bug#64147: 30.0.50; Crash when deleting fullscreen frame on macOS

bug#64147: 30.0.50; Crash when deleting fullscreen frame on macOS

[Eshel Yaron via Bug reports for GNU Emacs, the Swiss army knife of text editors]

Hi,

Emacs on macOS seems to crash when trying to delete a fullscreen frame:

1. emacs -Q
2. C-x 5 b RET (switch to *Messages* in another frame, the specific
buffer is not important, just the new frame)
3. M-x toggle-frame-fullscreen
4. C-x 5 0
5. Emacs crashes with segfault

Running Emacs under `lldb` gives the following backtrace (I'm not
totally sure but it looks like Emacs is trying to access the already
deleted frame):

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xc0)
    frame #0: 0x00000001003449a1 emacs`-[EmacsView resetCursorRects](self=0x0000000102235550, _cmd="resetCursorRects") at nsterm.m:6712:29
   6709	- (void)resetCursorRects
   6710	{
   6711	  NSRect visible = [self visibleRect];
-> 6712	  NSCursor *currentCursor = FRAME_POINTER_TYPE (emacsframe);
   6713	  NSTRACE ("[EmacsView resetCursorRects]");
   6714
   6715	  if (currentCursor == nil)
Target 0: (emacs) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xc0)
  * frame #0: 0x00000001003449a1 emacs`-[EmacsView resetCursorRects](self=0x0000000102235550, _cmd="resetCursorRects") at nsterm.m:6712:29
    frame #1: 0x00007ff81c8cd89d AppKit`-[_NSTrackingAreaAKViewHelper updateTrackingAreasWithInvalidCursorRects:] + 366
    frame #2: 0x00007ff81cb3d108 AppKit`_NSViewSubViewMutationSafeApply + 227
    frame #3: 0x00007ff81c8cd95b AppKit`-[_NSTrackingAreaAKViewHelper updateTrackingAreasWithInvalidCursorRects:] + 556
    frame #4: 0x00007ff81cb3d108 AppKit`_NSViewSubViewMutationSafeApply + 227
    frame #5: 0x00007ff81c8cd95b AppKit`-[_NSTrackingAreaAKViewHelper updateTrackingAreasWithInvalidCursorRects:] + 556
    frame #6: 0x00007ff81c8cb9ee AppKit`-[_NSTrackingAreaAKManager displayCycleUpdateStructuralRegions] + 227
    frame #7: 0x00007ff81c2e3ee9 AppKit`__NSWindowGetDisplayCycleObserverForUpdateStructuralRegions_block_invoke + 390
    frame #8: 0x00007ff81c2deb8c AppKit`NSDisplayCycleObserverInvoke + 142
    frame #9: 0x00007ff81c2de7bc AppKit`NSDisplayCycleFlush + 878
    frame #10: 0x00007ff820a2e3a6 QuartzCore`CA::Transaction::run_commit_handlers(CATransactionPhase) + 98
    frame #11: 0x00007ff820a2ce9e QuartzCore`CA::Transaction::commit() + 372
    frame #12: 0x00007ff81c37bfcf AppKit`__62+[CATransaction(NSCATransaction) NS_setFlushesWithDisplayLink]_block_invoke + 285
    frame #13: 0x00007ff81cb8ee90 AppKit`___NSRunLoopObserverCreateWithHandler_block_invoke + 41
    frame #14: 0x00007ff81918a444 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__ + 23
    frame #15: 0x00007ff81918a36b CoreFoundation`__CFRunLoopDoObservers + 482
    frame #16: 0x00007ff8191898f6 CoreFoundation`__CFRunLoopRun + 859
    frame #17: 0x00007ff819188f31 CoreFoundation`CFRunLoopRunSpecific + 560
    frame #18: 0x00007ff822c04dad HIToolbox`RunCurrentEventLoopInMode + 292
    frame #19: 0x00007ff822c049f4 HIToolbox`ReceiveNextEventCommon + 199
