Segfault and font corruption in menu under Windows

[Ralf Angeli]

We received a bug report on the AUCTeX list about a crash of Emacs
under Windows.  The report including a description on how to reproduce
the crash can be found at
<URL:http://thread.gmane.org/gmane.emacs.auctex.general/1281/focus=1286>.
Here is a backtrace I could produce following the recipe:

$ gdb /c/Programme/Emacs/bin/emacs.exe
GNU gdb 5.2.1
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-mingw32"...
(gdb) run
Starting program: c:/Programme/Emacs/bin/emacs.exe 

Program received signal SIGSEGV, Segmentation fault.
[Switching to thread 2984.0x834]
0x77c17fd4 in _libkernel32_a_iname ()
(gdb) backtrace
#0  0x77c17fd4 in _libkernel32_a_iname ()
#1  0x20ecefa8 in ?? ()
#2  0x01134e94 in w32_wnd_proc (hwnd=0x45029e, msg=44, wParam=0, 
    lParam=552399352) at w32fns.c:3513
#3  0x77d18734 in _libkernel32_a_iname ()
#4  0x77d18816 in _libkernel32_a_iname ()
#5  0x77d1c63f in _libkernel32_a_iname ()
#6  0x77d1e905 in _libkernel32_a_iname ()
#7  0x6d18160b in _libwinspool_a_iname ()
#8  0x77d18734 in _libkernel32_a_iname ()
#9  0x77d18816 in _libkernel32_a_iname ()
#10 0x77d1b4c0 in _libkernel32_a_iname ()
#11 0x77d4f383 in _libkernel32_a_iname ()
#12 0x7c91eae3 in _libkernel32_a_iname ()
#13 0x77d1d598 in _libkernel32_a_iname ()
#14 0x77d1d545 in _libkernel32_a_iname ()
#15 0x01134cad in w32_wnd_proc (hwnd=0x45029e, msg=274, wParam=61589, 
    lParam=7668163) at w32fns.c:3893
#16 0x77d18734 in _libkernel32_a_iname ()
#17 0x77d18816 in _libkernel32_a_iname ()
#18 0x77d1c63f in _libkernel32_a_iname ()
#19 0x77d1e905 in _libkernel32_a_iname ()
#20 0x6d18160b in _libwinspool_a_iname ()
#21 0x77d18734 in _libkernel32_a_iname ()
#22 0x77d18816 in _libkernel32_a_iname ()
#23 0x77d1b4c0 in _libkernel32_a_iname ()
#24 0x77d1b50c in _libkernel32_a_iname ()
#25 0x7c91eae3 in _libkernel32_a_iname ()
#26 0x77d1d598 in _libkernel32_a_iname ()
#27 0x77d1d545 in _libkernel32_a_iname ()
#28 0x01134cad in w32_wnd_proc (hwnd=0x45029e, msg=161, wParam=5, 
    lParam=7668163) at w32fns.c:3893
#29 0x77d18734 in _libkernel32_a_iname ()
#30 0x77d18816 in _libkernel32_a_iname ()
#31 0x77d1c63f in _libkernel32_a_iname ()
#32 0x77d1e905 in _libkernel32_a_iname ()
#33 0x6d18160b in _libwinspool_a_iname ()
#34 0x77d18734 in _libkernel32_a_iname ()
#35 0x77d18816 in _libkernel32_a_iname ()
#36 0x77d189cd in _libkernel32_a_iname ()
#37 0x77d196c7 in _libkernel32_a_iname ()
#38 0x01134673 in w32_msg_pump (msg_buf=0x20ececd0) at w32fns.c:2578
#39 0x011367c2 in w32_msg_worker (dw=0) at w32fns.c:2703
#40 0x7c80b50b in _libkernel32_a_iname ()
(gdb) 


I tried to construct a test case to be used with `emacs -Q' and
without the need for AUCTeX.  I managed to reproduce the font
corruption (which seems to affect only bold characters) but not the
crash with the following recipe:

* Start Emacs with `emacs -Q'.
* Evaluate the following code:
  (easy-menu-define nil (current-local-map) nil
    '("foo" "bar"))
* Open the menu "foo", close the menu "foo" and open the menu "foo"
  again.
* With the menu opened move the mouse pointer left and right over the
  other menus.  Eventually when the mouse pointer comes to the "foo"
  menu again, only sqares instead of the string "bar" will be
  displayed.


In GNU Emacs 22.0.50.1 (i386-mingw-nt5.1.2600)
 of 2006-07-27 on NEUTRINO
X server distributor `Microsoft Corp.', version 5.1.2600
configured using `configure --with-gcc (3.4) --cflags 
-Ic:/Programme/GnuWin32/include'

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: DEU
  locale-coding-system: cp1252
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  encoded-kbd-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  auto-compression-mode: t
  line-number-mode: t

Recent input:
M-x r e p o r t - e m <tab> <return>

Recent messages:
(c:\Programme\Emacs\bin\emacs.exe -Q)
Loading encoded-kb...done
For information about the GNU Project and its goals, type C-h C-p.
Loading emacsbug...
Loading regexp-opt...done
Loading emacsbug...done