bug#58857: 28.2; Emacs on macOS seg faults when deleting fullscreen frame

[Gerd Möllmann]

Eli Zaretskii <eliz@gnu.org> writes:

> In general, we don't expect any Emacs 28 releases, so it would be of
> great help to us if you could try Emacs 29 (from the master branch of
> the Emacs Git repository) and see if the problem still exists there.

I can reproduce this in feature/pkg, which should equal master in this
area.

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
(code=1, address=0xc0)
    frame #0: 0x0000000100310ce8 emacs`-[EmacsView 
resetCursorRects](self=0x0000000102f2cb40, _cmd="resetCursorRects") at 
nsterm.m:6702:29
   6699 - (void)resetCursorRects
   6700 {
   6701   NSRect visible = [self visibleRect];
-> 6702   NSCursor *currentCursor = FRAME_POINTER_TYPE (emacsframe);
   6703   NSTRACE ("[EmacsView resetCursorRects]");
   6704 
   6705   if (currentCursor == nil)
Target 0: (emacs) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
(code=1, address=0xc0)
  * frame #0: 0x0000000100310ce8 emacs`-[EmacsView 
resetCursorRects](self=0x0000000102f2cb40, _cmd="resetCursorRects") at 
nsterm.m:6702:29
    frame #1: 0x00000001952beb60 AppKit`-[_NSTrackingAreaAKViewHelper 
updateTrackingAreasWithInvalidCursorRects:] + 276
    frame #2: 0x00000001954cb9f0 AppKit`_NSViewSubViewMutationSafeApply + 220
    frame #3: 0x00000001952bec04 AppKit`-[_NSTrackingAreaAKViewHelper 
updateTrackingAreasWithInvalidCursorRects:] + 440
    frame #4: 0x00000001954cb9f0 AppKit`_NSViewSubViewMutationSafeApply + 220
    frame #5: 0x00000001952bec04 AppKit`-[_NSTrackingAreaAKViewHelper 
updateTrackingAreasWithInvalidCursorRects:] + 440
    frame #6: 0x00000001952bd030 AppKit`-[_NSTrackingAreaAKManager 
displayCycleUpdateStructuralRegions] + 176
    frame #7: 0x0000000194db7708 
AppKit`__NSWindowGetDisplayCycleObserverForUpdateStructuralRegions_block_invoke 
+ 364
    frame #8: 0x0000000194db2cb4 AppKit`NSDisplayCycleObserverInvoke + 168
    frame #9: 0x0000000194db2910 AppKit`NSDisplayCycleFlush + 644
    frame #10: 0x00000001990fa120 
QuartzCore`CA::Transaction::run_commit_handlers(CATransactionPhase) + 120
    frame #11: 0x00000001990f8ea0 QuartzCore`CA::Transaction::commit() + 324
    frame #12: 0x0000000194e34b90 AppKit`__62+[CATransaction(NSCATransaction) 
NS_setFlushesWithDisplayLink]_block_invoke + 272
    frame #13: 0x0000000195511744 
AppKit`___NSRunLoopObserverCreateWithHandler_block_invoke + 64
    frame #14: 0x0000000191ab4de4 
CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 
36
    frame #15: 0x0000000191ab4cd0 CoreFoundation`__CFRunLoopDoObservers + 532
    frame #16: 0x0000000191ab4308 CoreFoundation`__CFRunLoopRun + 784
    frame #17: 0x0000000191ab38a4 CoreFoundation`CFRunLoopRunSpecific + 612
    frame #18: 0x000000019b1273bc HIToolbox`RunCurrentEventLoopInMode + 292
    frame #19: 0x000000019b127200 HIToolbox`ReceiveNextEventCommon + 672
    frame #20: 0x000000019b126f48 
HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 72
    frame #21: 0x0000000194d0c630 AppKit`_DPSNextEvent + 632
