bug#43973: 28.0.50; [NS] Two crashes on macOS

[Win Treese <treese@acm.org>]

I got curious about what was going on with this bug after looking at other alloc/dealloc problems on the Mac, and I’m wondering if there is an initialization problem in setTranform:

The code is:

- (void)setTransform: (double[3][3]) m
{
  transform = [[NSAffineTransform transform] retain];
  NSAffineTransformStruct tm
    = { m[0][0], m[0][1], m[1][0], m[1][1], m[2][0], m[2][1]};
  [transform setTransformStruct:tm];
}

It seems to create a new NSAffineTransform object with the existing value of transform. I imagine that would be NULL the first time through. When the deallocation happens (the [transform dealloc] mentioned earlier in the thread, I think the following might happen:

[transform dealloc] essentially calls [NSAffineTransform dealloc], which then tries to dealloc the object it was initialized with, which was null, and it crashes there.

Could that be what’s going on?

- Win