Subject: bug#55068: 29.0.50; crashes when trying to set default font

From: Gregor Zattler <[email-masked]>
Date: Fri, 22 Apr 2022 20:38:40 +0200

Dear emacs developers, emacs (Lucid) crashes when I try to
set the default font, see below.  All infos in this bug
report describea newly build emacs.  I send this bug report
with another build.

Receipt:

1. Start emacs -Q
2. click "Option" in menu bar
3. click "Set default Font" in drop down  menu
4. hoover over  "More Fonts" on context menu
5. click "by Family"
6. emacs crashes

0 (master=) grfz@no:~/src/emacs/src$ gdb ./emacs
[...]
Reading symbols from ./emacs...
SIGINT is used by the debugger.
Are you sure you want to change it? (y or n) [answered Y; input not from terminal]
DISPLAY = :0
TERM = screen-256color-bce-s
Breakpoint 1 at 0x1fbf3d: file emacs.c, line 420.
Breakpoint 2 at 0x1bf667: file xterm.c, line 19987.
(gdb) run -Q
Starting program: /home/grfz/src/emacs/src/emacs -Q
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffef807700 (LWP 350876)]
[New Thread 0x7fffeefe8700 (LWP 350877)]
[New Thread 0x7fffee7e7700 (LWP 350878)]
[Detaching after vfork from child process 352257]
[Detaching after vfork from child process 352260]