    frame #20: 0x00007ff822c04918 HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 64
    frame #21: 0x00007ff81c21d5d0 AppKit`_DPSNextEvent + 858
    frame #22: 0x00007ff81c21c47a AppKit`-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1214
    frame #23: 0x00007ff81c20eae8 AppKit`-[NSApplication run] + 586
    frame #24: 0x0000000100341229 emacs`-[EmacsApp run](self=0x000000010211c590, _cmd="run") at nsterm.m:5823:7
    frame #25: 0x0000000100361472 emacs`ns_read_socket_1(terminal=0x0000000102832030, hold_quit=0x00007ff7bfefd8c0, no_release=NO) at nsterm.m:4703:11
    frame #26: 0x000000010035a55f emacs`ns_read_socket(terminal=0x0000000102832030, hold_quit=0x00007ff7bfefd8c0) at nsterm.m:4721:10
    frame #27: 0x0000000100169714 emacs`gobble_input at keyboard.c:7430:17
    frame #28: 0x0000000100169218 emacs`get_input_pending(flags=0) at keyboard.c:7386:7
    frame #29: 0x000000010017b8a4 emacs`detect_input_pending at keyboard.c:10890:27
    frame #30: 0x00000001002c3b9c emacs`wait_reading_process_output(time_limit=30, nsecs=0, read_kbd=-1, do_display=true, wait_for_cell=0x0000000000000000, wait_proc=0x0000000000000000, just_wait_proc=0) at process.c:5563:7
    frame #31: 0x00000001000120c1 emacs`sit_for(timeout=0x000000000000007a, reading=true, display_option=1) at dispnew.c:6270:7
    frame #32: 0x000000010016548c emacs`read_char(commandflag=1, map=0x000000011804f183, prev_event=0x0000000000000000, used_mouse_menu=0x00007ff7bfefeaff, end_time=0x0000000000000000) at keyboard.c:2885:11
    frame #33: 0x000000010015fe25 emacs`read_key_sequence(keybuf=0x00007ff7bfefee20, prompt=0x0000000000000000, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:10087:12
    frame #34: 0x000000010015e358 emacs`command_loop_1 at keyboard.c:1384:15
    frame #35: 0x0000000100246348 emacs`internal_condition_case(bfun=(emacs`command_loop_1 at keyboard.c:1278), handlers=0x0000000000000090, hfun=(emacs`cmd_error at keyboard.c:936)) at eval.c:1486:25
    frame #36: 0x000000010015cd83 emacs`command_loop_2(handlers=0x0000000000000090) at keyboard.c:1133:11
    frame #37: 0x0000000100245aa3 emacs`internal_catch(tag=0x000000000000f870, func=(emacs`command_loop_2 at keyboard.c:1129), arg=0x0000000000000090) at eval.c:1209:25
    frame #38: 0x000000010015cb1d emacs`command_loop at keyboard.c:1111:2
    frame #39: 0x000000010015c922 emacs`recursive_edit_1 at keyboard.c:720:9
    frame #40: 0x000000010015d5be emacs`Frecursive_edit at keyboard.c:803:3
    frame #41: 0x0000000100159c8e emacs`main(argc=2, argv=0x00007ff7bfeff698) at emacs.c:2530:3
    frame #42: 0x00007ff818d5541f dyld`start + 1903


In GNU Emacs 30.0.50 (build 8, x86_64-apple-darwin22.5.0, NS
 appkit-2299.60 Version 13.4 (Build 22F66)) of 2023-06-18 built on
 Dazzs-MBP
Repository revision: 1b0348d95934a66d9991a7331ab55e1b9a6c1367
Repository branch: master
Windowing system distributor 'Apple', version 10.3.2299
System Description:  macOS 13.4

Configured using:
 'configure 'CFLAGS=-g -O0' --with-native-compilation --with-json
 --with-imagemagick --with-tree-sitter'

