23.0.60; segfault on graphical splash screen

[Brad Walker]

Run Fedora 9 i386 or x86_64 (reproduced on a slot a athlon box and a core 2 duo 
laptop)
Install emacs 23 packages @ http://rpm.bradmwalker.com/8.92/
emacs --font 'Liberation Mono:pixelsize=18'





Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f7a41a96790 (LWP 18258)]
x_compute_glyph_string_overhangs (s=0x7fff49acfdb0) at xterm.c:1326
1326              font->driver->text_extents (font, code, s->nchars, &metrics);
gdb) bt full
#0  x_compute_glyph_string_overhangs (s=0x7fff49acfdb0) at xterm.c:1326
        font = (struct font *) 0x0
        metrics = {lbearing = 2, rbearing = 353, width = 358, ascent = 13, 
  descent = 4}
        cs = {lbearing = 2, rbearing = 353, width = 358, ascent = 0, 
  descent = 12, attributes = 1}
        direction = 32767
        font_ascent = 1236074896
        font_descent = 32767
#1  0x000000000042ac51 in draw_glyphs (w=0x17eb600, x=660, row=0x7f7a3bafc720, 
    area=TEXT_AREA, start=<value optimized out>, end=70, hl=DRAW_NORMAL_TEXT, 
    overlaps=0) at xdisp.c:20046
        dummy_x = <value optimized out>
        h = <value optimized out>
        t = <value optimized out>
        head = (struct glyph_string *) 0x7fff49acff40
        tail = (struct glyph_string *) 0x7fff49acfc70
        s = (struct glyph_string *) 0x7fff49acfdb0
        clip_head = <value optimized out>
        clip_tail = <value optimized out>
        last_x = 891
        area_width = 53760
        x_reached = 660
        i = 70
        j = <value optimized out>
#2  0x000000000042da6f in x_write_glyphs (start=<value optimized out>, len=70)
    at xdisp.c:21504
        x = <value optimized out>
        hpos = 0
#3  0x0000000000417b5b in update_window_line (w=0x17eb600, vpos=18, 
    mouse_face_overwritten_p=0x7fff49ad037c) at dispnew.c:4452
        current_row = (struct glyph_row *) 0x7f7a3b961b30
        desired_row = (struct glyph_row *) 0x7f7a3bafc720
        rif = (struct redisplay_interface *) 0x7f98a0
        changed_p = 0
#4  0x0000000000418f9b in update_window (w=0x17eb600, force_p=0)
    at dispnew.c:4308
        vpos = 18
        i = <value optimized out>
        end = (struct glyph_row *) 0x7f7a3bafe1f0
        header_line_row = (struct glyph_row *) 0x0
        changed_p = 1
        mouse_face_overwritten_p = 0
        row = (struct glyph_row *) 0x7f7a3bafc720
        yb = 588
        desired_matrix = (struct glyph_matrix *) 0xb03c00
        paused_p = 0
        rif = (struct redisplay_interface *) 0x7f98a0
#5  0x000000000041a6c3 in update_window_tree (w=0x17eb600, force_p=0)
    at dispnew.c:4001
        paused_p = 53760
#6  0x000000000041ae2e in update_frame (f=0xd60800, force_p=0, 
    inhibit_hairy_id_p=0) at dispnew.c:3929
        paused_p = 1
        root_window = (struct window *) 0x17eb600
#7  0x0000000000446dd9 in redisplay_internal (
    preserve_echo_area=<value optimized out>) at xdisp.c:11622
        f = (struct frame *) 0xd60800
        tail = <value optimized out>
        frame = <value optimized out>
        w = (struct window *) 0x17eb600
        pause = 0
        must_finish = 1
        tlbufpos = {charpos = 29817365, bytepos = 0}
        number_of_visible_frames = 1
        count = 2
        polling_stopped_here = 0
        old_frame = 14026756
        consider_all_windows_p = 1
    maps=0x7fff49ad13f0, prev_event=10862369, used_mouse_menu=0x7fff49ad1518, 
    end_time=0x0) at keyboard.c:2722
        c = <value optimized out>
        local_getcjmp = {{__jmpbuf = {140734429467112, 5598187, -8, 5927113, 
      0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {
        0 <repeats 16 times>}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 140162966592948}, 
    __mask_was_saved = 128, __saved_mask = {__val = {5898226, 128, 
        140162966560720, 10862369, 5902300, 140162966592948, 140162966592948, 
        127, 5898226, 127, 140162966560720, 10862369, 5902300, 
        140734429467120, 140734429467568, 140162966592944}}}}
        key_already_recorded = 0
        tem = <value optimized out>
        save = <value optimized out>
        previous_echo_area_message = 10862369
        also_record = 10862369
        reread = 0
        polling_stopped_here = <value optimized out>
        orig_kboard = (struct kboard *) 0x16c8620
#9  0x00000000004f733d in read_key_sequence (keybuf=0x7fff49ad15a0, 
    bufsize=30, prompt=10862369, dont_downcase_last=0, 
    can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9473
        interrupted_kboard = (KBOARD *) 0x16c8620
        key = 0
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 10862369
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 3
        nmaps_allocated = 3
