bug#20802: Segfault when showing non-GTK+ tooltip

[martin rudalics]

What happens is given in the backtraces below.  The first breakpoint is
hit when Emacs creates the image cache for the original frame
(f=0x13a7e00).  The second breakpoint is hit when freeing the image
cache for the tooltip frame (f=0xe0c7a0).  This removes the image_cache
created in make_image_cache at 0x1676f90.  The third breakpoint is the
same as in my earlier posts.

The reason seems obvious: When the color is not defined for the tooltip
frame we do _not_ increment the refcount of the image cache.  But we
subsequently free the image cache in unwind_create_frame.  Bad luck.

martin


(gdb) run
Starting program: /home/martin/emacs-git/trunk/obj-gtk/src/emacs
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffef48c700 (LWP 4514)]
[New Thread 0x7fffedadf700 (LWP 4515)]
[New Thread 0x7fffed28e700 (LWP 4516)]
(gdb) bt
#0  make_image_cache () at ../../src/image.c:1356
#1  0x0000000000524b87 in init_frame_faces (f=0x13a7e00) at 
../../src/xfaces.c:591
#2  0x0000000000551afb in Fx_create_frame (parms=...) at ../../src/xfns.c:3215
#3  0x00000000006297ae in Ffuncall (nargs=2, args=0x7fffffffb848) at 
../../src/eval.c:2718
#4  0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=0, args=0x0) at ../../src/bytecode.c:919
#5  0x000000000062a5b1 in funcall_lambda (fun=..., nargs=1, 
arg_vector=0xa0be8d) at ../../src/eval.c:2951
#6  0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffc0d8) at 
../../src/eval.c:2767
#7  0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=1, args=0x7fffffffc978) at 
../../src/bytecode.c:919
#8  0x000000000062a11f in funcall_lambda (fun=..., nargs=1, 
arg_vector=0x7fffffffc970) at ../../src/eval.c:2885
#9  0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffc968) at 
../../src/eval.c:2767
#10 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=0, args=0x7fffffffd1e0) at 
../../src/bytecode.c:919
#11 0x000000000062a11f in funcall_lambda (fun=..., nargs=0, 
arg_vector=0x7fffffffd1e0) at ../../src/eval.c:2885
#12 0x0000000000629a1a in Ffuncall (nargs=1, args=0x7fffffffd1d8) at 
../../src/eval.c:2767
#13 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=0, args=0x7fffffffdab8) at 
../../src/bytecode.c:919
#14 0x000000000062a11f in funcall_lambda (fun=..., nargs=0, 
arg_vector=0x7fffffffdab8) at ../../src/eval.c:2885
#15 0x0000000000629a1a in Ffuncall (nargs=1, args=0x7fffffffdab0) at 
../../src/eval.c:2767
#16 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=0, args=0x7fffffffe260) at 
../../src/bytecode.c:919
#17 0x000000000062a11f in funcall_lambda (fun=..., nargs=0, 
arg_vector=0x7fffffffe260) at ../../src/eval.c:2885
#18 0x0000000000629db3 in apply_lambda (fun=..., args=..., count=3) at 
../../src/eval.c:2826
#19 0x0000000000628201 in eval_sub (form=...) at ../../src/eval.c:2226
#20 0x00000000006276a7 in Feval (form=..., lexical=...) at ../../src/eval.c:1996
#21 0x00000000005798fe in top_level_2 () at ../../src/keyboard.c:1148
#22 0x0000000000625ac9 in internal_condition_case (bfun=0x5798e1 <top_level_2>, 
handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#23 0x000000000057993f in top_level_1 (ignore=...) at ../../src/keyboard.c:1156
#24 0x0000000000624ec4 in internal_catch (tag=..., func=0x579900 <top_level_1>, 
arg=...) at ../../src/eval.c:1108
#25 0x0000000000579839 in command_loop () at ../../src/keyboard.c:1117
#26 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#27 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#28 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at 
../../src/emacs.c:1626

Lisp Backtrace:
"x-create-frame" (0xffffb850)
"x-create-frame-with-faces" (0xffffc0e0)
"make-frame" (0xffffc970)
"frame-initialize" (0xffffd1e0)
"command-line" (0xffffdab8)
"normal-top-level" (0xffffe260)
(gdb) p c
$38 = (struct image_cache *) 0x1676f90
(gdb) c
Continuing.
