Segmentation violation in display_string

[Milan Zamazal]

CVS Emacs dated 2005-05-23 often crashes with segmentation violation.
I'm sorry, I don't know a way how to reproduce the bug and it happens on
a computer of another user.  But I have remote access to gdb on that
computer, so I can provide information about Emacs state after the
crash.

The backtrace looks as follows:

#0  0x0807a01b in display_string (string=0x0, lisp_string=0, 
face_string=137388049, face_string_pos=0, start=0, it=0xbfffde30,
    field_width=0, precision=0, max_x=127, multibyte=0) at xdisp.c:17092
#1  0x0807889b in display_mode_element (it=0xbfffde30, depth=4, 
field_width=-14, precision=-14, elt=148322947,
    props=137388049, risky=0) at xdisp.c:15811
#2  0x08078542 in display_mode_element (it=0xbfffde30, depth=3, 
field_width=-14, precision=-14, elt=146806181,
    props=137388049, risky=0) at xdisp.c:15970
#3  0x0807844c in display_mode_element (it=0xbfffde30, depth=1, 
field_width=0,precision=0, elt=148007253, props=137388049,
    risky=0) at xdisp.c:16036
#4  0x08079063 in Fformat_mode_line (format=148007277, face=0, 
window=-1073750480, buffer=147410876) at xdisp.c:16252
#5  0x0814b249 in Ffuncall (nargs=2, args=0xbfffe0f0) at eval.c:2798
#6  0x081743de in Fbyte_code (bytestr=137754697, vector=1, 
maxdepth=-1073749664) at bytecode.c:686
#7  0x0814b5e3 in funcall_lambda (fun=143991188, nargs=0, 
arg_vector=0xbfffe2a8) at eval.c:2976
#8  0x0814b0cd in Ffuncall (nargs=1, args=0xbfffe2a4) at eval.c:2844
#9  0x081743de in Fbyte_code (bytestr=137645897, vector=0, 
maxdepth=-1073749340) at bytecode.c:686
#10 0x0814b5e3 in funcall_lambda (fun=143729444, nargs=1, 
arg_vector=0xbfffe3f4) at eval.c:2976
#11 0x0814b0cd in Ffuncall (nargs=2, args=0xbfffe3f0) at eval.c:2844
#12 0x0814ae80 in call1 (fn=143729444, arg1=143799473) at eval.c:2579
#13 0x0815484f in mapcar1 (leni=13, vals=0xbfffe470, fn=143729444, seq=0) at 
fns.c:3137
#14 0x08154b54 in Fmapcar (function=0, sequence=143959637) at fns.c:3205
#15 0x0814b206 in Ffuncall (nargs=3, args=0xbfffe558) at eval.c:2790
#16 0x081743de in Fbyte_code (bytestr=143796089, vector=2, 
maxdepth=-1073748652) at bytecode.c:686
#17 0x0814b5e3 in funcall_lambda (fun=143801548, nargs=0, 
arg_vector=0xbfffe688) at eval.c:2976
#18 0x0814b0cd in Ffuncall (nargs=1, args=0xbfffe684) at eval.c:2844
#19 0x081743de in Fbyte_code (bytestr=137475633, vector=0, 
maxdepth=-1073748348) at bytecode.c:686
#20 0x0814b5e3 in funcall_lambda (fun=143880644, nargs=6, 
arg_vector=0xbfffe7b4) at eval.c:2976
#21 0x0814b0cd in Ffuncall (nargs=7, args=0xbfffe7b0) at eval.c:2844
#22 0x081743de in Fbyte_code (bytestr=137496369, vector=6, 
maxdepth=-1073748048) at bytecode.c:686
#23 0x0814a67c in Feval (form=137107544) at eval.c:2139
#24 0x0814938a in Fcondition_case (args=137388049) at eval.c:1336
#25 0x0817535b in Fbyte_code (bytestr=139703281, vector=143, 
maxdepth=-1073747392) at bytecode.c:864
#26 0x0814a67c in Feval (form=137107544) at eval.c:2139
#27 0x0814938a in Fcondition_case (args=137388049) at eval.c:1336
#28 0x0817535b in Fbyte_code (bytestr=143520089, vector=143, 
maxdepth=-1073746736) at bytecode.c:864
#29 0x0814b5e3 in funcall_lambda (fun=143988092, nargs=0, 
arg_vector=0xbfffee7c) at eval.c:2976
#30 0x0814b0cd in Ffuncall (nargs=1, args=0xbfffee78) at eval.c:2844
#31 0x0814acc2 in run_hook_with_args (nargs=1, args=0xbfffee78, 
cond=to_completion) at eval.c:2447
#32 0x0814aad0 in Frun_hooks (nargs=1, args=0xbfffef34) at eval.c:2316
#33 0x0814b387 in Ffuncall (nargs=2, args=0xbfffef30) at eval.c:2768
#34 0x0814ae80 in call1 (fn=137472833, arg1=137441065) at eval.c:2579
#35 0x080e985c in safe_run_hooks_1 (hook=-1073746048) at keyboard.c:2026
#36 0x0814949e in internal_condition_case (bfun=0x80e9840 <safe_run_hooks_1>, 
handlers=137388097,
    hfun=0x80e9860 <safe_run_hooks_error>) at eval.c:1389
#37 0x080e98fc in safe_run_hooks (hook=0) at keyboard.c:2054
#38 0x080e8fe5 in command_loop_1 () at keyboard.c:1436
#39 0x0814949e in internal_condition_case (bfun=0x80e8040 <command_loop_1>, 
handlers=137449017, hfun=0x80e7b30 <cmd_error>)
    at eval.c:1389
#40 0x080e7e8e in command_loop_2 () at keyboard.c:1318
#41 0x08148f9b in internal_catch (tag=0, func=0x80e7e60 <command_loop_2>, 
arg=137388049) at eval.c:1148
#42 0x080e7e33 in command_loop () at keyboard.c:1297
#43 0x080e7894 in recursive_edit_1 () at keyboard.c:990
#44 0x080e79d1 in Frecursive_edit () at keyboard.c:1051
#45 0x080e5f3d in main (argc=3, argv=0xbffff774) at emacs.c:1775

Additional information:

- The segmentation violation happens, because the value of glyph_row
  (and it->glyph_row) is 0x0.
  
- The Lisp value of `elt' in frame #1 is "Brailcom - Tituln? str?nka"
  with some non-ASCII characters in place of the question marks.

- The same bug seems to be present already in CVS Emacs dated
  2005-05-07 (I didn't check older versions).

Regards,

Milan Zamazal

-- 
  _/_\_/_  o     _\_/_\_  o     _/_\_/_  o     _\_/_\_  o    BEWARE!
-<_|_|_|_><--  -<_|_|_|_><--  -<_|_|_|_><--  -<_|_|_|_><--   *Bugs* are
   / \ /   o      \ / \   o      / \ /   o      \ / \   o     approaching!