bug#968: 23.0.60; CVS Emacs.app crashes randomly

[pat . maddox]

Emacs.app randomly crashes on me when in normal use.  I can be editing code, 
using gnus, or simply composing an email.  It's happened when I try to save a 
file, when I switch to emacs from another app, or when I hit return a couple 
times.  So it just seems to happen randomly.  It doesn't hang, it just exits 
immediately (without prompting me to save any files)

When I run it in gdb, instead of crashing instantly, it hangs.  I assume this 
is the point where the crash usually happens, but gdb is preventing it from 
quitting entirely.  Here's the message I see in gdb when it crashes:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000070
ns_free_indexed_color (idx=0, f=0x0) at nsterm.m:1302
1302      struct ns_color_table *color_table = FRAME_NS_DISPLAY_INFO 
(f)->color_table;

***********************************
** Output of 'bt full'

(gdb) bt full
#0  ns_free_indexed_color (idx=0, f=0x3a) at nsterm.m:1302
        color_table = <value temporarily unavailable, due to optimizations>
#1  0x0018917a in x_clear_image_1 (f=<value temporarily unavailable, due to 
optimizations>, img=0x2ebc2c0, pixmap_p=<value temporarily unavailable, due to 
optimizations>, mask_p=1, colors_p=1) at image.c:1627
No locals.
#2  0x00188bd3 in free_image (f=0x0, img=0x2ebc2c0) at image.c:1322
        c = (struct image_cache *) 0x2e11280
#3  0x0018951b in clear_image_cache (f=0x8a0510, filter=25165833) at 
image.c:1836
        img = (struct image *) 0x2ebc2c0
        t = {
  tv_sec = 1221201734, 
  tv_usec = 151573
}
        old = 1221199934
        i = 0
        nfreed = 0
        c = (struct image_cache *) 0x2e11280
#4  0x001895f6 in clear_image_caches (filter=25165833) at image.c:1873
        tail = 4055040
#5  0x00036378 in redisplay_internal (preserve_echo_area=<value temporarily 
unavailable, due to optimizations>) at xdisp.c:11981
        w = (struct window *) 0x8a0690
        f = <value temporarily unavailable, due to optimizations>
        pause = 0
        must_finish = 1
        tlbufpos = {
  charpos = 1, 
  bytepos = 25328521
}
        number_of_visible_frames = 1
        polling_stopped_here = 1
        old_frame = 9045268
        consider_all_windows_p = <value temporarily unavailable, due to 
optimizations>
#6  0x0009c6cc in read_char (commandflag=1, nmaps=7, maps=0xbffff210, 
prev_event=25165833, used_mouse_menu=0xbffff318, end_time=0x0) at 
keyboard.c:2649
        echo_current = 1
        c = 25165833
        count = <value temporarily unavailable, due to optimizations>
        jmpcount = 25193345
        local_getcjmp = {25165833, 594240, 25165833, 717563, 1408420, 80, 
426214788, -1073745496, 1408757, 426214784, 80, 99, 965706, 966718, 25253257, 
-1073745544, 33359185, -1073745524}
        save_jump = {25193345, 426214788, 594257, 56713426, -1073745284, 
-1073745640, 1064427, 25278009, 25278008, -1073745608, 1064739, 25278009, 
25165833, 426214784, 1, -1073745504, 3466748, 25165833}
        key_already_recorded = 0
        tem = <value temporarily unavailable, due to optimizations>
        save = <value temporarily unavailable, due to optimizations>
        previous_echo_area_message = 25165833
        also_record = 25165833
        reread = 0
        polling_stopped_here = <value temporarily unavailable, due to 
optimizations>
        orig_kboard = (struct kboard *) 0x83dec0
#7  0x0009f124 in read_key_sequence (keybuf=0xbffff3d8, bufsize=30, 
prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1, 
fix_current_buffer=1) at keyboard.c:9340
        interrupted_kboard = (KBOARD *) 0x83dec0
        key = 0
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 25165833
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 7
        nmaps_allocated = 7
        defs = (Lisp_Object * volatile) 0xbffff1e0
        submaps = (Lisp_Object * volatile) 0xbffff210
        orig_local_map = 20866517
        orig_keymap = 25165833
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 8031565, 
  map = 8031565, 
  start = 0, 
  end = 0
}
        keytran = {
  parent = 4140925, 
  map = 4140925, 
  start = 0, 
  end = 0
}
        indec = {
  parent = 8031573, 
  map = 8031573, 
  start = 0, 
  end = 0
}
        shift_translated = 0
        delayed_switch_frame = 25165833
        original_uppercase = 3202432
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x19678580
        fake_prefixed_keys = 25165833
#8  0x000a164a in command_loop_1 () at keyboard.c:1621
        cmd = <value temporarily unavailable, due to optimizations>
        lose = <value temporarily unavailable, due to optimizations>
        nonundocount = 0
        keybuf = {104, 384, 3467432, 25165833, -1073744792, 622864, 50056877, 
-1073744866, -1073744840, -1880941348, 4055049, 152, -1073744866, 25165833, 17, 
9, 0, -1895817508, 5258902, 1, -1073744776, -1773935801, 50389008, 0, 
-1073744820, -1073745008, 0, 3866624, 25165833, 33429633}
        i = 1
        prev_modiff = 22
        prev_buffer = (struct buffer *) 0x19678580
        already_adjusted = 0
#9  0x0010382d in internal_condition_case (bfun=0xa1410 <command_loop_1>, 
handlers=25205497, hfun=0x98030 <cmd_error>) at eval.c:1511
        val = <value temporarily unavailable, due to optimizations>
        c = {
  tag = 25165833, 
  val = 25165833, 
  next = 0xbffff58c, 
  gcpro = 0x0, 
  jmp = {-1073806465, -1880940836, 8098, 1062715, 25165833, 25165833, 3466684, 
3466748, -1073744600, -1073744784, 31, 658, 1062858, 1245207, 3407903, 3407903, 
-1073807360, -1073807305}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 25205497, 
  var = 25165833, 
  chosen_clause = 25165881, 
  tag = 0xbffff488, 
  next = 0x0
}
#10 0x00091528 in command_loop_2 () at keyboard.c:1338
        val = 58
#11 0x0010370c in internal_catch (tag=58, func=0x914e0 <command_loop_2>, 
arg=25165833) at eval.c:1247
        c = {
  tag = 25201569, 
  val = 25165833, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {-1773993089, 0, 8098, 1062505, -1773935635, 22000, 3466816, 3466748, 
-1073744376, -1073744528, 25296927, 658, 1062655, 25296919, 25296927, 25165855, 
5242880, 3997751}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
#12 0x0009127e in command_loop () at keyboard.c:1317
No locals.
#13 0x00091342 in recursive_edit_1 () at keyboard.c:942
        val = <value temporarily unavailable, due to optimizations>
#14 0x000914c1 in Frecursive_edit () at keyboard.c:1004
        buffer = 25165833
#15 0x0009015b in main (argc=1, argv=0xbffff7d8) at emacs.c:1693
        dummy = 0
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {
  rlim_cur = 8388608, 
  rlim_max = 67104768
}
        no_loadup = 0
        junk = 0x0
Current language:  auto; currently objective-c