Configured features:
ACL DBUS GIF GMP GNUTLS IMAGEMAGICK JPEG JSON LCMS2 LIBXML2 MODULES
NATIVE_COMP NOTIFY KQUEUE NS PDUMPER PNG SQLITE3 THREADS TIFF
TOOLKIT_SCROLL_BARS TREE_SITTER WEBP XIM ZLIB

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Group

Minor modes in effect:
  gnus-topic-mode: t
  gnus-undo-mode: t
  corfu-indexed-mode: t
  global-corfu-mode: t
  savehist-mode: t
  save-place-mode: t
  shell-dirtrack-mode: t
  repeat-mode: t
  recentf-mode: t
  pixel-scroll-precision-mode: t
  minibuffer-depth-indicate-mode: t
  all-the-icons-completion-mode: t
  marginalia-mode: t
  lin-global-mode: t
  lin-mode: t
  hl-line-mode: t
  global-whitespace-cleanup-mode: t
  global-diff-hl-mode: t
  global-auto-revert-mode: t
  display-battery-mode: t
  display-time-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  context-menu-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  buffer-read-only: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
/Users/eshelyaron/.emacs.d/elpa/ef-themes-1.1.1.0.20230616.61458/theme-loaddefs hides /Users/eshelyaron/.emacs.d/elpa/standard-themes-1.2.0.0.20230602.54907/theme-loaddefs
/Users/eshelyaron/.emacs.d/elpa/ef-themes-1.1.1.0.20230616.61458/theme-loaddefs hides /Users/eshelyaron/emacs/nextstep/Emacs.app/Contents/Resources/lisp/theme-loaddefs
/Users/eshelyaron/.emacs.d/elpa/transient-20230602.2121/transient hides /Users/eshelyaron/emacs/nextstep/Emacs.app/Contents/Resources/lisp/transient
/Users/eshelyaron/.emacs.d/elpa/eglot-1.15.0.20230609.11219/eglot hides /Users/eshelyaron/emacs/nextstep/Emacs.app/Contents/Resources/lisp/progmodes/eglot

