bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Torsten Bronger]

WARNING: This bug is difficult for me to reproduce.  I hope I found a
minimal example which exhibits the bug for everyone, but things like
display resolution or X settings may have an influence, so you may have
a hard time reproducing it.  That said ...

I see Emacs segfaulting when moving the cursor upwards in a LaTeX
document while tex-fold-mode is active.  The starting position of the
cursor is important.

I placed all files to reproduce the bug at
<http://wilson.bronger.org/emacs-glyph_row-bug.tar>.  The TeX file needs
to be put in /tmp.  tex-fold-mode must be present.  Furthermore, place
.emacs and .emacs.desktop in the proper positions, start current Git
Emacs, and press the "cursor up" button.  Then, Emacs crashes for me.

The subject of this bug is just to give it a name.  I do not know
whether glyph_row is the issue.  However, I bisected the problem, and it
started with commit f425a774, which sets glyph_row to NULL in two
places.  If I revert this commit, the problem is gone.


In GNU Emacs 28.0.50 (build 6, x86_64-pc-linux-gnu, cairo version 1.16.0)
 of 2020-12-10 built on brad
Repository revision: 4f352ad6f1759ae6dcff6ba43847273491bf9c30
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.12008000
System Description: Ubuntu 20.04.1 LTS

Configured using:
 'configure --prefix=/usr/ --mandir=/usr/share/man/
 --infodir=/usr/share/info/ --with-x-toolkit=no --without-makeinfo
 --with-xpm --with-jpeg --with-tiff --with-gif --with-png --with-x
 --with-file-notification=inotify'

Configured features:
XPM JPEG TIFF GIF PNG RSVG CAIRO SOUND GPM DBUS GSETTINGS GLIB NOTIFY
INOTIFY ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE HARFBUZZ M17N_FLT LIBOTF
ZLIB OLDXMENU X11 XDBE XIM MODULES THREADS LIBSYSTEMD PDUMPER LCMS2

Important settings:
  value of $EMACSLOADPATH: /home/bronger/.emacs.d/lisp:
  value of $LC_MONETARY: de_DE.UTF-8
  value of $LC_NUMERIC: de_DE.UTF-8
  value of $LC_TIME: de_DE.UTF-8
  value of $LANG: de_DE.UTF-8
  value of $XMODIFIERS: @im=fcitx
  locale-coding-system: utf-8-unix

Major mode: LaTeX/FP

Minor modes in effect:
  text-scale-mode: t
  flyspell-mode: t
  reftex-mode: t
  centered-cursor-mode: t
  magit-auto-revert-mode: t
  global-git-commit-mode: t
  async-bytecomp-package-mode: t
  shell-dirtrack-mode: t
  darkroom-mode: t
  global-auto-revert-mode: t
  TeX-fold-mode: t
  TeX-PDF-mode: t
  savehist-mode: t
  display-time-mode: t
  desktop-save-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  auto-fill-function: do-auto-fill

Load-path shadows:
/home/bronger/.emacs.d/elpa/auctex-12.3.1/tex-site hides 
/home/bronger/.emacs.d/lisp/tex-site
/home/bronger/.emacs.d/lisp/cmake-mode hides 
/usr/share/emacs/site-lisp/cmake-mode