In GNU Emacs 23.0.60.1 (i386-apple-darwin9.4.0, *Step 9.0)
 of 2008-09-09 on baggio.local
Windowing system distributor `Apple', version 49.46.48
configured using `configure  '--with-ns''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Emacs-Lisp

Minor modes in effect:
  shell-dirtrack-mode: t
  yas/minor-mode: t
  window-number-meta-mode: t
  window-number-mode: t
  show-paren-mode: t
  global-auto-revert-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
C-x C-f m y <backspace> <backspace> n u <backspace> 
<backspace> g n u <return> y M-x e v a l - b u f <tab> 
<return> M-x r e p o <tab> r - e m <tab> <return>

Recent messages:
Loading /Users/pergesu/.emacs.d/site-lisp/textmate.el (source)...done
Loading /Users/pergesu/.emacs.d/my-textmate.el (source)...done
Ido mode enabled
For information about GNU Emacs and the GNU system, type C-h C-a.
Loading vc-git...done
Symbolic link to Git-controlled source file; follow link? (y or n) 
Loading /Users/pergesu/myconfig/.emacs-project...done
Followed link to /Users/pergesu/myconfig/dot.gnus.el
Loading /Users/pergesu/.emacs.private.d/smtp-account-info.el (source)...done
Making completion list...