Features:
(shadow bbdb-message shortdoc help-fns radix-tree emacsbug qp flow-fill
mm-archive sort smiley gnus-cite mail-extr textsec uni-scripts
idna-mapping uni-confusable textsec-check gnus-async gnus-bcklg gnus-ml
disp-table gnus-topic nndraft nnmh utf-7 nnfolder bbdb-gnus bbdb-mua
bbdb-com crm network-stream nsm gnus-agent gnus-srvr gnus-score
score-mode nnvirtual gnus-msg nntp gnus-cache bbdb bbdb-site timezone
all-the-icons-gnus gnus-icalendar org-capture esy-publish htmlize
org-transclusion org-transclusion-font-lock org-transclusion-src-lines
text-clone ox-odt rng-loc rng-uri rng-parse rng-match rng-dt rng-util
rng-pttrn nxml-parse nxml-ns nxml-enc xmltok nxml-util ox-latex
ox-icalendar org-agenda ox-html table ox-ascii ox-publish ox org-element
org-persist org-id org-refile avl-tree generator org org-macro
org-pcomplete org-list org-footnote org-faces org-entities noutline
outline ob-prolog prolog align ob-sql ob-shell ob ob-tangle org-src
ob-ref ob-lob ob-table ob-exp ob-comint ob-emacs-lisp ob-core ob-eval
org-cycle org-table ol org-fold org-fold-core org-keys oc org-loaddefs
find-func org-version org-compat org-macs gnus-art mm-uu mml2015 mm-view
mml-smime smime gnutls dig gnus-sum shr pixel-fill kinsoku url-file svg
dom gnus-group gnus-undo gnus-start gnus-dbus gnus-cloud nnimap nnmail
mail-source utf7 nnoo gnus-spec gnus-int gnus-range message sendmail
yank-media puny dired dired-loaddefs rfc822 mml mml-sec epa derived epg
rfc6068 epg-config mailabbrev mailheader gnus-win mm-decode mm-bodies
mm-encode mail-parse rfc2231 rfc2047 rfc2045 ietf-drums gmm-utils
icalendar diary-lib diary-loaddefs cal-menu calendar cal-loaddefs gnus
nnheader gnus-util mail-utils range mm-util mail-prsvr smerge-mode diff
add-log flymake-cc misearch multi-isearch octave smie corfu-indexed
corfu cc-mode cc-fonts cc-guess cc-menus cc-cmds cc-styles cc-align
cc-engine cc-vars cc-defs orderless consult-xref consult bookmark pp
grep xref pulse color paredit edmacro kmacro vc-hg vc-git vc-bzr vc-src
vc-sccs vc-svn vc-cvs vc-rcs bug-reference display-fill-column-indicator
display-line-numbers checkdoc lisp-mnt flymake-proc flymake project
compile text-property-search thingatpt flyspell ispell
rainbow-delimiters init savehist saveplace tramp-sh tramp tramp-loaddefs
trampver tramp-integration files-x tramp-compat xdg shell pcomplete
comint ansi-osc parse-time iso8601 ls-lisp ansi-color repeat recentf
tree-widget wid-edit pixel-scroll cua-base ring avoid mb-depth
all-the-icons-completion all-the-icons all-the-icons-faces data-material
data-weathericons data-octicons data-fileicons data-faicons
data-alltheicons marginalia compat lin hl-line face-remap
whitespace-cleanup-mode advice whitespace diff-hl log-view pcvs-util
vc-dir ewoc vc vc-dispatcher diff-mode easy-mmode autorevert filenotify
format-spec battery dbus xml time time-date comp comp-cstr warnings
icons rx cl-extra help-mode finder-inf modus-vivendi-theme modus-themes
all-the-icons-completion-autoloads all-the-icons-dired-autoloads
all-the-icons-gnus-autoloads all-the-icons-autoloads auctex-autoloads
tex-site avy-autoloads bbdb-autoloads corfu-autoloads debbugs-autoloads
devdocs-autoloads diff-hl-autoloads eat-autoloads ef-themes-autoloads
eglot-autoloads elfeed-autoloads embark-consult-autoloads
consult-autoloads embark-autoloads emms-autoloads esy-publish-autoloads
firefox-javascript-repl-autoloads gnu-elpa-keyring-update-autoloads
gnuplot-autoloads graphql-mode-autoloads graphviz-dot-mode-autoloads
htmlize-autoloads ialign-autoloads keycast-autoloads
kubernetes-autoloads lin-autoloads magit-autoloads pcase
git-commit-autoloads magit-popup-autoloads magit-section-autoloads
marginalia-autoloads markdown-mode-autoloads mastodon-autoloads
nano-theme-autoloads ob-prolog-autoloads olivetti-autoloads
orderless-autoloads org-transclusion-autoloads package-lint-autoloads
paredit-autoloads pdf-tools-autoloads persist-autoloads
rainbow-delimiters-autoloads rainbow-mode-autoloads request-autoloads
rg-autoloads sicp-autoloads smtpmail-multi-autoloads sqlformat-autoloads
reformatter-autoloads standard-themes-autoloads sweeprolog-autoloads
tablist-autoloads terraform-mode-autoloads hcl-mode-autoloads
transient-autoloads ts-autoloads s-autoloads dash-autoloads
vterm-autoloads vundo-autoloads wgrep-autoloads
whitespace-cleanup-mode-autoloads with-editor-autoloads info
compat-autoloads package browse-url url url-proxy url-privacy url-expand
url-methods url-history url-cookie generate-lisp-file url-domsuf
url-util mailcap url-handlers url-parse auth-source cl-seq eieio
eieio-core cl-macs password-cache json subr-x map byte-opt gv bytecomp
byte-compile url-vars cl-loaddefs cl-lib early-init rmc iso-transl
tooltip cconv eldoc paren electric uniquify ediff-hook vc-hooks
lisp-float-type elisp-mode mwheel term/ns-win ns-win ucs-normalize
mule-util term/common-win tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode lisp-mode prog-mode register
page tab-bar menu-bar rfn-eshadow isearch easymenu timer select
scroll-bar mouse jit-lock font-lock syntax font-core term/tty-colors
frame minibuffer nadvice seq simple cl-generic indonesian philippine
cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese composite emoji-zwj charscript
charprop case-table epa-hook jka-cmpr-hook help abbrev obarray oclosure
cl-preloaded button loaddefs theme-loaddefs faces cus-face macroexp
files window text-properties overlay sha1 md5 base64 format env
code-pages mule custom widget keymap hashtable-print-readable backquote
threads dbusbind kqueue cocoa ns lcms2 multi-tty make-network-process
native-compile emacs)

