bug#38774: crash in image_pix_context_get_pixel

[Madhu]

Recent emacs configured with

configure -C --without-all --with-xml2 --with-dbus --with-m17n-flt
 --with-libotf --with-xft --with-x-toolkit=athena
 --with-toolkit-scroll-bars --with-xaw3d --with-cairo --with-harfbuzz
 --with-png

crashes on startup. The backtrace is

Starting program: /7/gtk/emacs/build-xt-debug/src/emacs -Q
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
delete terminal 0xa4b720 called

Program received signal SIGSEGV, Segmentation fault.
0x00000000005bf574 in image_pix_context_get_pixel (y=<optimized out>, x=0, 
    image=0xb3a210) at /7/gtk/emacs/src/image.c:183
(gdb) back
#0  0x00000000005bf574 in image_pix_context_get_pixel (y=<optimized out>, 
    x=0, image=0xb3a210) at /7/gtk/emacs/src/image.c:183
#1  image_pix_context_get_pixel (image=0xb3a210, x=0, y=<optimized out>)
    at /7/gtk/emacs/src/image.c:180
#2  0x00000000005bf65c in four_corners_best (pimg=0xb3a210, 
    corners=corners@entry=0xde108c, width=2, height=24)
    at /7/gtk/emacs/src/image.c:1334
#3  0x00000000005c2dfc in image_background (img=0xde1020, f=0xb0e9c0, 
    pimg=<optimized out>, pimg@entry=0x0) at /7/gtk/emacs/src/image.c:1374
#4  0x00000000004c8c9b in x_setup_relief_colors (s=s@entry=0x7fffffffbaa0)
    at /7/gtk/emacs/src/xterm.c:2746
#5  0x00000000004c8e09 in x_draw_glyph_string_box (s=s@entry=0x7fffffffbaa0)
    at /7/gtk/emacs/src/xterm.c:3029
#6  0x00000000004c9c98 in x_draw_glyph_string (s=0x7fffffffbaa0)
    at /7/gtk/emacs/src/xterm.c:3970
#7  0x000000000045d045 in draw_glyphs (w=0xbfd670, x=<optimized out>, 
    row=0xc9d960, area=TEXT_AREA, start=<optimized out>, end=<optimized out>, 
    hl=<optimized out>, overlaps=<optimized out>)
    at /7/gtk/emacs/src/xdisp.c:28490
#8  0x0000000000462731 in gui_write_glyphs (w=0xbfd670, 
    updated_row=<optimized out>, start=<optimized out>, 
    updated_area=TEXT_AREA, len=13) at /7/gtk/emacs/src/xdisp.c:30517
#9  0x000000000041d843 in update_text_area (vpos=0, updated_row=0xc9d960, 
    w=0xbfd670) at /7/gtk/emacs/src/dispnew.c:3832
#10 update_window_line (w=w@entry=0xbfd670, vpos=vpos@entry=0, 
    mouse_face_overwritten_p=mouse_face_overwritten_p@entry=0x7fffffffc33f)
    at /7/gtk/emacs/src/dispnew.c:4075
#11 0x0000000000422099 in update_window (w=w@entry=0xbfd670, 
    force_p=<optimized out>, force_p@entry=true)
    at /7/gtk/emacs/src/dispnew.c:3604
#12 0x00000000004238ae in update_frame (f=f@entry=0xb0e9c0, 
    force_p=<optimized out>, force_p@entry=false, 
    inhibit_hairy_id_p=inhibit_hairy_id_p@entry=false)
    at /7/gtk/emacs/src/dispnew.c:3206
#13 0x0000000000457f65 in redisplay_internal ()
    at /7/gtk/emacs/src/xdisp.c:15702
#14 0x00000000004f45d7 in read_char (commandflag=1, map=XIL(0xad0d63), 
    prev_event=XIL(0), used_mouse_menu=0x7fffffffdd8b, end_time=0x0)
    at /7/gtk/emacs/src/keyboard.c:2488
#15 0x00000000004f6eee in read_key_sequence (keybuf=<optimized out>, 
    prompt=XIL(0), dont_downcase_last=<optimized out>, 
    can_return_switch_frame=true, fix_current_buffer=true, 
    prevent_redisplay=<optimized out>) at /7/gtk/emacs/src/keyboard.c:9538
#16 0x00000000004f856e in command_loop_1 () at /7/gtk/emacs/src/lisp.h:1047
#17 0x000000000055bf57 in internal_condition_case (
    bfun=bfun@entry=0x4f8390 <command_loop_1>, 
    handlers=handlers@entry=XIL(0x90), hfun=hfun@entry=0x4ef690 <cmd_error>)
    at /7/gtk/emacs/src/eval.c:1355
#18 0x00000000004ea44c in command_loop_2 (ignore=ignore@entry=XIL(0))
    at /7/gtk/emacs/src/lisp.h:1047
#19 0x000000000055beb1 in internal_catch (tag=tag@entry=XIL(0xcc60), 
    func=func@entry=0x4ea430 <command_loop_2>, arg=arg@entry=XIL(0))
    at /7/gtk/emacs/src/eval.c:1116
#20 0x00000000004ea3f4 in command_loop () at /7/gtk/emacs/src/lisp.h:1047
#21 0x00000000004ef2a6 in recursive_edit_1 ()
    at /7/gtk/emacs/src/keyboard.c:714
#22 0x00000000004ef5d0 in Frecursive_edit ()
    at /7/gtk/emacs/src/keyboard.c:786
#23 0x000000000041aa71 in main (argc=2, argv=<optimized out>)
    at /7/gtk/emacs/src/emacs.c:2078

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
(gdb)  p image->data

0x0

With emacs -nw (which doesn't crash) the following details are printed:

In GNU Emacs 28.0.50 (build 2, x86_64-pc-linux-gnu, X toolkit, cairo version 1.\
16.0, Xaw3d scroll bars) of 2019-12-28 built on leonis4

[BTW
Composing main Info directory...done
user-error: Info file emacs does not exist
        ;; What nonsense! Of course it exists! in /7/gtk/emacs/info/emacs.info
]

Configured features:
XAW3D PNG CAIRO DBUS LIBXML2 FREETYPE HARFBUZZ M17N_FLT LIBOTF
TOOLKIT_SCROLL_BARS LUCID X11 XDBE XIM PDUMPER GMP

Now I had this same crash on master a few weeks ago even before the
emacs-28 branch (when compiled with gtk instead of xt - the crash
happened on a emacs -Q -f gnus in that case)

The information in this bug report may not be enough as it may depend on
the versions of the graphics libraries. I will be glad to supply the
info if it is needed.