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
x_menu_show (f=0x555556143800, x=301, y=458, menuflags=0, title=XIL(0x7ffff02d86ec), error_name=0x7fffffffc078) at xmenu.c:1816
1816      specpdl_ref specpdl_count = SPECPDL_INDEX ();
(gdb) bt full
#0  x_menu_show (f=0x555556143800, x=301, y=458, menuflags=0, title=XIL(0x7ffff02d86ec), error_name=0x7fffffffc078) at xmenu.c:1816
        i = 21845
        wv = 0x0
        save_wv = 0x0
        first_wv = 0x0
        prev_wv = 0x0
        submenu_stack = 0x7fffff83cff0
        subprefix_stack = 0x7fffff07e0b0
        submenu_depth = 0
        specpdl_count = {
          bytes = 1
        }
        first_pane = 85
#1  0x0000555555650996 in x_popup_menu_1 (position=XIL(0x5555569a88f3), menu=XIL(0x5555569bed53)) at menu.c:1402
        keymap = XIL(0)
        tem = XIL(0)
        tem2 = XIL(0)
        xpos = 301
        ypos = 458
        title = XIL(0x7ffff02d86ec)
        error_name = 0x0
        selection = XIL(0)
        f = 0x555556143800
        x = make_fixnum(301)
        y = make_fixnum(458)
        window = XIL(0x555556143805)
        menuflags = 0
        specpdl_count = {
          bytes = 384
        }
#2  0x0000555555650a29 in Fx_popup_menu (position=XIL(0x5555569a88f3), menu=XIL(0x5555569bed53)) at menu.c:1466
#3  0x000055555584a19e in funcall_subr (subr=0x555555e6d960 <Sx_popup_menu>, numargs=2, args=0x7fffef835110) at eval.c:2913
        argbuf =
          {XIL(0x7fffffffc1b0), make_fixnum(23456248935332), XIL(0x7fffffffc1a0), XIL(0x1155e6d965), XIL(0x555555e6d965), XIL(0x7fffffffc1c0), XIL(0x5555558ac8ff), XIL(0x555555e6d965)}
        a = 0x7fffef835110
        fun = XIL(0x5555558ac0dd)
#4  0x00005555558ae2ee in exec_byte_code (fun=XIL(0x7ffff0291405), args_template=513, nargs=1, args=0x7fffef835218) at bytecode.c:809
        call_nargs = 2
        call_fun = XIL(0x555555e6d965)
        count1 = {
          bytes = 352
        }
        template = make_fixnum(513)
        val = XIL(0x5555586f0994)
        call_args = 0x7fffef835110
        original_fun = XIL(0x2aaa9a357638)
        bytecode = XIL(0x7ffff02914a4)
        op = 2
        type = CATCHER
        targets =
        quitcounter = 115 's'
        bc = 0x555555e69750 <main_thread+496>
        top = 0x7fffef835108
        pc = 0x7ffff0a5d5f3 "@\207\207"
        bytestr = XIL(0x7ffff02914a4)
        vector = XIL(0x7ffff0291445)
        maxdepth = make_fixnum(10)
        const_length = 7
        bytestr_length = 29
        vectorp = 0x7ffff04d0670
        max_stack = 10
        frame_base = 0x7fffef835240
        fp = 0x7fffef835290
        bytestr_data = 0x7ffff0a5d5bc "\302 \204\t"
        rest = false
        mandatory = 1
        nonrest = 2
        pushedargs = 1
        result = XIL(0x555556084254)
#5  0x000055555584a52d in fetch_and_exec_byte_code (fun=XIL(0x7ffff04d0575), args_template=0, nargs=0, args=0x7fffffffcb50) at eval.c:2960
#6  0x000055555584a9bc in funcall_lambda (fun=XIL(0x7ffff04d0575), nargs=0, arg_vector=0x7fffffffcb50) at eval.c:3032
        val = XIL(0x2aaa9a5bc880)
        syms_left = make_fixnum(0)
        next = make_fixnum(23456248823624)
        lexenv = XIL(0x7fffffffc730)
        count = {
          bytes = 320
        }
        i = 119995696320
        optional = false
        rest = false
        previous_rest = false
#7  0x0000555555849c9e in funcall_general (fun=XIL(0x7ffff04d0575), numargs=0, args=0x7fffffffcb50) at eval.c:2823
        original_fun = XIL(0x2aaa9a5bc880)
#8  0x0000555555849f29 in Ffuncall (nargs=1, args=0x7fffffffcb48) at eval.c:2873
        count = {
          bytes = 288
        }
        val = make_fixnum(23456248819845)
#9  0x000055555583cf42 in Ffuncall_interactively (nargs=1, args=0x7fffffffcb48) at callint.c:260
        speccount = {
          bytes = 256
        }
#10 0x000055555584a3a5 in funcall_subr (subr=0x555555e80c20 <Sfuncall_interactively>, numargs=1, args=0x7fffffffcb48) at eval.c:2938
        fun = make_fixnum(23456248823645)
#11 0x0000555555849c52 in funcall_general (fun=XIL(0x555555e80c25), numargs=1, args=0x7fffffffcb48) at eval.c:2819
        original_fun = XIL(0x7b30)
#12 0x0000555555849f29 in Ffuncall (nargs=2, args=0x7fffffffcb40) at eval.c:2873
        count = {
          bytes = 224
        }
        val = make_fixnum(23456248823808)
#13 0x0000555555848d5d in Fapply (nargs=3, args=0x7fffffffcb40) at eval.c:2503
        i = 140737488341424
        funcall_nargs = 93825002485616
        funcall_args = 0x0
        spread_arg = XIL(0)
        fun = XIL(0x7b30)
        sa_avail = 16384
        sa_count = {
          bytes = 224
        }
        numargs = 0
        retval = XIL(0x55555583b9d7)
#14 0x000055555583d3d6 in Fcall_interactively (function=XIL(0x2aaa9a5bc880), record_flag=XIL(0), keys=XIL(0x7ffff0962d25)) at callint.c:353
        funval = XIL(0x7ffff04d0575)
        events = 6
        input = XIL(0)
        speccount = {
          bytes = 192
        }
        arg_from_tty = false
        key_count = 3
        record_then_fail = false
