bug#43973: 28.0.50; [NS] Two crashes on macOS

[Andrii Kolomoiets]

Alan Third <alan@idiocy.org> writes:

>> The frame must be small enough to not all the toolbar buttons fits the
>> toolbar:
>> 
>> (setq test-frame (make-frame `((parent-frame . ,(selected-frame))
>>                                         (width . 41))))
>> 
>> The last button (isearch) is replaced by ">>".
>
> Funnily enough that ">>" is what I was looking at. I guess it's a
> toolkit image and not something we provide with Emacs...?
>
>> There are no crash if '(width . 42)'.
>
> Can you try this:

Process 28381 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
(code=1, address=0x10c94fc8)
    frame #0: 0x00007fff6fa97678 libobjc.A.dylib`objc_release + 24
libobjc.A.dylib`objc_release:
->  0x7fff6fa97678 <+24>: testb  $0x4, 0x20(%rax)
    0x7fff6fa9767c <+28>: je     0x7fff6fa976e7            ; <+135>
    0x7fff6fa9767e <+30>: movabsq $0x100000000000000, %rcx  ; imm = 
0x100000000000000 
    0x7fff6fa97688 <+40>: movabsq $0x40000000000000, %rdx   ; imm = 
0x40000000000000 
Target 0: (emacs) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
(code=1, address=0x10c94fc8)
  * frame #0: 0x00007fff6fa97678 libobjc.A.dylib`objc_release + 24
    frame #1: 0x0000000100476338 emacs`-[EmacsImage 
dealloc](self=0x000000010178c650, _cmd="dealloc") at nsimage.m:286:3
    frame #2: 0x00007fff6fa9ceb3 
libobjc.A.dylib`objc_object::sidetable_release(bool) + 229
    frame #3: 0x00007fff33e5a6e1 AppKit`-[NSMenuItem dealloc] + 108
    frame #4: 0x00007fff340c83f8 AppKit`-[NSToolbarItem dealloc] + 110
    frame #5: 0x00007fff36b7d2a5 
CoreFoundation`__RELEASE_OBJECTS_IN_THE_ARRAY__ + 118
    frame #6: 0x00007fff36b7d1e8 CoreFoundation`-[__NSArrayM dealloc] + 279
    frame #7: 0x00007fff34227a99 AppKit`-[NSToolbarClippedItemsIndicator 
dealloc] + 84
    frame #8: 0x00007fff6fab3054 
libobjc.A.dylib`AutoreleasePoolPage::releaseUntil(objc_object**) + 134
    frame #9: 0x00007fff6fa97dba libobjc.A.dylib`objc_autoreleasePoolPop + 175
    frame #10: 0x00007fff36bdf335 
CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 
23
    frame #11: 0x00007fff36bdf267 CoreFoundation`__CFRunLoopDoObservers + 457
    frame #12: 0x00007fff36bde805 CoreFoundation`__CFRunLoopRun + 874
    frame #13: 0x00007fff36bdde3e CoreFoundation`CFRunLoopRunSpecific + 462
    frame #14: 0x00007fff3580aabd HIToolbox`RunCurrentEventLoopInMode + 292
    frame #15: 0x00007fff3580a6f4 HIToolbox`ReceiveNextEventCommon + 359
    frame #16: 0x00007fff3580a579 
HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 64
    frame #17: 0x00007fff33e50039 AppKit`_DPSNextEvent + 883
    frame #18: 0x00007fff33e4e880 AppKit`-[NSApplication(NSEvent) 
_nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1352
    frame #19: 0x00007fff33e4058e AppKit`-[NSApplication run] + 658
    frame #20: 0x000000010043b9ba emacs`-[EmacsApp 
run](self=0x000000010152b3a0, _cmd="run") at nsterm.m:5768:9