(gdb) bt
#0  free_image_cache (f=0xe0c7a0) at ../../src/image.c:1432
#1  0x0000000000524c5e in free_frame_faces (f=0xe0c7a0) at 
../../src/xfaces.c:624
#2  0x0000000000548bb0 in x_free_frame_resources (f=0xe0c7a0) at 
../../src/xterm.c:10228
#3  0x0000000000550621 in unwind_create_frame (frame=...) at 
../../src/xfns.c:2833
#4  0x00000000005549b3 in unwind_create_tip_frame (frame=...) at 
../../src/xfns.c:4991
#5  0x000000000062ae77 in unbind_to (count=9, value=...) at 
../../src/eval.c:3208
#6  0x0000000000624fa6 in unwind_to_catch (catch=0x15696d0, value=...) at 
../../src/eval.c:1157
#7  0x00000000006250b4 in Fthrow (tag=..., value=...) at ../../src/eval.c:1188
#8  0x00000000005799be in Ftop_level () at ../../src/keyboard.c:1179
#9  0x000000000062978c in Ffuncall (nargs=1, args=0x7fffffff9168) at 
../../src/eval.c:2715
#10 0x000000000061f642 in Ffuncall_interactively (nargs=1, args=0x7fffffff9168) 
at ../../src/callint.c:252
#11 0x0000000000629676 in Ffuncall (nargs=2, args=0x7fffffff9160) at 
../../src/eval.c:2698
#12 0x0000000000621bf9 in Fcall_interactively (function=..., record_flag=..., 
keys=...) at ../../src/callint.c:849
#13 0x0000000000629813 in Ffuncall (nargs=4, args=0x7fffffff9688) at 
../../src/eval.c:2725
#14 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=1, args=0x7fffffff9f20) at 
../../src/bytecode.c:919
#15 0x000000000062a11f in funcall_lambda (fun=..., nargs=1, 
arg_vector=0x7fffffff9f18) at ../../src/eval.c:2885
#16 0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffff9f10) at 
../../src/eval.c:2767
#17 0x0000000000629153 in call1 (fn=..., arg1=...) at ../../src/eval.c:2573
#18 0x000000000057a4f6 in command_loop_1 () at ../../src/keyboard.c:1521
#19 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, 
handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#20 0x00000000005798be in command_loop_2 (ignore=...) at 
../../src/keyboard.c:1139
#21 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 
<command_loop_2>, arg=...) at ../../src/eval.c:1108
#22 0x00000000005797f6 in command_loop () at ../../src/keyboard.c:1110
#23 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#24 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#25 0x000000000062978c in Ffuncall (nargs=1, args=0x7fffffffa408) at 
../../src/eval.c:2715
#26 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=2, args=0x7fffffffac98) at 
../../src/bytecode.c:919
#27 0x000000000062a11f in funcall_lambda (fun=..., nargs=2, 
arg_vector=0x7fffffffac98) at ../../src/eval.c:2885
#28 0x0000000000629a1a in Ffuncall (nargs=3, args=0x7fffffffac90) at 
../../src/eval.c:2767
#29 0x0000000000628a06 in Fapply (nargs=2, args=0x7fffffffada0) at 
../../src/eval.c:2337
#30 0x00000000006290fc in apply1 (fn=..., arg=...) at ../../src/eval.c:2558
#31 0x0000000000622711 in call_debugger (arg=...) at ../../src/eval.c:309
#32 0x0000000000626ab3 in maybe_call_debugger (conditions=..., sig=..., 
data=...) at ../../src/eval.c:1726
#33 0x00000000006262c8 in Fsignal (error_symbol=..., data=...) at 
../../src/eval.c:1544
#34 0x00000000006263fe in xsignal (error_symbol=..., data=...) at 
../../src/eval.c:1581
#35 0x000000000062663c in signal_error (s=0x6fd2de "Undefined color", arg=...) 
