bug#58857: 28.2; Emacs on macOS seg faults when deleting fullscreen frame

[Po Lu]

Gerd Möllmann <gerd.moellmann@gmail.com> writes:

> Eli Zaretskii <eliz@gnu.org> writes:
>
>> In general, we don't expect any Emacs 28 releases, so it would be of
>> great help to us if you could try Emacs 29 (from the master branch of
>> the Emacs Git repository) and see if the problem still exists there.
>
> I can reproduce this in feature/pkg, which should equal master in this
> area.
>
> * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
> (code=1, address=0xc0)
>     frame #0: 0x0000000100310ce8 emacs`-[EmacsView 
> resetCursorRects](self=0x0000000102f2cb40, _cmd="resetCursorRects") at 
> nsterm.m:6702:29
>    6699       - (void)resetCursorRects
>    6700       {
>    6701         NSRect visible = [self visibleRect];
> -> 6702         NSCursor *currentCursor = FRAME_POINTER_TYPE (emacsframe);
>    6703         NSTRACE ("[EmacsView resetCursorRects]");
>    6704       
>    6705         if (currentCursor == nil)
> Target 0: (emacs) stopped.
> (lldb) bt
> * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
> (code=1, address=0xc0)
>   * frame #0: 0x0000000100310ce8 emacs`-[EmacsView 
> resetCursorRects](self=0x0000000102f2cb40, _cmd="resetCursorRects") at 
> nsterm.m:6702:29
>     frame #1: 0x00000001952beb60 AppKit`-[_NSTrackingAreaAKViewHelper 
> updateTrackingAreasWithInvalidCursorRects:] + 276
>     frame #2: 0x00000001954cb9f0 AppKit`_NSViewSubViewMutationSafeApply + 220
>     frame #3: 0x00000001952bec04 AppKit`-[_NSTrackingAreaAKViewHelper 
> updateTrackingAreasWithInvalidCursorRects:] + 440
>     frame #4: 0x00000001954cb9f0 AppKit`_NSViewSubViewMutationSafeApply + 220
>     frame #5: 0x00000001952bec04 AppKit`-[_NSTrackingAreaAKViewHelper 
> updateTrackingAreasWithInvalidCursorRects:] + 440
>     frame #6: 0x00000001952bd030 AppKit`-[_NSTrackingAreaAKManager 
> displayCycleUpdateStructuralRegions] + 176
>     frame #7: 0x0000000194db7708 
> AppKit`__NSWindowGetDisplayCycleObserverForUpdateStructuralRegions_block_invoke
>  + 364
>     frame #8: 0x0000000194db2cb4 AppKit`NSDisplayCycleObserverInvoke + 168
>     frame #9: 0x0000000194db2910 AppKit`NSDisplayCycleFlush + 644
>     frame #10: 0x00000001990fa120 
> QuartzCore`CA::Transaction::run_commit_handlers(CATransactionPhase) + 120
>     frame #11: 0x00000001990f8ea0 QuartzCore`CA::Transaction::commit() + 324
>     frame #12: 0x0000000194e34b90 AppKit`__62+[CATransaction(NSCATransaction) 
> NS_setFlushesWithDisplayLink]_block_invoke + 272
>     frame #13: 0x0000000195511744 
> AppKit`___NSRunLoopObserverCreateWithHandler_block_invoke + 64
>     frame #14: 0x0000000191ab4de4 
> CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ 
> + 36
>     frame #15: 0x0000000191ab4cd0 CoreFoundation`__CFRunLoopDoObservers + 532
>     frame #16: 0x0000000191ab4308 CoreFoundation`__CFRunLoopRun + 784
>     frame #17: 0x0000000191ab38a4 CoreFoundation`CFRunLoopRunSpecific + 612
>     frame #18: 0x000000019b1273bc HIToolbox`RunCurrentEventLoopInMode + 292
>     frame #19: 0x000000019b127200 HIToolbox`ReceiveNextEventCommon + 672
>     frame #20: 0x000000019b126f48 
> HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 72
>     frame #21: 0x0000000194d0c630 AppKit`_DPSNextEvent + 632