    frame #22: 0x0000000194d0b7c0 AppKit`-[NSApplication(NSEvent) 
_nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 728
    frame #23: 0x0000000194cffbf0 AppKit`-[NSApplication run] + 464
    frame #24: 0x000000010030df40 emacs`-[EmacsApp 
run](self=0x00000001053150c0, _cmd="run") at nsterm.m:5813:7
    frame #25: 0x000000010030c66c emacs`ns_select_1(nfds=20, 
readfds=0x000000016fdfdcdc, writefds=0x000000016fdfdc5c, 
exceptfds=0x0000000000000000, timeout=0x000000016fdfdc30, 
sigmask=0x0000000000000000, run_loop_only=NO) at nsterm.m:4828:3
    frame #26: 0x000000010030c2e8 emacs`ns_select(nfds=20, 
readfds=0x000000016fdfdcdc, writefds=0x000000016fdfdc5c, 
exceptfds=0x0000000000000000, timeout=0x000000016fdfdc30, 
sigmask=0x0000000000000000) at nsterm.m:4880:10
    frame #27: 0x00000001002a65ec 
emacs`wait_reading_process_output(time_limit=37, nsecs=0, read_kbd=-1, 
do_display=true, wait_for_cell=(struct Lisp_Symbol *) $3 = 0x00000001008dcb68, 
wait_proc=0x0000000000000000, just_wait_proc=0) at process.c:5690:18
    frame #28: 0x000000010000b724 emacs`sit_for(timeout=(EMACS_INT) $5 = 37, 
reading=true, display_option=1) at dispnew.c:6252:7
    frame #29: 0x00000001001587d8 emacs`read_char(commandflag=1, map=(struct 
Lisp_Cons *) $7 = 0x000000012bc55400, prev_event=(struct Lisp_Symbol *) $10 = 
0x00000001008dcb68, used_mouse_menu=0x000000016fdfe997, 
end_time=0x0000000000000000) at keyboard.c:2870:11
    frame #30: 0x0000000100154c0c emacs`read_key_sequence(keybuf=(struct 
Lisp_Symbol *) $13 = 0x00000001008dcb68, prompt=(struct Lisp_Symbol *) $16 = 
0x00000001008dcb68, dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:10027:12
    frame #31: 0x0000000100153338 emacs`command_loop_1 at keyboard.c:1375:15
    frame #32: 0x0000000100231650 
emacs`internal_condition_case(bfun=(emacs`command_loop_1 at keyboard.c:1268), 
handlers=(struct Lisp_Symbol *) $19 = 0x00000001008dcbf8, hfun=(emacs`cmd_error 
at keyboard.c:926)) at eval.c:1471:25
    frame #33: 0x0000000100152e4c emacs`command_loop_2(handlers=(struct 
Lisp_Symbol *) $22 = 0x00000001008dcbf8) at keyboard.c:1123:11
    frame #34: 0x0000000100230e34 emacs`internal_catch(tag=(struct Lisp_Symbol 
*) $25 = 0x00000001008ebe98, func=(emacs`command_loop_2 at keyboard.c:1119), 
arg=(struct Lisp_Symbol *) $28 = 0x00000001008dcbf8) at eval.c:1194:25
    frame #35: 0x0000000100152164 emacs`command_loop at keyboard.c:1101:2
    frame #36: 0x0000000100151fb4 emacs`recursive_edit_1 at keyboard.c:710:9
    frame #37: 0x0000000100152500 emacs`Frecursive_edit at keyboard.c:793:3
    frame #38: 0x000000010014f1e8 emacs`main(argc=1, argv=0x000000016fdff688) 
at emacs.c:2523:3
    frame #39: 0x00000001916abe50 dyld`start + 2544

(lldb) p emacsframe
(frame *) $64 = 0x000000012d811600
(lldb) p emacsframe->output_data
(output_data) $63 = {
  tty = nil
  x = nil
  w32 = nil
  ns = nil
  pgtk = nil
  haiku = nil
}

Other than that, I can't help much with this, I'm afraid.  One could of
course check it output_data is valid, but if that's the right thing to
do...