bug#20802: Segfault when showing non-GTK+ tooltip

[martin rudalics]

>> When x-gtk-use-system-tooltips is set to nil, and the tooltip face is
>> customized using an invalid color string such as #zz, Emacs will
>> segfault when a tooltip is being drawn.
>
> I cannot reproduce this on my system, so please show a backtrace from
> running Emacs inside GDB.  Also, please tell how you customized the
> face color, exactly -- it could be that only some specific ways of
> customizing it cause the problem.

Below is a bt after setting an invalid background color.  Tooltips are
shown via ‘x-show-tip’ and the crash triggers after the backtrace buffer
complaining about the invalid color popped up and I tried to switch to
another buffer.  I have no idea whether it's the OP's original issue.

martin


#0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x198ee20) at 
../../src/image.c:1775
#1  0x00000000006c96e3 in lookup_image (f=0x13a7e00, spec=...) at 
../../src/image.c:1686
#2  0x000000000044bebc in handle_single_display_spec (it=0x7fffffff8ba0, 
spec=..., object=..., overlay=..., position=0x7fffffff8cd8, bufpos=203, 
display_replaced=0, frame_window_p=true) at ../../src/xdisp.c:5137
#3  0x00000000004498cd in handle_display_spec (it=0x7fffffff8ba0, spec=..., 
object=..., overlay=..., position=0x7fffffff8cd8, bufpos=203, 
frame_window_p=true) at ../../src/xdisp.c:4654
#4  0x00000000004492c8 in handle_display_prop (it=0x7fffffff8ba0) at 
../../src/xdisp.c:4576
#5  0x0000000000445e8d in handle_stop (it=0x7fffffff8ba0) at 
../../src/xdisp.c:3299
#6  0x0000000000454ee3 in next_element_from_buffer (it=0x7fffffff8ba0) at 
../../src/xdisp.c:8133
#7  0x00000000004511b5 in get_next_display_element (it=0x7fffffff8ba0) at 
../../src/xdisp.c:6785
#8  0x000000000047e4ea in display_line (it=0x7fffffff8ba0) at 
../../src/xdisp.c:20132
#9  0x00000000004719a2 in try_window (window=..., pos=..., flags=1) at 
../../src/xdisp.c:16892
#10 0x000000000046df50 in redisplay_window (window=..., just_this_one_p=false) 
at ../../src/xdisp.c:16365
#11 0x00000000004654d0 in redisplay_window_0 (window=...) at 
../../src/xdisp.c:14184
#12 0x0000000000625c43 in internal_condition_case_1 (bfun=0x46548e 
<redisplay_window_0>, arg=..., handlers=..., hfun=0x465456 
<redisplay_window_error>) at ../../src/eval.c:1372
#13 0x000000000046542c in redisplay_windows (window=...) at 
../../src/xdisp.c:14164
#14 0x00000000004653e2 in redisplay_windows (window=...) at 
../../src/xdisp.c:14158
#15 0x00000000004641e1 in redisplay_internal () at ../../src/xdisp.c:13756
#16 0x0000000000461e04 in redisplay () at ../../src/xdisp.c:13019
#17 0x000000000057d4a3 in read_char (commandflag=1, map=..., prev_event=..., 
used_mouse_menu=0x7fffffffe23f, end_time=0x0) at ../../src/keyboard.c:2542
#18 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffffe410, bufsize=30, 
prompt=..., dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#19 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#20 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, 
handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#21 0x00000000005798be in command_loop_2 (ignore=...) at 
../../src/keyboard.c:1139
#22 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 
<command_loop_2>, arg=...) at ../../src/eval.c:1108
#23 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#24 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#25 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#26 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at 
../../src/emacs.c:1626

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)