bug#16049: 24.3.50; xdisp.c infloop on Mac OS X 10.9

[Eli Zaretskii]

> From: Jan Djärv <jan.h.d@swipnet.se>
> Date: Sat, 7 Dec 2013 09:25:29 +0100
> Cc: Eli Zaretskii <eliz@gnu.org>,
>  Jules Colding <colding@venalicium.dk>,
>  16049@debbugs.gnu.org
> 
> Next problem, infloop in move_it_vertically_backward, xdisp.c
> 
> It just keeps going back to move_further_back: but no values are actually 
> changed in the code inbetween.  I don't know whats bad here, values looks 
> fine to me.  window_box_height is called
> and returns 490, which is the pixel size.
> 
> Backtrace:

Here's one sign of the trouble:

>       nchars_per_row = 0

This is the number of canonical-width characters that fit in a full
screen line, which obviously cannot be zero.  It is computed at the
beginning of move_it_vertically_backward like this:

  int nchars_per_row
    = (it->last_visible_x - it->first_visible_x) / FRAME_COLUMN_WIDTH (it->f);

So now we look for the values of it->last_visible_x and
it->first_visible_x.  The contents of it are not available in "bt
full", but there are locals it2 and it3, which use copies of the same
metrics.  And here we find this:

  first_visible_x = 2147483643, 
  last_visible_x = 2147483642, 

which is obviously bogus, since those are supposed to be the pixel
coordinates of the first screen-line pixel shown at the left edge of
the window (usually zero, but can be positive when lines are truncated
and the window is hscrolled), and of the last screen-line pixel shown
at the right edge.

So now the question is: how did those bogus values end up in the
iterator structure?

The code that initializes this iterator is here:

  if (it.current_y <= 0)
    {
      init_iterator (&it, w, PT, PT_BYTE, NULL, DEFAULT_FACE_ID); <<<<<<<<
      move_it_vertically_backward (&it, 0);

and in init_iterator we find this:

  /* Get the dimensions of the display area.  The display area
     consists of the visible window area plus a horizontally scrolled
     part to the left of the window.  All x-values are relative to the
     start of this total display area.  */
  if (base_face_id != DEFAULT_FACE_ID)
    {
      /* Mode lines, menu bar in terminal frames.  */
      it->first_visible_x = 0;
      it->last_visible_x = WINDOW_PIXEL_WIDTH (w);
    }
  else
    {
      it->first_visible_x
        = window_hscroll_limited (it->w, it->f) * FRAME_COLUMN_WIDTH (it->f);
      it->last_visible_x = (it->first_visible_x
                            + window_box_width (w, TEXT_AREA));

      /* If we truncate lines, leave room for the truncation glyph(s) at
         the right margin.  Otherwise, leave room for the continuation
         glyph(s).  Done only if the window has no fringes.  Since we
         don't know at this point whether there will be any R2L lines in
         the window, we reserve space for truncation/continuation glyphs
         even if only one of the fringes is absent.  */
      if (WINDOW_RIGHT_FRINGE_WIDTH (it->w) == 0
          || (it->bidi_p && WINDOW_LEFT_FRINGE_WIDTH (it->w) == 0))
        {
          if (it->line_wrap == TRUNCATE)
            it->last_visible_x -= it->truncation_pixel_width;
          else
            it->last_visible_x -= it->continuation_pixel_width;
        }

      it->header_line_p = WINDOW_WANTS_HEADER_LINE_P (w);
      it->current_y = WINDOW_HEADER_LINE_HEIGHT (w) + w->vscroll;
    }

So stepping through this code in init_iterator, when it is invoked
from xdisp.c:16186 (16191 in the current trunk) should reveal the
culprit.

If init_iterator computes these values correctly, then setting a
watchpoint on them should show who thrashes them.