at ../../src/eval.c:1636
#36 0x000000000054c091 in x_decode_color (f=0xe0c7a0, color_name=..., 
mono_color=16777215) at ../../src/xfns.c:495
#37 0x000000000054c566 in x_set_background_color (f=0xe0c7a0, arg=..., 
oldval=...) at ../../src/xfns.c:638
#38 0x000000000042d45d in x_set_frame_parameters (f=0xe0c7a0, alist=...) at 
../../src/frame.c:3152
#39 0x0000000000431ce6 in x_default_parameter (f=0xe0c7a0, alist=..., prop=..., deflt=..., 
xprop=0x6fd49d "background", xclass=0x6fd908 "Background", 
type=RES_TYPE_STRING) at ../../src/frame.c:4374
#40 0x000000000055549d in x_create_tip_frame (dpyinfo=0x1622000, parms=..., 
text=...) at ../../src/xfns.c:5173
#41 0x0000000000556884 in Fx_show_tip (string=..., frame=..., parms=..., 
timeout=..., dx=..., dy=...) at ../../src/xfns.c:5543
#42 0x0000000000628116 in eval_sub (form=...) at ../../src/eval.c:2200
#43 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#44 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#45 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#46 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#47 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#48 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#49 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#50 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#51 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#52 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#53 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#54 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#55 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#56 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#57 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#58 0x000000000062a511 in funcall_lambda (fun=..., nargs=0, arg_vector=0x0) at 
../../src/eval.c:2944
#59 0x0000000000629b19 in Ffuncall (nargs=1, args=0x7fffffffcbb0) at 
../../src/eval.c:2779
#60 0x000000000062853a in Fapply (nargs=2, args=0x7fffffffcbb0) at 
../../src/eval.c:2289
#61 0x0000000000629676 in Ffuncall (nargs=3, args=0x7fffffffcba8) at 
../../src/eval.c:2698
#62 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=0, args=0x0) at ../../src/bytecode.c:919
#63 0x000000000062a5b1 in funcall_lambda (fun=..., nargs=1, 
arg_vector=0xadb72d) at ../../src/eval.c:2951
#64 0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffd430) at 
../../src/eval.c:2767
#65 0x0000000000629153 in call1 (fn=..., arg1=...) at ../../src/eval.c:2573
#66 0x0000000000582a83 in timer_check_2 (timers=..., idle_timers=...) at 
../../src/keyboard.c:4533
#67 0x0000000000582bf2 in timer_check () at ../../src/keyboard.c:4600
#68 0x000000000058008d in readable_events (flags=1) at ../../src/keyboard.c:3434
#69 0x000000000058841c in get_input_pending (flags=1) at 
../../src/keyboard.c:6818
#70 0x000000000058ff13 in detect_input_pending_run_timers (do_display=true) at 
../../src/keyboard.c:9973
#71 0x0000000000684c13 in wait_reading_process_output (time_limit=2025, 
nsecs=0, read_kbd=-1, do_display=true, wait_for_cell=..., wait_proc=0x0, 
just_wait_proc=0) at ../../src/process.c:5014
#72 0x0000000000422610 in sit_for (timeout=..., reading=true, display_option=1) 
at ../../src/dispnew.c:5748
#73 0x000000000057de53 in read_char (commandflag=1, map=..., prev_event=..., 
used_mouse_menu=0x7fffffffe23f, end_time=0x0) at ../../src/keyboard.c:2781
#74 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffffe410, bufsize=30, 
prompt=..., dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#75 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#76 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, 
handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#77 0x00000000005798be in command_loop_2 (ignore=...) at 
../../src/keyboard.c:1139
#78 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 
<command_loop_2>, arg=...) at ../../src/eval.c:1108
#79 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#80 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#81 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#82 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at 
../../src/emacs.c:1626

Lisp Backtrace:
"x-show-tip" (0xffffb810)
"progn" (0xffffbb20)
"if" (0xffffbd40)
"let*" (0xffffc040)
"progn" (0xffffc250)
"if" (0xffffc470)
"let*" (0xffffc770)
"eldoc-tooltip--make" (0xffffcbb8)
"apply" (0xffffcbb0)
"timer-event-handler" (0xffffd438)
(gdb) p c
$39 = (struct image_cache *) 0x1676f90
(gdb) c
Continuing.
