From xemacs-m  Wed Jan  8 18:04:17 1997
Received: from cs.sunysb.edu (sbcs.sunysb.edu [130.245.1.15])
          by xemacs.cs.uiuc.edu (8.8.4/8.8.4) with SMTP
	  id SAA13348; Wed, 8 Jan 1997 18:04:16 -0600 (CST)
Received: from sbkifer.cs.sunysb.edu (sbkifer.cs.sunysb.edu [130.245.1.35]) by cs.sunysb.edu (8.6.12/8.6.9) with SMTP id TAA15423; Wed, 8 Jan 1997 19:12:16 -0500
Message-Id: <199701090012.TAA15423@cs.sunysb.edu>
X-Authentication-Warning: sbcs.cs.sunysb.edu: Host sbkifer.cs.sunysb.edu didn't use HELO protocol
From: kifer@CS.SunySB.EDU (Michael Kifer)
To: crashes@xemacs.org, Steven L Baur <steve@miranova.com>
cc: xemacs-beta@xemacs.org
Subject: Re: core dump and Toobar bug in 19.15-b7
In-reply-to: "Steven L Baur" of 06 Jan 1997 21:49:57 PST
             <m24tguhw56.fsf@altair.xemacs.org> 
Date: Wed, 08 Jan 1997 19:01:45 -0500
Sender: kifer@CS.SunySB.EDU


Start xemacs -q -no-site-file

First, evaluate this progn:

(progn
  (setq bb (selected-frame))
  (setq aa (make-frame (list (cons 'width  21) (cons 'height 3))))
  (select-frame aa)
  (switch-to-buffer "bb")
  )

Then eval the following progn several times (via C-xC-e)

(progn
  (save-excursion
    (set-buffer "bb")
    (set-specifier bottom-toolbar-height (list aa 0))
    (set-specifier bottom-toolbar-height (list aa 42))
    (setq icon (toolbar-make-button-list
		(expand-file-name "debug-up.xpm" toolbar-icon-directory)))
    (set-specifier bottom-toolbar (list aa '([icon bla t "Test"])))
    (modify-frame-parameters
     aa '((width . 21) (height . 3) (top . 33) (left . 11)))
  ))

The first time it'll be ok (it'll have a bottom toolbar). The second time
the toolbar will be behind the modeline!!! 

If this is not bad enough, as you keep evaluating the above progn, the
frame (in var aa) shrinks and when it becomes hair-wide (no kidding!), you
get a core dump. 

Here are the details:

    19.15-b7 on SunOS 4.1.3, X11R6, twm

The error I am getting on the console is (I deleted irrelevant info):

    Fatal error: assertion failed, file eval.c, line 1903, abort()
    Fatal error (6).

    Lisp backtrace follows:
	# (condition-case ... . error)
	# (catch top-level ...)
	IOT trap (core dumped)

Here is the stack:

    (gdb) where
    #0  0x20ab00 in kill ()
    #1  0x2fdd4 in fatal_error_signal ()
    #2  <signal handler called>
    #3  0x20ab00 in kill ()
    #4  0x31bec in assert_failed ()
    #5  0x34284 in signal_1 ()
    #6  0x34edc in error ()
    #7  0x3024 in xrealloc ()
    #8  0x29aa4 in Dynarr_resize ()
    #9  0xaf4b4 in regenerate_window ()
    #10 0xb07d4 in redisplay_window ()
    #11 0xb1250 in redisplay_frame ()
    #12 0xb14ec in redisplay_device ()
    #13 0xb17b4 in redisplay_without_hooks ()
    #14 0xb1998 in redisplay ()
    #15 0x436c4 in Fnext_event ()
    #16 0x18274 in Fcommand_loop_1 ()
    #17 0x1809c in command_loop_1 ()
    #18 0x33e00 in condition_case_1 ()
    #19 0x18568 in command_loop_2 ()
    #20 0x33b84 in internal_catch ()
    #21 0x17cb0 in initial_command_loop ()
    #22 0x30d0c in main_1 ()
    #23 0x3113c in main ()

