bug#30800: 26.0.91; unknown crash on macos

[Aaron Jensen <aaronjensen@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 627 bytes --]

On Wed, Mar 21, 2018 at 12:36 PM, Eli Zaretskii <eliz@gnu.org> wrote:
>> or just add
>>
>>     if (represented_frame == f)
>>       represented_frame = NULL;
>>
>> to x_destroy_frame as you say.
>
> If that fixes the problem, it's the safest change I can think of, so
> perhaps Aaron could try running Emacs 26.0.91 with it.

It seems to fix it. I'm unable to reproduce the crash with this patch
applied. I tried to represent what was going on in my comments/commit
messages but I'm happy to change them if anyone has a better way to
describe it. That is if you want to apply this instead of fixing it in
another way.

Thanks.

[-- Attachment #2: 0001-Fix-crash-after-frame-is-freed-on-macOS-bug-30800.patch --]
[-- Type: application/octet-stream, Size: 892 bytes --]

From 323740bf0d554fbfc6afc90ed81c68879cd46ece Mon Sep 17 00:00:00 2001
From: Aaron Jensen <aaronjensen@gmail.com>
Date: Wed, 21 Mar 2018 22:30:08 -0700
Subject: [PATCH] Fix crash after frame is freed on macOS (bug#30800)

* src/nsterm.m (x_free_frame_resources): Clear represented_frame.
(bug#30800)
---
 src/nsterm.m | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/nsterm.m b/src/nsterm.m
index 3d58cd5ec6..c8ae31abc0 100644
--- a/src/nsterm.m
+++ b/src/nsterm.m
@@ -1692,6 +1692,10 @@ -(void)remove
     dpyinfo->x_highlight_frame = 0;
   if (f == hlinfo->mouse_face_mouse_frame)
     reset_mouse_highlight (hlinfo);
+  /* Ensure that sendEvent does not attempt to dereference a freed
+     frame. (bug#30800) */
+  if (represented_frame == f)
+    represented_frame = NULL;
 
   if (f->output_data.ns->miniimage != nil)
     [f->output_data.ns->miniimage release];
-- 
2.16.2