(gdb) bt
#0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x24d7600) at 
../../src/image.c:1775
#1  0x00000000006c96e3 in lookup_image (f=0x13a7e00, spec=...) at 
../../src/image.c:1686
#2  0x000000000044bebc in handle_single_display_spec (it=0x7fffffff46f0, 
spec=..., object=..., overlay=..., position=0x7fffffff4828, bufpos=203, 
display_replaced=0, frame_window_p=true) at ../../src/xdisp.c:5137
#3  0x00000000004498cd in handle_display_spec (it=0x7fffffff46f0, spec=..., 
object=..., overlay=..., position=0x7fffffff4828, bufpos=203, 
frame_window_p=true) at ../../src/xdisp.c:4654
#4  0x00000000004492c8 in handle_display_prop (it=0x7fffffff46f0) at 
../../src/xdisp.c:4576
#5  0x0000000000445e8d in handle_stop (it=0x7fffffff46f0) at 
../../src/xdisp.c:3299
#6  0x0000000000454ee3 in next_element_from_buffer (it=0x7fffffff46f0) at 
../../src/xdisp.c:8133
#7  0x00000000004511b5 in get_next_display_element (it=0x7fffffff46f0) at 
../../src/xdisp.c:6785
#8  0x000000000047e4ea in display_line (it=0x7fffffff46f0) at 
../../src/xdisp.c:20132
#9  0x00000000004719a2 in try_window (window=..., pos=..., flags=1) at 
../../src/xdisp.c:16892
#10 0x000000000046df50 in redisplay_window (window=..., just_this_one_p=false) 
at ../../src/xdisp.c:16365
#11 0x00000000004654d0 in redisplay_window_0 (window=...) at 
../../src/xdisp.c:14184
#12 0x0000000000625c43 in internal_condition_case_1 (bfun=0x46548e 
<redisplay_window_0>, arg=..., handlers=..., hfun=0x465456 
<redisplay_window_error>) at ../../src/eval.c:1372
#13 0x000000000046542c in redisplay_windows (window=...) at 
../../src/xdisp.c:14164
#14 0x00000000004653e2 in redisplay_windows (window=...) at 
../../src/xdisp.c:14158
#15 0x00000000004641e1 in redisplay_internal () at ../../src/xdisp.c:13756
#16 0x0000000000461e04 in redisplay () at ../../src/xdisp.c:13019
#17 0x000000000057d4a3 in read_char (commandflag=1, map=..., prev_event=..., 
used_mouse_menu=0x7fffffff9d8f, end_time=0x0) at ../../src/keyboard.c:2542
#18 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffff9f60, bufsize=30, 
prompt=..., dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#19 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#20 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, 
handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#21 0x00000000005798be in command_loop_2 (ignore=...) at 
../../src/keyboard.c:1139
#22 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 
<command_loop_2>, arg=...) at ../../src/eval.c:1108
#23 0x00000000005797f6 in command_loop () at ../../src/keyboard.c:1110
#24 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#25 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#26 0x000000000062978c in Ffuncall (nargs=1, args=0x7fffffffa408) at 
../../src/eval.c:2715
#27 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=2, args=0x7fffffffac98) at 
../../src/bytecode.c:919
#28 0x000000000062a11f in funcall_lambda (fun=..., nargs=2, 
arg_vector=0x7fffffffac98) at ../../src/eval.c:2885
#29 0x0000000000629a1a in Ffuncall (nargs=3, args=0x7fffffffac90) at 
../../src/eval.c:2767
#30 0x0000000000628a06 in Fapply (nargs=2, args=0x7fffffffada0) at 
../../src/eval.c:2337
#31 0x00000000006290fc in apply1 (fn=..., arg=...) at ../../src/eval.c:2558
#32 0x0000000000622711 in call_debugger (arg=...) at ../../src/eval.c:309
#33 0x0000000000626ab3 in maybe_call_debugger (conditions=..., sig=..., 
data=...) at ../../src/eval.c:1726
#34 0x00000000006262c8 in Fsignal (error_symbol=..., data=...) at 
../../src/eval.c:1544
#35 0x00000000006263fe in xsignal (error_symbol=..., data=...) at 
../../src/eval.c:1581
#36 0x000000000062663c in signal_error (s=0x6fd2de "Undefined color", arg=...) 
