Subject: bug#17688: 24.3.90; segmentation fault in deselect_palette

From: Eli Zaretskii <[email-masked]>
Date: Wed, 04 Jun 2014 18:58:50 +0300

> From: Zdzislaw Meglicki <[email-masked]>
> Date: Wed, 04 Jun 2014 10:46:39 -0400
> 
>    On copy and paste between emacs and Firefox windows.
>    Emacs, which I had been running under gdb, crashed
>    on segmentation fault. It is the second time that this
>    has happened, with nearly identical backtraces.

Is this reproducible?  If so, can you post a reproducible recipe
starting with "emacs -Q"?

> (gdb) bt full
> #0  0x0000000100631d84 in deselect_palette (f=0x0, hdc=0x0)
>     at /usr/src/debug/emacs-24.3.90-1/src/w32xfns.c:123
> No locals.
> #1  0x0000000100631e53 in release_frame_dc (f=0x0, hdc=0x0)
>     at /usr/src/debug/emacs-24.3.90-1/src/w32xfns.c:154
>         ret = 0
> #2  0x00000001006351f9 in uniscribe_encode_char (
>     font=0x101071d30 <bss_sbrk_buffer+6928560>, c=76)
>     at /usr/src/debug/emacs-24.3.90-1/src/w32uniscribe.c:585
>         context = 0x0
>         f = 0x0
>         old_font = 0x0
>         code = 15
>         ch = L"LC"
>         len = 1
>         items = 0x436980
>         nitems = 1
>         uniscribe_font = 0x101071d30 <bss_sbrk_buffer+6928560>

This backtrace makes no sense: uniscribe_encode_char calls
release_frame_dc only if the variable 'context' has a non-NULL value
(and then 'f' should also be non-NULL).  But here we see that
release_frame_dc is called by uniscribe_encode_char when both
'context' and 'f' are NULL, which cannot happen.  I was about to say
that this could be due to compiler optimizations that screw up the
backtrace, but then I saw that your Emacs binary was built with -O0.
So now I'm stumped how could this happen at all.