Memory information:
((conses 16 1049395 205774) (symbols 48 45588 6)
 (strings 32 312938 18514) (string-bytes 1 9816385)
 (vectors 16 135976) (vector-slots 8 2056358 422846)
 (floats 8 2349 1173) (intervals 56 13412 1172) (buffers 984 34))

bug#64147: 30.0.50; Crash when deleting fullscreen frame on macOS

[Eshel Yaron via Bug reports for GNU Emacs, the Swiss army knife of text editors]

Looking deeper into this, I see this issue has already been reported in
Bug#59794.

There's a workaround that avoids this crash on the release branch, but
it was deliberately kept out of the master branch in hope that a better
solution would come up (see https://debbugs.gnu.org/cgi/bugreport.cgi?bug=59794#41).

bug#64147: 30.0.50; Crash when deleting fullscreen frame on macOS

[Daniel Martín via Bug reports for GNU Emacs, the Swiss army knife of text editors]

merge 64147 59794
thanks

Eshel Yaron via "Bug reports for GNU Emacs, the Swiss army knife of text
editors" <bug-gnu-emacs@gnu.org> writes:

> Looking deeper into this, I see this issue has already been reported in
> Bug#59794.
>
> There's a workaround that avoids this crash on the release branch, but
> it was deliberately kept out of the master branch in hope that a better
> solution would come up (see https://debbugs.gnu.org/cgi/bugreport.cgi?bug=59794#41).

In ns_free_frame_resources, the frame's window is closed, but the view
is not removed from the hierarchy, meaning that it could be called by
AppKit.  That is problematic, because the frame's output_data is
nullified just a few lines later.

Does the following patch (on top of master) solve the problem?

diff --git a/src/nsterm.m b/src/nsterm.m
index 3e089cc1ff1..2c0c90e70e1 100644
--- a/src/nsterm.m
+++ b/src/nsterm.m
@@ -1624,7 +1624,7 @@ Hide the window (X11 semantics)
     [f->output_data.ns->miniimage release];
 
   [[view window] close];
-  [view release];
+  [view removeFromSuperview];
 
   xfree (f->output_data.ns);
   f->output_data.ns = NULL;

bug#64147: 30.0.50; Crash when deleting fullscreen frame on macOS

[Eshel Yaron via Bug reports for GNU Emacs, the Swiss army knife of text editors]

Daniel Martín <mardani29@yahoo.es> writes:

> In ns_free_frame_resources, the frame's window is closed, but the view
> is not removed from the hierarchy, meaning that it could be called by
> AppKit.  That is problematic, because the frame's output_data is
> nullified just a few lines later.
>
> Does the following patch (on top of master) solve the problem?
>
> diff --git a/src/nsterm.m b/src/nsterm.m
> index 3e089cc1ff1..2c0c90e70e1 100644
> --- a/src/nsterm.m
> +++ b/src/nsterm.m
> @@ -1624,7 +1624,7 @@ Hide the window (X11 semantics)
>      [f->output_data.ns->miniimage release];
>  
>    [[view window] close];
> -  [view release];
> +  [view removeFromSuperview];
>  
>    xfree (f->output_data.ns);
>    f->output_data.ns = NULL;

Yes, this seems to solve it, thanks!


