bug#24281: 25.1; (next-frame nil t) crashes

[martin rudalics <rudalics@gmx.at>]

With emacs -Q evaluating (next-frame nil t) currently crashes as:

(gdb) bt
#0  terminate_due_to_signal (sig=22, backtrace_limit=2147483647) at emacs.c:354
#1  0x011f1adf in die (msg=0x1642607 "0 <= n", file=0x1642600 "lisp.h", line=916) at alloc.c:7223
#2  0x01143da3 in XFASTINT (a=...) at lisp.h:916
#3  0x0101794f in candidate_frame (candidate=..., frame=..., minibuf=...) at frame.c:1311
#4  0x01017a53 in next_frame (frame=..., minibuf=...) at frame.c:1338
#5  0x01017f06 in Fnext_frame (frame=..., miniframe=...) at frame.c:1396
#6  0x0121e882 in eval_sub (form=...) at eval.c:2169
#7  0x0121d9f5 in Feval (form=..., lexical=...) at eval.c:1988
#8  0x0122085f in Ffuncall (nargs=3, args=0x82e0e8) at eval.c:2696
#9  0x0127d391 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=0x82e690) at bytecode.c:880
#10 0x01221620 in funcall_lambda (fun=..., nargs=1, arg_vector=0x82e688) at eval.c:2855
#11 0x01220c2e in Ffuncall (nargs=2, args=0x82e680) at eval.c:2742
#12 0x0127d391 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=0x82ed78) at bytecode.c:880
#13 0x01221620 in funcall_lambda (fun=..., nargs=1, arg_vector=0x82ed70) at eval.c:2855
#14 0x01220c2e in Ffuncall (nargs=2, args=0x82ed68) at eval.c:2742
#15 0x01212c52 in Ffuncall_interactively (nargs=2, args=0x82ed68) at callint.c:252
#16 0x012206cf in Ffuncall (nargs=3, args=0x82ed60) at eval.c:2673
#17 0x01215e4e in Fcall_interactively (function=..., record_flag=..., keys=...) at callint.c:840
#18 0x012208b6 in Ffuncall (nargs=4, args=0x82f1c8) at eval.c:2700
#19 0x0127d391 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=0x82f780) at bytecode.c:880
#20 0x01221620 in funcall_lambda (fun=..., nargs=1, arg_vector=0x82f778) at eval.c:2855
#21 0x01220c2e in Ffuncall (nargs=2, args=0x82f770) at eval.c:2742
#22 0x0121ff7f in call1 (fn=..., arg1=...) at eval.c:2552
#23 0x011515c3 in command_loop_1 () at keyboard.c:1479
#24 0x0121b4f2 in internal_condition_case (bfun=0x1150af7 <command_loop_1>, handlers=..., hfun=0x114fd8f <cmd_error>) at eval.c:1309
#25 0x01150591 in command_loop_2 (ignore=...) at keyboard.c:1107
#26 0x0121a696 in internal_catch (tag=..., func=0x1150555 <command_loop_2>, arg=...) at eval.c:1074
#27 0x01150517 in command_loop () at keyboard.c:1086
#28 0x0114f7a7 in recursive_edit_1 () at keyboard.c:692
#29 0x0114fa68 in Frecursive_edit () at keyboard.c:763
#30 0x0114d17e in main (argc=2, argv=0xa32658) at emacs.c:1626

Lisp Backtrace:
"next-frame" (0x82ded0)
"eval" (0x82e0f0)
"elisp--eval-last-sexp" (0x82e688)
"eval-last-sexp" (0x82ed70)
"funcall-interactively" (0x82ed68)
"call-interactively" (0x82f1d0)
"command-execute" (0x82f778)
(gdb)


In GNU Emacs 25.1.1 (i686-pc-mingw32)
  of 2016-08-18 built on MACHNO
Repository revision: 8c2946e29b38fa3e0dff6b4d402ba0fda0e03c9b
Windowing system distributor 'Microsoft Corp.', version 5.1.2600
Configured using:
  'configure --prefix=/c/emacs-git/next --with-wide-int
  --enable-checking=yes --enable-check-lisp-object-type=yes 'CFLAGS=-O0
  -g3''


Looks like an almost four years old bug.  Still I think we should install
the below _before_ the release.


--- a/src/frame.c
+++ b/src/frame.c
@@ -1308,7 +1308,7 @@ candidate_frame (Lisp_Object candidate, Lisp_Object frame, Lisp_Object minibuf)
  		     FRAME_FOCUS_FRAME (c)))
  	    return candidate;
  	}
-      else if (XFASTINT (minibuf) == 0)
+      else if (INTEGERP (minibuf) && XINT (minibuf) == 0)
  	{
  	  if (FRAME_VISIBLE_P (c) || FRAME_ICONIFIED_P (c))
  	    return candidate;


martin