bug#31545: xwidget-webkit-execute-script does not protect script against GC

[Paul Eggert <eggert@cs.ucla.edu>]

[-- Attachment #1: Type: text/plain, Size: 253 bytes --]

Thanks for fixing that GC bug with xwidgets. I installed the attached 
minor tweaks to try to improve the fix. Although the 
intptr_t-vs-ptrdiff_t thing is bit of an annoyance, I find it useful to 
distinguish between offsets and pointers-as-integers.


[-- Attachment #2: 0001-Minor-tweaks-to-recent-fix-for-Bug-31545.patch --]
[-- Type: text/x-patch, Size: 2793 bytes --]

From cc3bbd250317d76c7448beb1ecc7f3df6bd48e36 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Tue, 22 May 2018 09:13:20 -0700
Subject: [PATCH] Minor tweaks to recent fix for Bug#31545

* src/xwidget.c (webkit_javascript_finished_cb)
(Fxwidget_webkit_execute_script): Use intptr_t to avoid warnings
in the (unlikely) event that ptrdiff_t and void * differ in width.
(save_script_callback): Simplify by using xlispdstrdup and
larger_vector.
---
 src/xwidget.c | 35 +++++++++++------------------------
 1 file changed, 11 insertions(+), 24 deletions(-)

diff --git a/src/xwidget.c b/src/xwidget.c
index 16243b7789..32022abf34 100644
--- a/src/xwidget.c
+++ b/src/xwidget.c
@@ -370,7 +370,7 @@ webkit_javascript_finished_cb (GObject      *webview,
     GError *error = NULL;
     struct xwidget *xw = g_object_get_data (G_OBJECT (webview),
                                             XG_XWIDGET);
-    ptrdiff_t script_idx = (ptrdiff_t) arg;
+    ptrdiff_t script_idx = (intptr_t) arg;
     Lisp_Object script_callback = AREF (xw->script_callbacks, script_idx);
     ASET (xw->script_callbacks, script_idx, Qnil);
     if (!NILP (script_callback))
@@ -711,33 +711,20 @@ DEFUN ("xwidget-webkit-zoom",
 static ptrdiff_t
 save_script_callback (struct xwidget *xw, Lisp_Object script, Lisp_Object fun)
 {
-  ptrdiff_t script_bytes = STRING_BYTES (XSTRING (script));
-  char *script_data = xmalloc (script_bytes + 1);
-  memcpy (script_data, SSDATA (script), script_bytes + 1);
-
-  ptrdiff_t idx;
   Lisp_Object cbs = xw->script_callbacks;
   if (NILP (cbs))
     xw->script_callbacks = cbs = Fmake_vector (make_number (32), Qnil);
 
   /* Find first free index.  */
-  for (idx = 0; ; idx++)
-    {
-      if (idx >= ASIZE (cbs))
-	{
-	  /* Resize script/callback save vector.  */
-	  Lisp_Object new_cbs = Fmake_vector (make_number (idx + 32), Qnil);
-	  ptrdiff_t n;
-	  for (n = 0; n < idx; n++)
-	    ASET (new_cbs, n, AREF (cbs, n));
-	  xw->script_callbacks = cbs = new_cbs;
-	}
-      if (NILP (AREF (cbs, idx)))
-	{
-	  ASET (cbs, idx, Fcons (make_save_ptr (script_data), fun));
-	  break;
-	}
-    }
+  ptrdiff_t idx;
+  for (idx = 0; !NILP (AREF (cbs, idx)); idx++)
+    if (idx + 1 == ASIZE (cbs))
+      {
+	xw->script_callbacks = cbs = larger_vector (cbs, 1, -1);
+	break;
+      }
+
+  ASET (cbs, idx, Fcons (make_save_ptr (xlispstrdup (script)), fun));
   return idx;
 }
 
@@ -757,7 +744,7 @@ argument procedure FUN.*/)
   script = ENCODE_SYSTEM (script);
 
   /* Protect script and fun during GC.  */
-  ptrdiff_t idx = save_script_callback (xw, script, fun);
+  intptr_t idx = save_script_callback (xw, script, fun);
 
   /* JavaScript execution happens asynchronously.  If an elisp
      callback function is provided we pass it to the C callback
-- 
2.17.0