Moving mouse in balloon-help frame crashes XEmacs-21.2-b15 in MSWin

This bug report will be sent to the XEmacs Development Team, not to your local site managers!! Please write in English, because the XEmacs maintainers do not have translators to read other languages for them. In XEmacs 21.1 "20 Minutes to Nikko" [Lucid] (i386-pc-win32) of Fri May 14 1999 on ZJ75T configured using `configure UNKNOWN' Please describe exactly what actions triggered the bug and the precise symptoms of the bug: Moving mouse in balloon-help crashes XEmacs-21.2-b15. This bug has been around for a long time. Now I decided to look into it. D:\export\home\tmp\21.2\xemacs\src>xemacs Fatal error: assertion failed, file ..\src\redisplay.c, line 6658, abort() To reproduce it, I need to load gnus and display-time. Moving mouse to mail envelope in mode-line brings up another XEmacs frame as a side-effect on MS-Windows. Moving the mouse around in this new frame will crash XEmacs with above assertion. Here's the source with the call to abort(): start_elt = point_in_line_start_cache (w, cur_start, 0); if (start_elt == -1) ==> abort (); /* this had better never happen */ while (1) Here's the VC++ Call Stack: NTDLL! 77f76148() start_end_of_last_line(window * 0x107f6000, int 1, int 1) line 6658 + 20 bytes end_of_last_line(window * 0x107f6000, int 1) line 6732 + 15 bytes pixel_to_glyph_translation(frame * 0x107e1200, int 15, int 53, int * 0x0082e354, int * 0x0082e348, int * 0x0082e338, int * 0x0082e33c, window * * 0x0082e358, int * 0x0082e35c, int * 0x0082e334, int * 0x0082e34c, Lisp_Object * 0x0082e350, Lisp_Object * 0x0082e344) line 7876 + 29 bytes event_pixel_translation(Lisp_Object {...}, int * 0x00000000, int * 0x00000000, int * 0x00000000, int * 0x00000000, window * * 0x0082e3a4, int * 0x00000000, int * 0x00000000, int * 0x00000000, Lisp_Object * 0x00000000, Lisp_Object * 0x00000000) line 1740 + 66 bytes Fevent_window(Lisp_Object {...}) line 1870 + 31 bytes Ffuncall(int 2, Lisp_Object * 0x0082e434) line 3189 + 80 bytes execute_optimized_program(const unsigned char * 0x1079d098, int 2, Lisp_Object * 0x101f0f54) line 748 + 16 bytes funcall_compiled_function(Lisp_Object {...}, int 1, Lisp_Object * 0x0082e710) line 524 + 53 bytes Ffuncall(int 2, Lisp_Object * 0x0082e70c) line 3221 + 17 bytes execute_optimized_program(const unsigned char * 0x107e1818, int 9, Lisp_Object * 0x1068c214) line 748 + 16 bytes funcall_compiled_function(Lisp_Object {...}, int 1, Lisp_Object * 0x0082eaf8) line 524 + 53 bytes Ffuncall(int 2, Lisp_Object * 0x0082eaf4) line 3221 + 17 bytes run_hook_with_args_in_buffer(buffer * 0x1068ce00, int 2, Lisp_Object * 0x0082eaf4, int 0) line 3671 + 13 bytes run_hook_with_args(int 2, Lisp_Object * 0x0082eaf4, int 0) line 3684 + 23 bytes Frun_hook_with_args(int 2, Lisp_Object * 0x0082eaf4) line 3560 + 15 bytes Ffuncall(int 3, Lisp_Object * 0x0082eaf0) line 3207 + 14 bytes execute_optimized_program(const unsigned char * 0x101077f8, int 3, Lisp_Object * 0x10624a34) line 748 + 16 bytes funcall_compiled_function(Lisp_Object {...}, int 1, Lisp_Object * 0x0082eddc) line 524 + 53 bytes Ffuncall(int 2, Lisp_Object * 0x0082edd8) line 3221 + 17 bytes call1(Lisp_Object {...