bug#20802: Segfault when showing non-GTK+ tooltip

[Eli Zaretskii]

> From: Tobias Getzner <tobias.getzner@gmx.de>
> Cc: rudalics@gmx.at, 20802@debbugs.gnu.org
> Date: Tue, 16 Jun 2015 18:34:32 +0200
> 
> On Di, 2015-06-16 at 18:58 +0300, Eli Zaretskii wrote:
> > > 
> > > From: Tobias Getzner <tobias.getzner@gmx.de>
> > > Date: Tue, 16 Jun 2015 17:34:05 +0200
> > > 
> > > Thanks! I built from master (34a43ba), which includes your 93ae9f4. 
> > > I’m
> > > still seeing a segfault for the steps given above. Backtrace below.
> > 
> > Please run Emacs under GDB, put a breakpoint in
> > x_free_frame_resources, then perform your steps, and show backtrace
> > each time the breakpoint breaks.
> > 
> > Thanks.
> > 
> 
> Breakpoint 1, x_free_frame_resources (f=0x124fd70) at xterm.c:10970
> 10970 {
> (gdb) bt
> #0  x_free_frame_resources (f=0x124fd70) at xterm.c:10970
> #1  0x00000000004c9715 in unwind_create_frame (frame=19201397) at xfns.c:2842
> #2  0x00000000004c9759 in unwind_create_tip_frame (frame=<optimized out>) at 
> xfns.c:4997
> #3  0x0000000000557b2e in unbind_to (count=<optimized out>, 
> value=value@entry=0) at eval.c:3211
> #4  0x0000000000557cf9 in unwind_to_catch (catch=catch@entry=0x140a040, 
> value=value@entry=19849283)
>     at eval.c:1157
> #5  0x00000000005592ed in Fsignal (error_symbol=error_symbol@entry=18624, 
> data=<optimized out>)
>     at eval.c:1557
> #6  0x00000000005595f9 in xsignal (error_symbol=error_symbol@entry=18624, 
> data=<optimized out>)
>     at eval.c:1581
> #7  0x0000000000559c6d in signal_error (s=s@entry=0x5e3d1d "Undefined color", 
> arg=19849315, 
>     arg@entry=34016084) at eval.c:1636
> #8  0x00000000004ccc57 in x_decode_color (f=<optimized out>, 
> color_name=34016084, 
>     mono_color=<optimized out>) at xfns.c:495

Is that the only call?  If so, I don't understand hy Martin's change
didn't work.

> (gdb) cont
> Continuing.
> Fatal error 11: Segmentation fault
> Program received signal SIGSEGV, Segmentation fault.
> 0x000000000045e51e in note_mouse_highlight (f=f@entry=0x1193460, x=<optimized 
> out>, y=19) at xdisp.c:29600
> 29600           struct image *img = IMAGE_FROM_ID (f, glyph->u.img_id);

And this is a different segfault from what you've shown before.

Can you step into the call to x_free_frame_resources, then step from
there into free_frame_faces, and see what it does there?  You are
supposed to see that image_cache->refcount is at least 2, and
therefore free_image_cache is not called.