Features:
(shadow sort mail-extr emacsbug sendmail face-remap magit-extras python
tramp-sh tramp tramp-loaddefs trampver tramp-integration files-x
tramp-compat ls-lisp dired-aux vc-git flyspell ispell reftex-dcr reftex
reftex-loaddefs reftex-vars font-latex latexenc tex-mode
centered-cursor-mode etags-table magit-submodule magit-obsolete
magit-blame magit-stash magit-reflog magit-bisect magit-push magit-pull
magit-fetch magit-clone magit-remote magit-commit magit-sequence
magit-notes magit-worktree magit-tag magit-merge magit-branch
magit-reset magit-files magit-refs magit-status magit magit-repos
magit-apply magit-wip magit-log which-func imenu magit-diff smerge-mode
diff diff-mode magit-core magit-autorevert magit-margin magit-transient
magit-process magit-mode git-commit transient magit-git magit-section
magit-utils log-edit pcvs-util add-log with-editor async-bytecomp async
shell dash graphviz-dot-mode taskjuggler-mode skeleton darkroom cql-mode
sql view rust-mode swift-mode go-errcheck go-mode find-file ffap etags
fileloop xref project yaml-mode dockerfile-mode rx sh-script smie
executable dired-x adaptive-wrap org-duration org-element avl-tree
generator ol-eww ol-rmail ol-mhe ol-irc ol-info ol-gnus nnselect
gnus-search eieio-opt cl-extra help-mode speedbar ezimage dframe
gnus-art mm-uu mml2015 mm-view mml-smime smime dig gnus-sum shr kinsoku
svg dom gnus-group gnus-undo gnus-start gnus-dbus gnus-cloud nnimap
nnmail mail-source utf7 netrc nnoo parse-time iso8601 gnus-spec gnus-int
gnus-range message rmc puny rfc822 mml mml-sec epa derived epg
epg-config mm-decode mm-bodies mm-encode mail-parse rfc2231 mailabbrev
gmm-utils mailheader gnus-win gnus nnheader gnus-util rmail
rmail-loaddefs rfc2047 rfc2045 ietf-drums mail-utils mm-util mail-prsvr
wid-edit ol-docview doc-view jka-compr image-mode exif dired
dired-loaddefs ol-bibtex bibtex ol-bbdb ol-w3m org-agenda ob-python org
ob ob-tangle ob-ref ob-lob ob-table ob-exp org-macro org-footnote
org-src ob-comint org-pcomplete pcomplete org-list org-faces
org-entities time-date noutline outline org-version ob-emacs-lisp
ob-core ob-eval org-table ol org-keys org-compat org-macs org-loaddefs
format-spec find-func server mmm-mode mmm-univ mmm-class mmm-region
mmm-auto mmm-vars mmm-utils mmm-compat rst browse-kill-ring
bbdb-autoloads bbdb timezone cal-china lunar solar cal-dst cal-bahai
cal-islam cal-hebrew holidays hol-loaddefs appt diary-lib diary-loaddefs
cal-menu calendar cal-loaddefs preview reporter tex-buf latex
latex-flymake flymake-proc flymake compile text-property-search comint
ansi-color ring warnings thingatpt tex-ispell tex-style autorevert
filenotify tex-fold easy-mmode tex dbus xml crm advice texmathp edmacro
kmacro savehist time desktop frameset delsel cus-start cus-load tex-site
info package easymenu browse-url url url-proxy url-privacy url-expand
url-methods url-history url-cookie url-domsuf url-util mailcap
url-handlers url-parse auth-source cl-seq eieio eieio-core cl-macs
eieio-loaddefs password-cache json subr-x map url-vars seq byte-opt gv
bytecomp byte-compile cconv cl-loaddefs cl-lib iso-transl tooltip eldoc
electric uniquify ediff-hook vc-hooks lisp-float-type mwheel term/x-win
x-win term/common-win x-dnd tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode elisp-mode lisp-mode
prog-mode register page tab-bar menu-bar rfn-eshadow isearch timer
select scroll-bar mouse jit-lock font-lock syntax facemenu font-core
term/tty-colors frame minibuffer cl-generic cham georgian utf-8-lang
misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms
cp51932 hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese composite charscript charprop case-table epa-hook
jka-cmpr-hook help simple abbrev obarray cl-preloaded nadvice button
loaddefs faces cus-face macroexp files window text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote threads dbusbind inotify lcms2
dynamic-setting system-font-setting font-render-setting cairo x
multi-tty make-network-process emacs)

Memory information:
((conses 16 489247 50916)
 (symbols 48 39010 1)
 (strings 32 136893 11721)
 (string-bytes 1 4610070)
 (vectors 16 63227)
 (vector-slots 8 732383 72966)
 (floats 8 869 67)
 (intervals 56 23909 2046)
 (buffers 984 39))

-- 
Torsten Bronger