bug#11395: 24.0.96; Sporadic crashing

[Chong Yidong]

> It just crashed! It took several days for this to show up, and all I was
> doing at the time was typing text...
>
> Here's the backtrace (plus everything else that appeared on the screen
> after I told it to run Emacs).

Unfortunately, I will be traveling for the next several days, and will
not have time to work on this.  Paul, would you mind taking a look, and
see if it rings any bell?

The backtrace posted by Felix Geller at

  https://gist.github.com/2644938

also points to something in the vectorlike allocation code.

> Program received signal EXC_BAD_ACCESS, Could not access memory.
> Reason: 13 at address: 0x0000000000000000
> 0x00000001001cf0a4 in mem_insert (start=0x10fa29010, end=0x10fa29088,
> type=MEM_TYPE_VECTORLIKE) at alloc.c:3585
> 3585        c = start < c->start ? c->left : c->right;
> (gdb) bt
> #0  0x00000001001cf0a4 in mem_insert (start=0x10fa29010, end=0x10fa29088,
> type=MEM_TYPE_VECTORLIKE) at alloc.c:3585
> #1  0x00000001001cb45e in lisp_malloc (nbytes=120,
> type=MEM_TYPE_VECTORLIKE) at alloc.c:918
> #2  0x00000001001cde02 in allocate_vectorlike (len=13) at alloc.c:2948
> #3  0x00000001001cdf22 in allocate_pseudovector (memlen=13, lisplen=13,
> tag=2097152) at alloc.c:2988
> #4  0x0000000100219313 in font_make_spec () at font.c:174
> #5  0x0000000100226dbc in copy_font_spec (font=4488910229) at font.c:3875
> #6  0x00000001002230d6 in font_clear_prop (attrs=0x7fff5fbf8740,
> prop=FONT_WEIGHT_INDEX) at font.c:2982
> #7  0x000000010011744d in merge_face_vectors (f=0x105203fb0,
> from=0x7fff5fbf7eb8, to=0x7fff5fbf8740, named_merge_points=0x7fff5fbf7f60)
> at xfaces.c:2350
> #8  0x0000000100116d89 in merge_named_face (f=0x105203fb0,
> face_name=4324754282, to=0x7fff5fbf8740,
> named_merge_points=0x7fff5fbf7f60) at xfaces.c:2387
> #9  0x0000000100117f37 in merge_face_ref (f=0x105203fb0,
> face_ref=4324754282, to=0x7fff5fbf8740, err_msgs=0,
> named_merge_points=0x7fff5fbf81b0) at xfaces.c:2637
> #10 0x0000000100117031 in merge_face_vectors (f=0x105203fb0,
> from=0x7fff5fbf8108, to=0x7fff5fbf8740, named_merge_points=0x7fff5fbf81b0)
> at xfaces.c:2315
> #11 0x0000000100116d89 in merge_named_face (f=0x105203fb0,
> face_name=4434249458, to=0x7fff5fbf8740,
> named_merge_points=0x7fff5fbf81b0) at xfaces.c:2387
> #12 0x0000000100117f37 in merge_face_ref (f=0x105203fb0,
> face_ref=4434249458, to=0x7fff5fbf8740, err_msgs=0,
> named_merge_points=0x7fff5fbf8400) at xfaces.c:2637
> #13 0x0000000100117031 in merge_face_vectors (f=0x105203fb0,
> from=0x7fff5fbf8358, to=0x7fff5fbf8740, named_merge_points=0x7fff5fbf8400)
> at xfaces.c:2315
> #14 0x0000000100116d89 in merge_named_face (f=0x105203fb0,
> face_name=4434716402, to=0x7fff5fbf8740,
> named_merge_points=0x7fff5fbf8400) at xfaces.c:2387
> #15 0x0000000100117f37 in merge_face_ref (f=0x105203fb0,
> face_ref=4434716402, to=0x7fff5fbf8740, err_msgs=1,
> named_merge_points=0x0) at xfaces.c:2637
> #16 0x0000000100121b25 in face_at_buffer_position (w=0x10168aa70, pos=559,
> region_beg=-1, region_end=-1, endptr=0x7fff5fbf88e8, limit=659, mouse=0,
> base_face_id=0) at xfaces.c:6033
> #17 0x000000010002eb56 in handle_face_prop (it=0x7fff5fbf9c98) at
> xdisp.c:3593
> #18 0x000000010002d751 in handle_stop (it=0x7fff5fbf9c98) at xdisp.c:3106
> #19 0x000000010003cd0c in next_element_from_buffer (it=0x7fff5fbf9c98) at
> xdisp.c:7721
> #20 0x000000010003822a in get_next_display_element (it=0x7fff5fbf9c98) at
> xdisp.c:6414
> #21 0x0000000100062de0 in display_line (it=0x7fff5fbf9c98) at xdisp.c:19038
> #22 0x00000001000585eb in try_window (window=4318603893, pos={charpos = 1,
> bytepos = 1}, flags=1) at xdisp.c:16031
> #23 0x0000000100055e71 in redisplay_window (window=4318603893,
> just_this_one_p=1) at xdisp.c:15556
> #24 0x000000010004e841 in redisplay_window_1 (window=4318603893) at
> xdisp.c:13650
> #25 0x00000001001fd520 in internal_condition_case_1 (bfun=0x10004e800
> <redisplay_window_1>, arg=4318603893, handlers=4320154566,
> hfun=0x10004e740 <redisplay_window_error>) at eval.c:1553
> #26 0x000000010004d0d7 in redisplay_internal () at xdisp.c:13275
> #27 0x000000010004a379 in redisplay () at xdisp.c:12422
> #28 0x000000010012c6e9 in read_char (commandflag=1, nmaps=5,
> maps=0x7fff5fbfe9c0, prev_event=4320145466,
> used_mouse_menu=0x7fff5fbfecd4, end_time=0x0) at keyboard.c:2448
> #29 0x000000010013e6a2 in read_key_sequence (keybuf=0x7fff5fbfef60,
> bufsize=30, prompt=4320145466, dont_downcase_last=0,
> can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9328
> #30 0x0000000100129952 in command_loop_1 () at keyboard.c:1449
> #31 0x00000001001fd385 in internal_condition_case (bfun=0x100129440
> <command_loop_1>, handlers=4320201578, hfun=0x100128980 <cmd_error>) at
> eval.c:1515
> #32 0x0000000100128f4f in command_loop_2 (ignore=4320145466) at
> keyboard.c:1160
> #33 0x00000001001fcbc5 in internal_catch (tag=4320197578, func=0x100128f20
> <command_loop_2>, arg=4320145466) at eval.c:1272
> #34 0x0000000100128ed2 in command_loop () at keyboard.c:1139
> #35 0x0000000100128309 in recursive_edit_1 () at keyboard.c:759
> #36 0x000000010012854d in Frecursive_edit () at keyboard.c:823
> #37 0x0000000100125dd0 in main (argc=1, argv=0x7fff5fbff8c0) at