Re: SIGSEGV after mouse-1 on toolbar

[Richard Stallman]

    (gdb) p *glyph
    $15 = {
      charpos = 268435455, 

    So charpos is -1 here.

-1 is a legitimate value for glyph->charpos, in some cases, but
268435455 as a C int is not the same as -1.  But the relationship is
suggestive: perhaps something copies a Lisp integer to charpos without
checking it or properly converting it to C.  Finding all the places
that set the charpos field and checking them could be a way to find
this bug, if there is no better way.

However, I have a feeling that this glyph is really a stray pointer to
something which is not a glyph at all.  The contents look
unreasonable.

So I wonder, did x_tool_bar_item screw up trying to find the glyph?
Maybe it got confused because x was negative.

The work is done in x_y_to_hpos_vpos.  Can you either step
or hand-simulate the code in x_y_to_hpos_vpos, using the actual data,
so as to see whether it found a real glyph, and the right glyph?