bug#35784: emacs 26 crash

[Eli Zaretskii <eliz@gnu.org>]

On May 19, 2019 5:54:59 AM GMT+03:00, Noam Postavsky <npostavs@gmail.com> wrote:
> >>> #2  0x000000000061849e in die (msg=0x743f3f "BUFFERP (a)",
> >>> file=0x743f36 "buffer.h", line=914) at alloc.c:7406
> >>> #3  0x00000000005802b3 in XBUFFER (a=0) at buffer.h:914
> >>> #4  0x0000000000468bb3 in mark_window_display_accurate_1
> (w=0x558e410,
> >>> accurate_p=false) at xdisp.c:14754
> >>>          b = 0x7ffe74b60e40
> >>> #5  0x0000000000468ffd in mark_window_display_accurate
> >>> (window=89711637, accurate_p=false) at xdisp.c:14811
> >>>          w = 0x558e410
> >>> #6  0x00000000004bbe06 in Fforce_window_update (object=89711637)
> at
> >>> window.c:3643
> >>>          w = 0x558e410
> >>
> >> This seems to imply that we are trying to update a non-leaf window,
> >> something that should never happen.  There's no Lisp-level
> backtrace,
> >> so it's hard to tell what Lisp called force-window-update, and how
> the
> >> window in question became non-leaf, but maybe some crazy Lisp hook
> >> switched windows behind redisplay's back or something.
> >
> > I'd rather guess that this is the result of 'kill-buffer' called
> from
> > 'delete-frame-functions' or 'delete-frame' called from
> > 'kill-buffer-hook'.  But at the moment I can't reproduce the bug
> here
> > any more.
> 
> The Lisp backtrace is:
> 
> "force-window-update" (0xffffd640)
> 0x2f61c80 Lisp type 3
> "mapc" (0xffffd960)
> "k-tabbar2::pc-handle-queued-updates" (0xffffdb00)
> "k-tabbar2::post-command-fn" (0xffffddf0)
> 
> I think the problem is just that the Lisp code is calling
> force-window-update on a deleted window.  At least, I can trigger the
> crash with
> 
>     (let ((w (split-window)))
>       (delete-window w)
>       (force-window-update w))
> 
> And the following fixes it:
> 
> --- i/src/window.c
> +++ w/src/window.c
> @@ -4089,7 +4089,7 @@ displaying that buffer.  */)
>        return Qt;
>      }
>  
> -  if (WINDOWP (object))
> +  if (WINDOW_LIVE_P (object))
>      {
>        struct window *w = XWINDOW (object);
>        mark_window_display_accurate (object, false);

Thanks, this fix is fine with me.  Martin?