        save_this_command = XIL(0x2aaa9a5bc880)
        save_this_original_command = XIL(0x2aaa9a5bc880)
        save_real_this_command = XIL(0x2aaa9a5bc880)
        save_last_command = XIL(0x2aaa9a5bc880)
        prefix_arg = XIL(0)
        enable = XIL(0)
        up_event = XIL(0)
        form = XIL(0x5555569a8b23)
        specs = XIL(0)
        sa_avail = 140737488341648
        sa_count = {
          bytes = 140737488341600
        }
        string_len = 0
        string = 0x55555581b103 <XSYMBOL+100> "\353\030H\213E\370H\211\307\350\353\376\377\377H\213@\bH\211\307\350(\377\377\377\311\303UH\211\345H\203\354 H\211}\350H\215\025\016\213o"
        string_end = 0x0
        next_event = 140737488341680
        nargs = 140737488341696
        args = 0x0
        visargs = 0x555555f13c40 <lispsym>
        varies = 0x7fffffffcb00 " \313\377\377\377\177"
        tem = 0x555555f13c40 <lispsym> "\230\001"
        val = XIL(0x60)
#15 0x000055555584a1cd in funcall_subr (subr=0x555555e80c80 <Scall_interactively>, numargs=3, args=0x7fffef835070) at eval.c:2915
        argbuf =
          {XIL(0x7fffffffcc10), make_fixnum(23456248935332), XIL(0x7fffffffcc00), XIL(0x1155e80c85), XIL(0x555555e80c85), XIL(0x7fffffffcc20), XIL(0x5555558ac8ff), XIL(0x555555e80c85)}
        a = 0x7fffef835070
        fun = XIL(0x5555558ac0dd)
#16 0x00005555558ae2ee in exec_byte_code (fun=XIL(0x7ffff025eedd), args_template=1025, nargs=1, args=0x7fffffffd260) at bytecode.c:809
        call_nargs = 3
        call_fun = XIL(0x555555e80c85)
        count1 = {
          bytes = 160
        }
        template = XIL(0)
        val = XIL(0)
        call_args = 0x7fffef835070
        original_fun = XIL(0x2aaa9a313c38)
        bytecode = XIL(0x555555e7b7c5)
        op = 3
        type = CATCHER
        targets =
        quitcounter = 1 '\001'
        bc = 0x555555e69750 <main_thread+496>
        top = 0x7fffef835068
        pc = 0x7ffff09c211f "\006\a9\203\260"
        bytestr = XIL(0x7ffff025f764)
        vector = XIL(0x7ffff025ef1d)
        maxdepth = make_fixnum(14)
        const_length = 26
        bytestr_length = 179
        vectorp = 0x7ffff025ef20
        max_stack = 14
        frame_base = 0x7fffef835030
        fp = 0x7fffef8350a0
        bytestr_data = 0x7ffff09c2096 "\304\020\211?\205\023"
        rest = false
        mandatory = 1
        nonrest = 4
        pushedargs = 1
        result = XIL(0x55555581d943)
#17 0x000055555584a52d in fetch_and_exec_byte_code (fun=XIL(0x7ffff025eedd), args_template=1025, nargs=1, args=0x7fffffffd258) at eval.c:2960
#18 0x000055555584a9bc in funcall_lambda (fun=XIL(0x7ffff025eedd), nargs=1, arg_vector=0x7fffffffd258) at eval.c:3032
        val = XIL(0x4980)
        syms_left = make_fixnum(1025)
        next = make_fixnum(23456248823624)
        lexenv = XIL(0x7fffffffd190)
        count = {
          bytes = 160
        }
        i = 117406008768
        optional = false
        rest = false
        previous_rest = false
#19 0x0000555555849c9e in funcall_general (fun=XIL(0x7ffff025eedd), numargs=1, args=0x7fffffffd258) at eval.c:2823
        original_fun = XIL(0x4980)
#20 0x0000555555849f29 in Ffuncall (nargs=2, args=0x7fffffffd250) at eval.c:2873
        count = {
          bytes = 128
        }
        val = make_fixnum(23456248582844)
#21 0x0000555555755c34 in call1 (fn=XIL(0x4980), arg1=XIL(0x2aaa9a5bc880)) at lisp.h:3218
#22 0x0000555555759509 in command_loop_1 () at keyboard.c:1514
        scount = {
          bytes = 96
        }
        cmd = XIL(0x2aaa9a5bc880)
        keybuf =
        i = 3
        prev_modiff = 16
        prev_buffer = 0x7ffff020e708
        already_adjusted = false
#23 0x00005555558458e6 in internal_condition_case (bfun=0x555555758c25 <command_loop_1>, handlers=XIL(0x90), hfun=0x55555575805f <cmd_error>) at eval.c:1450
        val = XIL(0x7fffffffd420)
        c = 0x5555560691a0
#24 0x000055555575880e in command_loop_2 (handlers=XIL(0x90)) at keyboard.c:1142
        val = make_fixnum(0)
#25 0x0000555555844ab7 in internal_catch (tag=XIL(0xf450), func=0x5555557587e7 <command_loop_2>, arg=XIL(0x90)) at eval.c:1180
        val = make_fixnum(23456248582865)
        c = 0x555555f6b600
#26 0x00005555557587a3 in command_loop () at keyboard.c:1120
#27 0x0000555555757b22 in recursive_edit_1 () at keyboard.c:729
        count = {
          bytes = 32
        }
        val = XIL(0x55555584bf20)
#28 0x0000555555757d3f in Frecursive_edit () at keyboard.c:812
        count = {
          bytes = 0
        }
        buffer = XIL(0)
#29 0x0000555555753345 in main (argc=2, argv=0x7fffffffd738) at emacs.c:2474
        stack_bottom_variable = 0x7ffff5fe03c0
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = true
        rlim = {
          rlim_cur = 10022912,
          rlim_max = 18446744073709551615
        }
        lc_all = 0x7fffffffee1b ""
        sockfd = -1
        module_assertions = false
Cannot access memory at address 0x7fffff07e02f
(gdb) xbacktrace
Cannot access memory at address 0x7fffff07e02f
(gdb)

