:15575
#23 0x000000040005e365 in redisplay () at 
C:/emacs/git/emacs/master/src/xdisp.c:15159
#24 0x00000004000f9af6 in read_char (commandflag=1601537, map=XIL(0), 
map@entry=XIL(0x9c4dc23), prev_event=XIL(0x172a2c), used_mouse_menu=0x1, 
used_mouse_menu@entry=0xbfdb0b, end_time=end_time@entry=0x0) at 
C:/emacs/git/emacs/master/src/keyboard.c:2497
#25 0x00000004000fcc41 in read_key_sequence 
(keybuf=keybuf@entry=0xbfdc80, prompt=prompt@entry=XIL(0), 
dont_downcase_last=dont_downcase_last@entry=false, 
can_return_switch_frame=can_return_switch_frame@entry=true, 
fix_current_buffer=fix_current_buffer@entry=true, 
prevent_redisplay=prevent_redisplay@entry=false) at 
C:/emacs/git/emacs/master/src/keyboard.c:9546
#26 0x00000004000fe44f in command_loop_1 () at 
C:/emacs/git/emacs/master/src/lisp.h:1007
#27 0x0000000400185f5d in internal_condition_case 
(bfun=bfun@entry=0x4000fe230 <command_loop_1>, 
handlers=handlers@entry=XIL(0x90), hfun=hfun@entry=0x4000f36a0 
<cmd_error>) at C:/emacs/git/emacs/master/src/eval.c:1359
#28 0x00000004000eaaf8 in command_loop_2 (ignore=<optimized out>) at 
C:/emacs/git/emacs/master/src/lisp.h:1007
#29 0x0000000400185e9b in internal_catch (tag=tag@entry=XIL(0x5940), 
func=func@entry=0x4000eaad0 <command_loop_2>, arg=arg@entry=XIL(0)) at 
C:/emacs/git/emacs/master/src/eval.c:1120
#30 0x00000004000eb752 in command_loop () at 
C:/emacs/git/emacs/master/src/lisp.h:1007
#31 0x0000000000000000 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Lisp Backtrace:

Thread 1 hit Breakpoint 1, terminate_due_to_signal (sig=22, 
backtrace_limit=2147483647) at C:/emacs/git/emacs/master/src/emacs.c:377
377     {
The program being debugged stopped while in a function called from GDB.
Evaluation of the expression containing the function
(backtrace_function) will be abandoned.



In GNU Emacs 28.0.50 (build 11, x86_64-w64-mingw32)
 of 2020-11-07 built on QUIETUS
Repository revision: bc76afd355c0a6608830e2b43c8c67243aa0fa7b
Repository branch: master
Windowing system distributor 'Microsoft Corp.', version 10.0.19041
System Description: Microsoft Windows 10 Pro (v10.0.2004.19041.572)

Configured using:
 'configure --prefix=/c/emacs/emacs-master

--cache-file=/c/emacs/git/emacs/master/build/mingw64-x86_64-O2/config.cache
 --without-dbus --with-gif --with-gnutls --without-imagemagick
 --with-jpeg --with-json --with-lcms2 --with-modules --with-png
 --without-pop --with-rsvg --with-tiff --with-xml2 --with-xpm
 --enable-checking
 'ac_cv_search___gmpz_roinit_n=-Wl,--push-state,-static -lgmp
 -Wl,--pop-state' 'CFLAGS= -O2 -g3 -gdwarf-4 -fdiagnostics-color=never'
 PKG_CONFIG_PATH=/mingw64/lib/pkgconfig:/mingw64/share/pkgconfig'

Configured features:
XPM JPEG TIFF GIF PNG RSVG SOUND NOTIFY W32NOTIFY ACL GNUTLS LIBXML2
HARFBUZZ ZLIB TOOLKIT_SCROLL_BARS MODULES THREADS JSON PDUMPER LCMS2

Important settings:
  value of $LANG: ENG
  locale-coding-system: cp1252

Major mode: ELisp/d

Minor modes in effect:
  hexl-follow-ascii: t
  bug-reference-prog-mode: t
  which-function-mode: t
  global-so-long-mode: t
  display-fill-column-indicator-mode: t
  desktop-save-mode: t
  show-paren-mode: t
  minibuffer-electric-default-mode: t
  override-global-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message rfc822 mml mml-sec epa derived
epg epg-config gnus-util rmail rmail-loaddefs mm-decode mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail
rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils add-log time
mule-util jka-compr sh-script executable dired-aux autorevert filenotify
rng-xsd xsd-regexp rng-cmpct image-mode dired-x dired dired-loaddefs
exif vc-git diff-mode macrostep-c cmacexp macrostep xcscope cap-words
superword subword time-date rnc-mode rng-nxml rng-valid rng-loc rng-uri
rng-parse nxml-parse rng-match rng-dt rng-util rng-pttrn nxml-ns
nxml-mode nxml-outln nxml-rap sgml-mode dom nxml-util nxml-enc xmltok
typescript-mode tuareg speedbar ezimage dframe tuareg-opam flymake-proc
flymake caml-help caml-types caml-emacs smalltalk-mode rust-mode
meson-mode smie lua-mode advice kconfig-mode go-mode find-file ffap
etags fileloop generator xref project csharp-mode cc-langs cc-mode
cc-fonts cc-guess cc-menus cc-cmds cc-styles cc-align cc-engine cc-vars
cc-defs cmake-mode thingatpt hexl bug-reference graphviz-dot-mode
compile text-property-search xr which-func imenu so-long
display-fill-column-indicator desktop frameset cygwin-mount ange-ftp
comint ansi-color ring hl-line pcase rx paren edmacro kmacro
use-package-bind-key use-package-delight minibuf-eldef
gnu-elpa-keyring-update warnings delight bind-key easy-mmode finder-inf
cl-extra help-mode use-package-ensure use-package-core cus-edit pp
cus-start cus-load wid-edit nsm rmc gnutls puny info package easymenu
browse-url url url-proxy url-privacy url-expand url-methods url-history
url-cookie url-domsuf url-util mailcap url-handlers url-parse
auth-source cl-seq eieio eieio-core cl-macs eieio-loaddefs
password-cache json subr-x map url-vars seq byte-opt gv bytecomp
byte-compile cconv cl-loaddefs cl-lib tooltip eldoc electric uniquify
ediff-hook vc-hooks lisp-float-type mwheel dos-w32 ls-lisp disp-table
term/w32-win w32-win w32-vars term/common-win tool-bar dnd fontset image
regexp-opt fringe tabulated-list replace newcomment text-mode elisp-mode
lisp-mode prog-mode register page tab-bar menu-bar rfn-eshadow isearch
timer select scroll-bar mouse jit-lock font-lock syntax facemenu
font-core term/tty-colors frame minibuffer cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese composite charscript charprop
case-table epa-hook jka-cmpr-hook help simple abbrev obarray
cl-preloaded nadvice button loaddefs faces cus-face macroexp files
window text-properties overlay sha1 md5 base64 format env code-pages
mule custom widget hashtable-print-readable backquote threads w32notify
w32 lcms2 multi-tty make-network-process emacs)

Memory information:
((conses 16 384317 223359)
 (symbols 48 27577 428)
 (strings 32 117889 33639)
 (string-bytes 1 3236646)
 (vectors 16 40518)
 (vector-slots 8 561206 362902)
 (floats 8 89 815)
 (intervals 56 4641 630)
 (buffers 992 35))