at ../../src/eval.c:1636
#37 0x000000000054c091 in x_decode_color (f=0x26aafb0, color_name=..., 
mono_color=16777215) at ../../src/xfns.c:495
#38 0x000000000054c566 in x_set_background_color (f=0x26aafb0, arg=..., 
oldval=...) at ../../src/xfns.c:638
#39 0x000000000042d45d in x_set_frame_parameters (f=0x26aafb0, alist=...) at 
../../src/frame.c:3152
#40 0x0000000000431ce6 in x_default_parameter (f=0x26aafb0, alist=..., prop=..., deflt=..., 
xprop=0x6fd49d "background", xclass=0x6fd908 "Background", 
type=RES_TYPE_STRING) at ../../src/frame.c:4374
#41 0x000000000055549d in x_create_tip_frame (dpyinfo=0x1622000, parms=..., 
text=...) at ../../src/xfns.c:5173
#42 0x0000000000556884 in Fx_show_tip (string=..., frame=..., parms=..., 
timeout=..., dx=..., dy=...) at ../../src/xfns.c:5543
#43 0x0000000000628116 in eval_sub (form=...) at ../../src/eval.c:2200
#44 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#45 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#46 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#47 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#48 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#49 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#50 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#51 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#52 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#53 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#54 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#55 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#56 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#57 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#58 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#59 0x000000000062a511 in funcall_lambda (fun=..., nargs=0, arg_vector=0x0) at 
../../src/eval.c:2944
#60 0x0000000000629b19 in Ffuncall (nargs=1, args=0x7fffffffcbb0) at 
../../src/eval.c:2779
#61 0x000000000062853a in Fapply (nargs=2, args=0x7fffffffcbb0) at 
../../src/eval.c:2289
#62 0x0000000000629676 in Ffuncall (nargs=3, args=0x7fffffffcba8) at 
../../src/eval.c:2698
#63 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=0, args=0x0) at ../../src/bytecode.c:919
#64 0x000000000062a5b1 in funcall_lambda (fun=..., nargs=1, 
arg_vector=0xadb72d) at ../../src/eval.c:2951
#65 0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffd430) at 
../../src/eval.c:2767
#66 0x0000000000629153 in call1 (fn=..., arg1=...) at ../../src/eval.c:2573
#67 0x0000000000582a83 in timer_check_2 (timers=..., idle_timers=...) at 
../../src/keyboard.c:4533
#68 0x0000000000582bf2 in timer_check () at ../../src/keyboard.c:4600
#69 0x000000000058008d in readable_events (flags=1) at ../../src/keyboard.c:3434
#70 0x000000000058841c in get_input_pending (flags=1) at 
../../src/keyboard.c:6818
#71 0x000000000058ff13 in detect_input_pending_run_timers (do_display=true) at 
../../src/keyboard.c:9973
#72 0x0000000000684c13 in wait_reading_process_output (time_limit=2025, 
nsecs=0, read_kbd=-1, do_display=true, wait_for_cell=..., wait_proc=0x0, 
just_wait_proc=0) at ../../src/process.c:5014
#73 0x0000000000422610 in sit_for (timeout=..., reading=true, display_option=1) 
at ../../src/dispnew.c:5748
#74 0x000000000057de53 in read_char (commandflag=1, map=..., prev_event=..., 
used_mouse_menu=0x7fffffffe23f, end_time=0x0) at ../../src/keyboard.c:2781
#75 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffffe410, bufsize=30, 
prompt=..., dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#76 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#77 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, 
handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#78 0x00000000005798be in command_loop_2 (ignore=...) at 
../../src/keyboard.c:1139
#79 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 
<command_loop_2>, arg=...) at ../../src/eval.c:1108
#80 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#81 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#82 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#83 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at 
../../src/emacs.c:1626

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
"recursive-edit" (0xffffa410)
"debug" (0xffffac98)
"x-show-tip" (0xffffb810)
"progn" (0xffffbb20)
"if" (0xffffbd40)
"let*" (0xffffc040)
"progn" (0xffffc250)
"if" (0xffffc470)
"let*" (0xffffc770)
"eldoc-tooltip--make" (0xffffcbb8)
"apply" (0xffffcbb0)
"timer-event-handler" (0xffffd438)
(gdb) p c
$40 = (struct image_cache *) 0x0
(gdb)