-- 
Best,

Eshel

bug#64147: 30.0.50; Crash when deleting fullscreen frame on macOS

[Eli Zaretskii]

> Cc: 64147@debbugs.gnu.org
> Date: Mon, 19 Jun 2023 07:15:53 +0300
> From:  Eshel Yaron via "Bug reports for GNU Emacs,
>  the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
> 
> Daniel Martín <mardani29@yahoo.es> writes:
> 
> > In ns_free_frame_resources, the frame's window is closed, but the view
> > is not removed from the hierarchy, meaning that it could be called by
> > AppKit.  That is problematic, because the frame's output_data is
> > nullified just a few lines later.
> >
> > Does the following patch (on top of master) solve the problem?
> >
> > diff --git a/src/nsterm.m b/src/nsterm.m
> > index 3e089cc1ff1..2c0c90e70e1 100644
> > --- a/src/nsterm.m
> > +++ b/src/nsterm.m
> > @@ -1624,7 +1624,7 @@ Hide the window (X11 semantics)
> >      [f->output_data.ns->miniimage release];
> >  
> >    [[view window] close];
> > -  [view release];
> > +  [view removeFromSuperview];
> >  
> >    xfree (f->output_data.ns);
> >    f->output_data.ns = NULL;
> 
> Yes, this seems to solve it, thanks!

Great, so please install it (on the emacs-29 branch, if the problem
happens there as well).

Thanks.

bug#64147: 30.0.50; Crash when deleting fullscreen frame on macOS

[Daniel Martín via Bug reports for GNU Emacs, the Swiss army knife of text editors]

Eli Zaretskii <eliz@gnu.org> writes:
>> Yes, this seems to solve it, thanks!
>
> Great, so please install it (on the emacs-29 branch, if the problem
> happens there as well).
>
> Thanks.

Sorry, I don't have commit access, so I'd need someone to commit it for
me.

The problem shouldn't happen on Emacs 29 because there is a workaround
to prevent the crash.

bug#64147: 30.0.50; Crash when deleting fullscreen frame on macOS

[Eli Zaretskii]

> From: Daniel Martín <mardani29@yahoo.es>
> Cc: Eshel Yaron <me@eshelyaron.com>,  64147@debbugs.gnu.org
> Date: Tue, 20 Jun 2023 14:53:33 +0200
> 
> Eli Zaretskii <eliz@gnu.org> writes:
> >> Yes, this seems to solve it, thanks!
> >
> > Great, so please install it (on the emacs-29 branch, if the problem
> > happens there as well).
> >
> > Thanks.
> 
> Sorry, I don't have commit access, so I'd need someone to commit it for
> me.

Done.

Should this bug now be closed?

bug#64147: 30.0.50; Crash when deleting fullscreen frame on macOS

[Daniel Martín via Bug reports for GNU Emacs, the Swiss army knife of text editors]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Daniel Martín <mardani29@yahoo.es>
>> Cc: Eshel Yaron <me@eshelyaron.com>,  64147@debbugs.gnu.org
>> Date: Tue, 20 Jun 2023 14:53:33 +0200
>> 
>> Eli Zaretskii <eliz@gnu.org> writes:
>> >> Yes, this seems to solve it, thanks!
>> >
>> > Great, so please install it (on the emacs-29 branch, if the problem
>> > happens there as well).
>> >
>> > Thanks.
>> 
>> Sorry, I don't have commit access, so I'd need someone to commit it for
>> me.
>
> Done.
>
> Should this bug now be closed?

Yes, I'm closing it.