Subject: bug#18162: 24.3.92; segfault on null face pointer in face_for_char

From: Eli Zaretskii <[email-masked]>
Date: Sat, 02 Aug 2014 15:50:48 +0300

> Date: Sat, 02 Aug 2014 13:41:12 +0300
> From: Eli Zaretskii <[email-masked]>
> Cc: [email-masked]
> 
> > From: Ken Raeburn <[email-masked]>
> > Date: Sat, 2 Aug 2014 06:00:34 -0400
> > Cc: [email-masked]
> > 
> >   emacs -Q
> >   M-x list-faces-display RET
> > Type into the scratch buffer:
> >   (progn (clear-face-cache t) (internal-char-font nil 8230))
> > Hit C-j to evaluate. This generally works the first time. Move the cursor back up to the end of the expression and hit C-j again. The second time usually crashes for me.
> 
> It didn't crash for me.

Moreover, even if I force the call to clear_font_cache by invoking
clear-font-cache in the progn, I don't see a crash, and the use count
of the frame's face cache is not zero.

So one way of tracking this down would be to put a breakpoint in
Fclear_face_cache, and when it breaks, step through the function until
it assigns the frame pointer to 'f', and put a watchpoint on
f->face_cache->used, to see which code zeroes it.  My guess would be
that some code calls free_realized_faces (I misremembered earlier:
clear_face_cache doesn't do that).