bug#43973: 28.0.50; [NS] Two crashes on macOS

[Win Treese]

I got curious about what was going on with this bug after looking at other 
alloc/dealloc problems on the Mac, and I’m wondering if there is an 
initialization problem in setTranform:

The code is:

- (void)setTransform: (double[3][3]) m
{
  transform = [[NSAffineTransform transform] retain];
  NSAffineTransformStruct tm
    = { m[0][0], m[0][1], m[1][0], m[1][1], m[2][0], m[2][1]};
  [transform setTransformStruct:tm];
}

It seems to create a new NSAffineTransform object with the existing value of 
transform. I imagine that would be NULL the first time through. When the 
deallocation happens (the [transform dealloc] mentioned earlier in the thread, 
I think the following might happen:

[transform dealloc] essentially calls [NSAffineTransform dealloc], which then 
tries to dealloc the object it was initialized with, which was null, and it 
crashes there.

Could that be what’s going on?

- Win