bug#59794: 29.0.60; NSport segfaults when a fullscreen frame is being closed)

[Po Lu]

Daniel Martín <mardani29@yahoo.es> writes:

> Kai Ma <justksqsf@gmail.com> writes:
>
>>
>> diff --git a/src/nsterm.m b/src/nsterm.m
>> index 507f2a9e7d..f99d7cde3c 100644
>> --- a/src/nsterm.m
>> +++ b/src/nsterm.m
>> @@ -6703,8 +6703,18 @@ - (BOOL)acceptsFirstResponder
>>  
>>  - (void)resetCursorRects
>>  {
>> -  NSRect visible = [self visibleRect];
>> -  NSCursor *currentCursor = FRAME_POINTER_TYPE (emacsframe);
>> +  NSRect visible;
>> +  NSCursor *currentCursor;
>> +
>> +  /* FIXME: [resetCursorRects:] can be called from the event loop
>> +     after the frame is deleted.  When this happens,
>> +     emacsframe->output_data is NULL.  This means there is an
>> +     underlying leak of the EmacsView object!  (bug#59794) */
>> +  if (! emacsframe || ! FRAME_OUTPUT_DATA (emacsframe))
>
> Wouldn't it be more clear to check !FRAME_LIVE_P (emacsframe) instead?
> (I can't reproduce this bug, so I don't know if that would avoid the
> crash.)  There is a similar check in - (void)windowWillExitFullScreen
> and - (void)windowDidExitFullScreen, for example.

Those other calls are a serious problem too.  They obscure an underlying
memory leak, and if emacsframe is not set to NULL by the point they are
called, they could result in use-after-frees once GC deletes emacsframe
entirely.