Subject: bug#11541: 24.0.97; Crash when visiting file on OS X 10.7.3

From: Chong Yidong <[email-masked]>
Date: Wed, 30 May 2012 21:36:30 +0800

"C. Florian Ebeling" <[email-masked]> writes:

> (gdb) p scratch_font_spec
> $1 = 4338015181
> (gdb) xtype
> Lisp_Vectorlike
> PVEC_FONT
> (gdb) pp scratch_font_spec
> #<font-spec ns apple nil nil iso10646-1 nil nil nil nil nil nil nil
> ((:script . symbol))>

Interesting.  We need to pin down where the stack clobbering is taking
place; I don't see an obvious problem in the code, so let's just do it
by brute force.  Could you apply the following patch (which adds three
abort conditions to the code), trigger the bug again, then see where the
abort takes place?

=== modified file 'src/nsfont.m'
*** src/nsfont.m	2012-01-19 07:21:25 +0000
--- src/nsfont.m	2012-05-30 13:32:44 +0000
***************
*** 511,519 ****
--- 511,529 ----
  	debug_print (font_spec);
        }
  
+     if (!FONT_SPEC_P (font_spec))
+       abort ();
+ 
      cFamilies = ns_get_covering_families (ns_get_req_script (font_spec), 0.90);
  
+     if (!FONT_SPEC_P (font_spec))
+       abort ();
+ 
      fdesc = ns_spec_to_descriptor (font_spec);
+ 
+     if (!FONT_SPEC_P (font_spec))
+       abort ();
+ 
      fkeys = [NSMutableSet setWithArray: [[fdesc fontAttributes] allKeys]];
      if (isMatch)
  	[fkeys removeObject: NSFontFamilyAttribute];