bug#43973: 28.0.50; [NS] Two crashes on macOS

[Andrii Kolomoiets]

Update to recent trunk brought me everyone's favorite random crashes.

In an attempt to find the recipe for reproduce the bug somehow, I spot
two crashes that I actually can reproduce in 'emacs -Q'.

The first one is more "stable":

With this code in scratch and point at '|':

    (make-frame `((parent-frame . ,(selected-frame))
                  (width . 0.5)
                  (height . 0.5)
                  (top . 0.5)
                  (left . 0.5)))|

1. C-x C-e
2. s-w

Repeating these two steps 3-5 times leads to crash.  Most of the time
the only meaningfull record in the 'bt' is:

Thread 3 received signal SIGSEGV, Segmentation fault.
0x00007fff6fa97678 in ?? ()
(gdb) bt full
#0  0x00007fff6fa97678 in ?? ()
No symbol table info available.
#1  0x0000000100476338 in -[EmacsImage dealloc] (self=0x1014c77f0, 
_cmd=0x7fff7afcdc58) at nsimage.m:286
No locals.

It may be tool bar related, because Emacs is not crashing with
tool-bar-mode turned of.


The second one is not reproducible every time:

1. M-x tool-bar-mode
2. Evaluate
    (let ((params `((parent-frame . ,(selected-frame))
                    (undecorated . t))))
      (dotimes (_z 100)
        (set-face-background 'internal-border "black"
                             (make-frame params))))
3. Move the frame

Thread 3 received signal SIGSEGV, Segmentation fault.
0x0000000100456e88 in ns_clear_under_internal_border (f=0x13cedafe8) at 
nsterm.m:3052
3052          [ns_lookup_indexed_color (NS_FACE_BACKGROUND (face), f) set];
(gdb) bt full
#0  0x0000000100456e88 in ns_clear_under_internal_border (f=0x13cedafe8) at 
nsterm.m:3052
        frame_rect = {origin = {x = 0, y = 0}, size = {width = 595, height = 
508}}
        face_id = 15
        border_width = 2
        view = 0x10bfb2b70
        edge_rect = {origin = {x = 0, y = 6.9529314086768113e-310}, size = 
{width = 2.6133677750952917e-314,
            height = 2.6133668897296544e-314}}
        edge = {NSRectEdgeMinX, NSRectEdgeMinY, NSRectEdgeMaxX, NSRectEdgeMaxY}
        face = 0x0
#1  0x0000000100067b8d in redisplay_internal () at xdisp.c:16014
        gcscrollbars = false
        f_redisplay_flag = false
        f = 0x13cedafe8
        w = 0x105046430
        sw = 0x105046430
        fr = 0x10503b430
        pending = false
        must_finish = true
        match_p = true
        tlbufpos = {charpos = 304, bytepos = 304}
        tlendpos = {charpos = 0, bytepos = 0}
        number_of_visible_frames = 101
        count = 3
        sf = 0x10503b430
        polling_stopped_here = true
        tail = {i = 0x102227d93}
        frame = {i = 0x13cedafed}
        hscroll_retries = 0
        garbaged_frame_retries = 0
        consider_all_windows_p = true
        update_miniwindow_p = false
#2  0x000000010006ceb9 in redisplay () at xdisp.c:15159
No locals.

(Just for the record: in my usual workflow I don't create that much
child frames)

Thanks! And hope Emacs is crashing on your side too ;)

In GNU Emacs 28.0.50 (build 3, x86_64-apple-darwin19.6.0, NS appkit-1894.60 
Version 10.15.6 (Build 19G2021))
Windowing system distributor 'Apple', version 10.3.1894
System Description:  Mac OS X 10.15.6

Configured using:
 'configure --enable-checking=yes,glyphs --enable-check-lisp-object-type
 'CFLAGS=-O0 -g3''