>     frame #22: 0x0000000194d0b7c0 AppKit`-[NSApplication(NSEvent) 
> _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 728
>     frame #23: 0x0000000194cffbf0 AppKit`-[NSApplication run] + 464
>     frame #24: 0x000000010030df40 emacs`-[EmacsApp 
> run](self=0x00000001053150c0, _cmd="run") at nsterm.m:5813:7
>     frame #25: 0x000000010030c66c emacs`ns_select_1(nfds=20, 
> readfds=0x000000016fdfdcdc, writefds=0x000000016fdfdc5c, 
> exceptfds=0x0000000000000000, timeout=0x000000016fdfdc30, 
> sigmask=0x0000000000000000, run_loop_only=NO) at nsterm.m:4828:3
>     frame #26: 0x000000010030c2e8 emacs`ns_select(nfds=20, 
> readfds=0x000000016fdfdcdc, writefds=0x000000016fdfdc5c, 
> exceptfds=0x0000000000000000, timeout=0x000000016fdfdc30, 
> sigmask=0x0000000000000000) at nsterm.m:4880:10
>     frame #27: 0x00000001002a65ec 
> emacs`wait_reading_process_output(time_limit=37, nsecs=0, read_kbd=-1, 
> do_display=true, wait_for_cell=(struct Lisp_Symbol *) $3 = 
> 0x00000001008dcb68, wait_proc=0x0000000000000000, just_wait_proc=0) at 
> process.c:5690:18
>     frame #28: 0x000000010000b724 emacs`sit_for(timeout=(EMACS_INT) $5 = 37, 
> reading=true, display_option=1) at dispnew.c:6252:7
>     frame #29: 0x00000001001587d8 emacs`read_char(commandflag=1, map=(struct 
> Lisp_Cons *) $7 = 0x000000012bc55400, prev_event=(struct Lisp_Symbol *) $10 = 
> 0x00000001008dcb68, used_mouse_menu=0x000000016fdfe997, 
> end_time=0x0000000000000000) at keyboard.c:2870:11
>     frame #30: 0x0000000100154c0c emacs`read_key_sequence(keybuf=(struct 
> Lisp_Symbol *) $13 = 0x00000001008dcb68, prompt=(struct Lisp_Symbol *) $16 = 
> 0x00000001008dcb68, dont_downcase_last=false, can_return_switch_frame=true, 
> fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:10027:12
>     frame #31: 0x0000000100153338 emacs`command_loop_1 at keyboard.c:1375:15
>     frame #32: 0x0000000100231650 
> emacs`internal_condition_case(bfun=(emacs`command_loop_1 at keyboard.c:1268), 
> handlers=(struct Lisp_Symbol *) $19 = 0x00000001008dcbf8, 
> hfun=(emacs`cmd_error at keyboard.c:926)) at eval.c:1471:25
>     frame #33: 0x0000000100152e4c emacs`command_loop_2(handlers=(struct 
> Lisp_Symbol *) $22 = 0x00000001008dcbf8) at keyboard.c:1123:11
>     frame #34: 0x0000000100230e34 emacs`internal_catch(tag=(struct 
> Lisp_Symbol *) $25 = 0x00000001008ebe98, func=(emacs`command_loop_2 at 
> keyboard.c:1119), arg=(struct Lisp_Symbol *) $28 = 0x00000001008dcbf8) at 
> eval.c:1194:25
>     frame #35: 0x0000000100152164 emacs`command_loop at keyboard.c:1101:2
>     frame #36: 0x0000000100151fb4 emacs`recursive_edit_1 at keyboard.c:710:9
>     frame #37: 0x0000000100152500 emacs`Frecursive_edit at keyboard.c:793:3
>     frame #38: 0x000000010014f1e8 emacs`main(argc=1, argv=0x000000016fdff688) 
> at emacs.c:2523:3
>     frame #39: 0x00000001916abe50 dyld`start + 2544
>
> (lldb) p emacsframe
> (frame *) $64 = 0x000000012d811600
> (lldb) p emacsframe->output_data
> (output_data) $63 = {
>   tty = nil
>   x = nil
>   w32 = nil
>   ns = nil
>   pgtk = nil
>   haiku = nil
> }
>
> Other than that, I can't help much with this, I'm afraid.  One could of
> course check it output_data is valid, but if that's the right thing to
> do...

I can reproduce this on GNUstep, so expect a fix soon (anywhere between
2 to 5 hours depending on when I can get home.)