bug#26646: 26.0.50; Segfault from find-font in "emacs -nw"

[John Mastro]

Hello,

In both Emacs 25.1 and master (at 53f8f4b), calling find-font from an
Emacs built with X support and started with `emacs -nw' results in a
segfault.

In both cases I am testing on Fedora 25. The version of 25.1 I tested on
was Fedora's default version built with GTK, and master was built myself
with Lucid.

To reproduce:
  - Run `emacs -Q -nw'
  - Evaluate (find-font (font-spec :name "Anything-10"))

(It doesn't matter whether "Anything-10" is something made up or an
actual font on the system.)

The result of "thread apply all bt full" is attached. Please let me know
if I can provide any additional information.

        John

In GNU Emacs 26.0.50 (build 1, x86_64-pc-linux-gnu, X toolkit, Xaw3d
scroll bars)
 of 2017-04-24 built on meta
Repository revision: 53f8f4bf2db097f4a2c68194c55a87c5a1176c8c
System Description:     Fedora release 25 (Twenty Five)

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Configured using:
 'configure --with-xml2 --with-zlib --with-gnutls --with-x-toolkit=lucid
 --without-pop'

Configured features:
XAW3D XPM JPEG TIFF GIF PNG SOUND NOTIFY GNUTLS FREETYPE XFT ZLIB
TOOLKIT_SCROLL_BARS LUCID X11

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message subr-x puny seq byte-opt gv
bytecomp byte-compile cconv cl-loaddefs cl-lib dired dired-loaddefs
format-spec rfc822 mml easymenu mml-sec password-cache epa derived epg
epg-config gnus-util rmail rmail-loaddefs mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047
rfc2045 ietf-drums mm-util mail-prsvr mail-utils term/xterm xterm
time-date mule-util tooltip eldoc electric uniquify ediff-hook vc-hooks
lisp-float-type mwheel term/x-win x-win term/common-win x-dnd tool-bar
dnd fontset image regexp-opt fringe tabulated-list replace newcomment
text-mode elisp-mode lisp-mode prog-mode register page menu-bar
rfn-eshadow isearch timer select scroll-bar mouse jit-lock font-lock
syntax facemenu font-core term/tty-colors frame cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese composite charscript case-table
epa-hook jka-cmpr-hook help simple abbrev obarray minibuffer
cl-preloaded nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote inotify dynamic-setting
font-render-setting x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 98731 5181)
 (symbols 48 20009 1)
 (miscs 40 39 132)
 (strings 32 17519 4336)
 (string-bytes 1 558742)
 (vectors 16 12460)
 (vector-slots 8 435232 2455)
 (floats 8 52 544)
 (intervals 56 192 0)
 (buffers 976 11))

gdb-log.txt
Description: Text document