Configured using:
 'configure -C --prefix=/usr/local/stow/emacs-snapshot
 --enable-locallisppath=/etc/emacs:/usr/local/share/emacs/29.0/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/29.0/site-lisp:/usr/share/emacs/site-lisp
 --with-sound=yes --without-gconf --with-mailutils --build
 x86_64-linux-gnu --infodir=/usr/local/share/info:/usr/share/info
 --with-json --with-file-notification=yes --with-cairo --with-x=yes
 --with-x-toolkit=lucid --without-toolkit-scroll-bars
 --enable-checking=yes,glyphs --enable-check-lisp-object-type
 --with-native-compilation 'CFLAGS=-g3 -O0
 -ffile-prefix-map=/home/grfz/src/emacs=. -fstack-protector-strong
 -Wformat -Werror=format-security ''

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ JPEG
JSON LCMS2 LIBOTF LIBSELINUX LIBSYSTEMD LIBXML2 M17N_FLT MODULES
NATIVE_COMP NOTIFY INOTIFY PDUMPER PNG RSVG SECCOMP SOUND THREADS TIFF
X11 XAW3D XDBE XIM XPM LUCID ZLIB

Important settings:
  value of $LC_ALL: 
  value of $LC_COLLATE: de_DE.utf8
  value of $LC_CTYPE: de_DE.utf8
  value of $LC_MESSAGES: POSIX
  value of $LC_MONETARY: de_DE.utf8
  value of $LC_NUMERIC: de_DE.utf8
  value of $LC_TIME: de_DE.utf8
  value of $LANG: de_DE.utf8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  line-number-mode: t
  indent-tabs-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message mailcap yank-media rmc puny
dired dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg
rfc6068 epg-config gnus-util text-property-search mm-decode mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail
rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils time-date comp
comp-cstr warnings rx cl-seq cl-macs cl-extra help-mode seq gv subr-x
byte-opt cl-loaddefs cl-lib bytecomp byte-compile cconv iso-transl
tooltip eldoc paren electric uniquify ediff-hook vc-hooks
lisp-float-type elisp-mode mwheel term/x-win x-win term/common-win x-dnd
tool-bar dnd fontset image regexp-opt fringe tabulated-list replace
newcomment text-mode lisp-mode prog-mode register page tab-bar menu-bar
rfn-eshadow isearch easymenu timer select scroll-bar mouse jit-lock
font-lock syntax font-core term/tty-colors frame minibuffer nadvice
simple cl-generic cham georgian utf-8-lang misc-lang vietnamese tibetan
thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek romanian
slovak czech european ethiopic indian cyrillic chinese composite
emoji-zwj charscript charprop case-table epa-hook jka-cmpr-hook help
abbrev obarray oclosure cl-preloaded button loaddefs faces cus-face
macroexp files window text-properties overlay sha1 md5 base64 format env
code-pages mule custom widget keymap hashtable-print-readable backquote
threads dbusbind inotify lcms2 dynamic-setting system-font-setting
font-render-setting cairo x-toolkit x multi-tty make-network-process
native-compile emacs)

Memory information:
((conses 16 70361 8461)
 (symbols 48 7467 1)
 (strings 32 21008 3854)
 (string-bytes 1 669651)
 (vectors 16 15130)
 (vector-slots 8 227932 13413)
 (floats 8 27 28)
 (intervals 56 275 0)
 (buffers 992 11))