bug#16127: 24.3.50; emacs crashes with macfont_free_entity

[Dmitry Antipov <dmantipov@yandex.ru>]

[-- Attachment #1: Type: text/plain, Size: 936 bytes --]

On 12/13/2013 06:46 AM, Darren Hoo wrote:

> Process 17619 launched: '/Volumes/disk/emacs/src/emacs' (x86_64)
> Process 17619 stopped
> * thread #1: tid = 0x1f0644, 0x00000001001ac8cb emacs`macfont_free_entity [inlined] XCDR(c=9053142519906304, obj=9053142519906304, n=0) + 4 at lisp.h:2007, queue = 'com.apple.main-thread, stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
>      frame #0: 0x00000001001ac8cb emacs`macfont_free_entity [inlined] XCDR(c=9053142519906304, obj=9053142519906304, n=0) + 4 at lisp.h:2007
>     2004	XSAVE_POINTER (Lisp_Object obj, int n)
>     2005	{
>     2006	  eassert (save_type (XSAVE_VALUE (obj), n) == SAVE_POINTER);
> -> 2007	  return XSAVE_VALUE (obj)->data[n].pointer;
>     2008	}
>     2009	INLINE void
>     2010	set_save_pointer (Lisp_Object obj, int n, void *val)

Hm...double call to macfont_free_entity for the same entity?

Can you compile with --enable-checking and this patch?

Dmitry


[-- Attachment #2: test_bug16127.patch --]
[-- Type: text/x-patch, Size: 575 bytes --]

=== modified file 'src/macfont.m'
--- src/macfont.m	2013-12-12 14:26:06 +0000
+++ src/macfont.m	2013-12-13 06:37:01 +0000
@@ -2435,11 +2435,14 @@
 {
   Lisp_Object val = assq_no_quit (QCfont_entity,
 				  AREF (entity, FONT_EXTRA_INDEX));
-  CFStringRef name = XSAVE_POINTER (XCDR (val), 0);
+  if (CONSP (val) && SAVE_VALUE_P (XCDR (val)))
+    {
+      CFStringRef name = XSAVE_POINTER (XCDR (val), 0);
 
-  block_input ();
-  CFRelease (name);
-  unblock_input ();
+      block_input ();
+      CFRelease (name);
+      unblock_input ();
+    }
 }
 
 static Lisp_Object