        defs = (Lisp_Object * volatile) 0x7fff49ad13c0
        submaps = (Lisp_Object * volatile) 0x7fff49ad13f0
        orig_local_map = 12035445
        orig_keymap = 10862369
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {parent = 21939957, map = 21939957, start = 0, end = 0}
        keytran = {parent = 10854165, map = 10854165, start = 0, end = 0}
        indec = {parent = 21940821, map = 21940821, start = 0, end = 0}
        delayed_switch_frame = 10862369
        original_uppercase = 4413613
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x7f7a3bd59db0
        fake_prefixed_keys = 10862369
#10 0x00000000004f9133 in command_loop_1 () at keyboard.c:1653
        cmd = <value optimized out>
        lose = <value optimized out>
        nonundocount = 0
        keybuf = {44108294, 286541526297010176, 273820952844, 8854528, 
  4611686018427389952, 4611686018427404288, 140734429470144, 140734429470152, 
  140734429468352, 5631403, 273821008272, 4208872, 4294967296, 4294968231, 0, 
  140163064603480, 140734429468592, 2822930839, 140734429468512, 0, 
  140734429468536, 273816789454, 0, 140734429468288, 140734429468032, 0, 1, 
  10862369, 21393489, 286541526297010176}
        i = 11630976
        prev_modiff = 0
        prev_buffer = (struct buffer *) 0x0
        already_adjusted = 0
#11 0x000000000055c73f in internal_condition_case (
    bfun=0x4f8f20 <command_loop_1>, handlers=10949361, 
    hfun=0x4f1860 <cmd_error>) at eval.c:1494
        val = <value optimized out>
        c = {tag = 10862369, val = 10862369, next = 0x7fff49ad1860, 
  gcpro = 0x0, jmp = {{__jmpbuf = {0, 2679520856056530932, 11630944, 
        4294967295, 140734429470144, 140734429470152, -2679360040122447884, 
        2679522811569899508}, __mask_was_saved = 0, __saved_mask = {__val = {
          5253935, 273820980000, 140163064410112, 0, 4294967295, 1, 8345776, 
          11630944, 4294967295, 140734429470144, 140734429470152, 0, 
          273816806426, 140161962737665, 0, 140734429468608}}}}, 
  backlist = 0x0, handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2, 
  poll_suppress_count = 1, interrupt_input_blocked = 0, byte_stack = 0x0}
        h = {handler = 10949361, var = 10862369, chosen_clause = 10862369, 
  tag = 0x7fff49ad16f0, next = 0x0}
#12 0x00000000004f0c0e in command_loop_2 () at keyboard.c:1370
        val = 53760
#13 0x000000000055c857 in internal_catch (tag=<value optimized out>, 
    func=0x4f0bf0 <command_loop_2>, arg=10862369) at eval.c:1230
        c = {tag = 10930705, val = 10862369, next = 0x0, gcpro = 0x0, jmp = {{
      __jmpbuf = {0, 2679520856056530932, 11630944, 4294967295, 
        140734429470144, 140734429470152, -2679360039803680780, 
        2679522811887093748}, __mask_was_saved = 0, __saved_mask = {__val = {
          0, 0, 0, 100, 30064771072, 344, 94500340416, 1, 11262576, 11256802, 
          10902544, 11262577, 10862369, 11256800, 5557911, 11262576}}}}, 
  backlist = 0x0, handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2, 
  poll_suppress_count = 1, interrupt_input_blocked = 0, byte_stack = 0x0}
#14 0x00000000004f16a0 in command_loop () at keyboard.c:1349
No locals.
#15 0x00000000004f1abc in recursive_edit_1 () at keyboard.c:958
        val = <value optimized out>
#16 0x00000000004f1c34 in Frecursive_edit () at keyboard.c:1020
        buffer = 10862369
#17 0x00000000004e6aab in main (argc=3, argv=0x7fff49ad1dc8) at emacs.c:1784
        dummy = 0
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {rlim_cur = 10485760, rlim_max = 18446744073709551615}
        no_loadup = 0
        junk = 0x0



In GNU Emacs 23.0.60.1 (x86_64-redhat-linux-gnu, GTK+ Version 2.12.9)
 of 2008-03-30 on brad.office
Windowing system distributor `The X.Org Foundation', version 11.0.10499901
configured using `configure  '--build=x86_64-redhat-linux-gnu' 
'--host=x86_64-redhat-linux-gnu' '--target=x86_64-redhat-linux-gnu' 
'--program-prefix=' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' 
'--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' 
'--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' 
'--localstatedir=/var' '--sharedstatedir=/usr/com' '--mandir=/usr/share/man' 
'--infodir=/usr/share/info' 'build_alias=x86_64-redhat-linux-gnu' 
'host_alias=x86_64-redhat-linux-gnu' 'target_alias=x86_64-redhat-linux-gnu' 
'CFLAGS=-DMAIL_USE_LOCKF -O2 -g -pipe -Wall -Wp,-D_FORTIFY_SOURCE=2 
-fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.utf8
  value of $XMODIFIERS: @im=none
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Mail

Minor modes in effect:
  iswitchb-mode: t
  show-paren-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t



Additional Info:
I have not been able to reproduce this on Fedora 8.