bug#15844: 24.3.50; Segfault in redisplay_internal

[Eli Zaretskii]

> From: Nathan Trapuzzano <nbtrap@nbtrap.com>
> Cc: 15844@debbugs.gnu.org
> Date: Sun, 10 Nov 2013 14:19:57 -0500
> 
> Eli Zaretskii <eliz@gnu.org> writes:
> 
> It happens when I click the "C source code" button in the *Help* buffer,

"Click", as in "with a mouse"?  What kind of mouse do you have there
-- GPM, xterm, something else?  Also, was the 'button' or 'link' face
customized in any way?

> so it could be text that it's trying to display in the buffer that it
> creates for displaying the C source.

Looking closer at the backtrace you presented:

  #1  0x00000000004a7ffd in tty_write_glyphs (f=0xb67300, 
string=0x7fa8c53db5e0, len=169) at term.c:755
          face_id = 24
          conversion_buffer = 0x12e5070 "function is a special form in 
`efinition", '-' <repeats 20 times>, ' ' <repeats 109 times>, "-------"
          coding = 0x11a3c90
          n = 13
          stringlen = 138
          tty = 0x12c3dc0

and comparing this with the code in tty_write_glyphs, we can see that
at this point, Emacs already wrote out 169 - 138 = 31 characters,
which brings us to the "C source code" part of the line.  Also, n = 13
is consistent with "C source code" part, whose characters all have the
same 'button' face.  So I'm not sure Emacs is trying to display the C
source, I think it was trying to redisplay the "function is a special
form in ..." line.  But to be sure, please show the contents of the
2nd argument to tty_write_glyphs, 'string', which is an array of
'struct glyph'.  Each element of the array has the character to
display in the u.ch member.  Note that 'stringlen' has the value of
138, so 31 characters were already written by the time the segfault
strikes.  Also note that this is the first line of the frame:

  #3  0x000000000040e6da in update_frame_line (f=0xb67300, vpos=0) at 
dispnew.c:4777
                                                           ^^^^^^

(and I'm guessing that you had the menu bar turned off in that frame,
right?).