bug#71176: 30.0.50; Segmentation fault (SIGSEGV) in TTY+emacsclient, default_face is nil

[Eli Zaretskii]

> From: Daniel Clemente <n142857@gmail.com>
> Date: Sat, 25 May 2024 11:04:18 +0000
> Cc: Eli Zaretskii <eliz@gnu.org>
> 
> I found out how to reproduce this and a possible cause, see 
> "garbage-collection-messages" below.
> 
> > > 6819      return default_face->id;
> > 
> > Do you use face-remapping?  Is face-remapping-alist non-nil when this
> > happens?  If so, can you show the value of Vface_remapping_alist?
> 
> I don't use it, and it's nil when the SIGSEGV happens.
> (gdb) p Vface_remapping_alist 
> $1 = XIL(0)
> 
> >> warning: Source file is more recent than executable.
> >        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > This is not a good sign: you have edited your sources after the Emacs
> > binary was produced, so some of the information in the backtrace and
> > the GDB session might be inaccurate or even incorrect.
> 
> My source branch was at yesterday's HEAD, sorry. There were only small recent 
> changes in xfaces.c/xdisp.c.
> I now switched my branch to the commit I used to build Emacs 
> (b82a003544c607b5c54bab13870d52), from 2
> weeks ago.
> I also recompiled using -O2 instead of -O3, thanks.
> 
> With that, and by opening+closing many frames in succession (details at 
> bug#71177), I made it crash.
> Backtrace attached below.
> 
> I was able to consistently reproduce the crash by running this command (30 
> seconds is always enough to
> reproduce it, but it also happens after less than 10 secons, so you may 
> change the 30 to a lower number):
> 
> for j in `seq 30`; do for i in `seq 10`; do urxvt -e emacsclient '-nw' '-e' 
> '(dired "~")' &; done; sleep 1 && killall
> emacsclient; done
> 
> I couldn't reproduce it under emacs -Q
> The minimal .emacs needed to reproduce it has these 2 lines:
> 
> (setq garbage-collection-messages t)
> (set-face-foreground 'default "#bbb")

Thanks.  Please try the stab-in-the-dark patch below.

diff --git a/src/xfaces.c b/src/xfaces.c
index 5192b22..8c07e5e 100644
--- a/src/xfaces.c
+++ b/src/xfaces.c
@@ -1041,13 +1041,17 @@ tty_lookup_color (struct frame *f, Lisp_Object color, 
Emacs_Color *tty_color,
                  Emacs_Color *std_color)
 {
   Lisp_Object frame, color_desc;
+  specpdl_ref count;
 
   if (!STRINGP (color) || NILP (Ffboundp (Qtty_color_desc)))
     return false;
 
   XSETFRAME (frame, f);
 
+  count = SPECPDL_INDEX ();
+  specbind (Qinhibit_free_realized_faces, Qt);
   color_desc = call2 (Qtty_color_desc, color, frame);
+  unbind_to (count, Qnil);
   if (CONSP (color_desc) && CONSP (XCDR (color_desc)))
     {
       Lisp_Object rgb;
@@ -1076,7 +1080,10 @@ tty_lookup_color (struct frame *f, Lisp_Object color, 
Emacs_Color *tty_color,
              && !NILP (Ffboundp (Qtty_color_standard_values)))
            {
              /* Look up STD_COLOR separately.  */
+             count = SPECPDL_INDEX ();
+             specbind (Qinhibit_free_realized_faces, Qt);
              rgb = call1 (Qtty_color_standard_values, color);
+             unbind_to (count, Qnil);
              if (! parse_rgb_list (rgb, std_color))
                return false;
            }