}, Lisp_Object {...}) line 3834 + 11 bytes execute_internal_event(Lisp_Object {...}) line 2952 + 16 bytes Fnext_command_event(Lisp_Object {...}, Lisp_Object {...}) line 2398 + 9 bytes Ffuncall(int 1, Lisp_Object * 0x0082eeb0) line 3189 + 107 bytes execute_optimized_program(const unsigned char * 0x0082f09c, int 4, Lisp_Object * 0x102676d4) line 748 + 16 bytes Fbyte_code(Lisp_Object {...}, Lisp_Object {...}, Lisp_Object {...}) line 2398 + 38 bytes Feval(Lisp_Object {...}) line 2986 + 195 bytes internal_catch(Lisp_Object {...}, Lisp_Object (Lisp_Object)* 0x01002081 _Feval, Lisp_Object {...}, int * volatile 0x00000000) line 1315 + 7 bytes execute_rare_opcode(Lisp_Object * 0x0082f35c, const unsigned char * 0x107ab83f, int 141) line 1254 + 22 bytes execute_optimized_program(const unsigned char * 0x107ab818, int 8, Lisp_Object * 0x10266b14) line 658 + 17 bytes funcall_compiled_function(Lisp_Object {...}, int 0, Lisp_Object * 0x0082f650) line 524 + 53 bytes Ffuncall(int 1, Lisp_Object * 0x0082f64c) line 3221 + 17 bytes execute_optimized_program(const unsigned char * 0x103dba18, int 4, Lisp_Object * 0x10266c14) line 748 + 16 bytes funcall_compiled_function(Lisp_Object {...}, int 0, Lisp_Object * 0x0082f930) line 524 + 53 bytes Ffuncall(int 1, Lisp_Object * 0x0082f92c) line 3221 + 17 bytes execute_optimized_program(const unsigned char * 0x10177f18, int 6, Lisp_Object * 0x10266e14) line 748 + 16 bytes funcall_compiled_function(Lisp_Object {...}, int 0, Lisp_Object * 0x0082fb94) line 524 + 53 bytes Feval(Lisp_Object {...}) line 3045 + 20 bytes condition_case_1(Lisp_Object {...}, Lisp_Object (Lisp_Object)* 0x01002081 _Feval, Lisp_Object {...}, Lisp_Object (Lisp_Object, Lisp_Object)* 0x0105005b cmd_error(Lisp_Object, Lisp_Object), Lisp_Object {...}) line 1640 + 7 bytes top_level_1(Lisp_Object {...}) line 205 + 35 bytes internal_catch(Lisp_Object {...}, Lisp_Object (Lisp_Object)* 0x0104fff2 top_level_1(Lisp_Object), Lisp_Object {...}, int * volatile 0x00000000) line 1315 + 7 bytes initial_command_loop(Lisp_Object {...}) line 284 + 25 bytes STACK_TRACE_EYE_CATCHER(int 1, char * * 0x10108a10, char * * 0x102f2600, int 0) line 1756 + 9 bytes main(int 1, char * * 0x10108a10, char * * 0x102f2600) line 2181 + 21 bytes XEMACS! mainCRTStartup + 180 bytes _start() line 165 Recent keystrokes: C-p RET M-> misc-user RET misc-user n n n n n n n n RET x y C-x C-z C-x C-b button2 button2up p p p p p p p p p SPC C-x 1 SPC SPC DEL q s button1 button1up n SPC q s q y M-x g n u s RET C-x C-z g n n n p SPC SPC DEL n n SPC q p p SPC button1 button1up q SPC n n SPC n n n n n n n n SPC n n n n l s g p C-x C-z button1 button1up misc-user Recent messages (most recent first): Loading emacsbug...done Loading emacsbug... No more unread newsgroups Checking new news...done Checking new news... Reading active file via nnfolder...done Reading active file via nnfolder... Reading active file via nnfolder... Reading active file via nnml...done Reading active file via nnml... -- Adrian Aichner Teradyne GmbH, European Design Center Integra Test Division Telephone +49/89/41861(0)-208 Dingolfinger Strasse 2 Fax +49/89/41861-217 (What is a Fax?) D-81673 MUENCHEN E-mail adrian.aichner(a)teradyne.com