Re: shr using `make-xwidget' incorrectly

[Po Lu]

Eli Zaretskii <eliz@gnu.org> writes:

>> Which reminds me of another problem (in the Emacs 28 xwidget code as
>> well): If an xwidget's buffer is killed, but references to it still
>> exist somewhere, crashes can happen, because the GTK resources allocated
>> to the xwidget are killed in `kill_buffer_xwidgets' and not during
>> garbage collection.
>> 
>> I think the best thing to do in this case would be to introduce a
>> `dead' state for xwidgets, not unlike killed buffers and dead frames,
>> which an xwidget is set to after being killed.
>> 
>> Then, performing any sort of operation on a killed xwidget can either
>> throw an error, or do nothing.

> Why can't we release the GTK resources when such a buffer is killed?

We are releasing the GTK resources when such a buffer is killed.  This
is the problem here: code that uses `CHECK_XWIDGET' won't catch the case
where the GTK resources are released, but there are still references to
the xwidget, which causes use-after-frees when trying to redisplay the
xwidget, or when calling, say, `xwidget-webkit-goto-uri' on the xwidget.

The comment in kill_buffer_xwidgets that says:

      /* TODO free the GTK things in xw.  */

Is probably outdated and likely should be removed.  But I am still
investigating through the history of that file to make sure of that, so
please bear with me for a while.

Thanks.