21.2.31 balloon-help crash on Solaris 2.7
Built 21.2.31 from a full tarball on Solaris 2.7 using gcc 2.7.2.x.
The following recipe gives me a 100% repeatable crash when
balloon-help tries to pop up its help window.
xemacs -vanilla
In the *scratch* buffer, evaluate the following
(balloon-help-mode)
Now place the mouse over one of the toolbar buttons. Instant crash.
Here's the Lisp backtrace:
Lisp backtrace follows:
# (unwind-protect ...)
# (catch #<INTERNAL OBJECT (XEmacs bug?) (opaque_ptr, adr=0x2b31f8) 0x318000>
...)
# (unwind-protect ...)
# (unwind-protect ...)
# bind (inhibit-quit)
# (condition-case ... . error)
# (catch top-level ...)
Abort (core dumped)
Here's the C backtrace:
#0 0xfec16870 in _libc_kill () from /usr/lib/libc.so.1
#1 0xa3870 in fatal_error_signal (sig=6) at emacs.c:272
#2 <signal handler called>
#3 0xfec16870 in _libc_kill () from /usr/lib/libc.so.1
#4 0xfebb92a4 in abort () from /usr/lib/libc.so.1
#5 0xa6598 in assert_failed (file=0x261ff8 "glyphs.h", line=808,
expr=0x262058 "RECORD_TYPEP (obj, lrecord_type_glyph)") at emacs.c:2770
#6 0x147d5c in text_query_geometry (image_instance=7900800, width=0xffbed8e0,
height=0xffbed8dc,
disp=IMAGE_DESIRED_GEOMETRY, domain=7829504) at glyphs.c:1168
#7 0x13f91c in image_instance_layout (image_instance=7900800, width=4294967295,
height=4294967295, domain=7829504) at glyphs.c:1699
#8 0x13c5cc in instantiate_image_instantiator (device=6454272, domain=7829504,
instantiator=7779296, pointer_fg=6919424, pointer_bg=6700384, dest_mask=-1,
glyph=3276160)
at glyphs.c:615
#9 0x141f90 in image_instantiate (specifier=2599060, matchspec=6454272, domain=7829504,
instantiator=7779296, depth=6919424) at glyphs.c:2831
#10 0xaa504 in call_with_suspended_errors_1 (opaque_arg=-4269120) at eval.c:2046
#11 0xaa924 in call_with_suspended_errors (fun=0x1419b4 <image_instantiate>,
retval=2599060,
class=3024900, errb=Cannot access memory at address 0x2a.
) at eval.c:1304
#12 0x1c1b4c in specifier_instance_from_inst_list (specifier=3560896, matchspec=2599060,
domain=7829504, inst_list=6340592, errb=Cannot access memory at address 0x2a.
) at specifier.c:2455
#13 0x1c1f10 in specifier_instance (specifier=3560896, matchspec=2599060, domain=7829504,
errb=
Cannot access memory at address 0x2a.
) at specifier.c:2564
#14 0x116e90 in update_face_cachel_data (cachel=0xffbede28, domain=7829504, face=3276160)
at faces.c:1194
#15 0x117abc in add_face_cachel (w=0x777800, face=3276160) at faces.c:1330
#16 0x117d38 in reset_face_cachels (w=0x777800) at faces.c:1361
#17 0x196c4c in redisplay_window (window=7829504, skip_selected=1) at redisplay.c:5936
#18 0x197ad8 in redisplay_frame (f=0x777a00, preemption_check=268435456) at
redisplay.c:6410
#19 0x197ec0 in redisplay_device (d=0x627c00, automatic=7830016) at redisplay.c:6518
#20 0x1982ac in redisplay_without_hooks () at redisplay.c:6577
#21 0x198514 in redisplay () at redisplay.c:6634
#22 0xfbadc in Fnext_event (event=7662616, prompt=3024900) at event-stream.c:2238
#23 0x87708 in Fcommand_loop_1 () at cmdloop.c:566
#24 0x874ac in command_loop_1 (dummy=3024900) at cmdloop.c:490
#25 0xa9764 in condition_case_1 (handlers=2804736, bfun=0x87460 <command_loop_1>,
barg=3024900,
hfun=0x878f8 <cmd_error>, harg=3024900) at eval.c:1629
#26 0x87a08 in command_loop_2 (dummy=3024900) at cmdloop.c:252
#27 0xa9338 in internal_catch (tag=3107060, func=0x879bc <command_loop_2>,
arg=3024900, threw=0x0)
at eval.c:1304
#28 0x86de0 in initial_command_loop (load_me=555452) at cmdloop.c:301
#29 0xa540c in xemacs_21_2_b31_sparc_sun_solaris2_7 (argc=2, argv=0xffbeeb5c,
envp=0xffbeeb68,
restart=0) at emacs.c:1879
#30 0xa5c28 in main (argc=2, argv=0xffbeeb5c, envp=0xffbeeb68) at emacs.c:2305