bug#56095: 29.0.50; nsterm.m, use after free

["Gerd Möllmann" <gerd.moellmann@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 734 bytes --]

On 20. Jun 2022, 12:21 +0200, Po Lu <luangruo@yahoo.com>, wrote:
> But it seems there is no struct scroll_bar at all in the NS port! (Why
> does it always have to do things differently?)
Think Different (tm) :-).
> Does anyone want me to
> fix that?
I have no opinion on that.
>
> In the meantime, a loop through all the scroll bars in a mark_nsterm
> function would suffice.
Please find a patch for that attached.

As an aside, if anyone has heard anything about building GDB on an M1 Mac, I'd be grateful for a pointer. I'm asking because I'm currently stuck with lldb on my machine.  GDB doesn't seem to build - it doesn't produce an executable, but apparently, if I'm not blind, without saying what the problem is.

[-- Attachment #1.2: Type: text/html, Size: 1483 bytes --]

[-- Attachment #2: 0001-Prevent-GC-of-window-referenced-from-EmacsScroller.patch --]
[-- Type: application/octet-stream, Size: 2486 bytes --]

From 8842a994fabf65197fa48beed8bd88066f1655e2 Mon Sep 17 00:00:00 2001
From: Gerd Moellmann <gerd.moellmann@gmail.com>
Date: Tue, 21 Jun 2022 15:49:44 +0200
Subject: [PATCH] Prevent GC of window referenced from EmacsScroller

* src/nsterm.m (EmacsScroller.mark, mark_nsterm): New functions.
* src/nsterm.h (EmacsScroller.mark, mark_nsterm): Declare.
* src/alloc.c (garbage_collect) [MAVE_NS]: Call mark_nsterm.
---
 src/alloc.c  |  4 ++++
 src/nsterm.h |  4 ++++
 src/nsterm.m | 30 ++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/src/alloc.c b/src/alloc.c
index 55e18ecd77..f115a3ceba 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -6204,6 +6204,10 @@ garbage_collect (void)
   mark_xterm ();
 #endif
 
+#ifdef HAVE_NS
+  mark_nsterm ();
+#endif
+
   /* Everything is now marked, except for the data in font caches,
      undo lists, and finalizers.  The first two are compacted by
      removing an items which aren't reachable otherwise.  */
diff --git a/src/nsterm.h b/src/nsterm.h
index c4fdc7054f..7a097b3248 100644
--- a/src/nsterm.h
+++ b/src/nsterm.h
@@ -724,6 +724,7 @@ #define NSTRACE_UNSILENCE()
    int em_whole;
    }
 
+- (void) mark;
 - (instancetype) initFrame: (NSRect )r window: (Lisp_Object)win;
 - (void)setFrame: (NSRect)r;
 
@@ -1373,4 +1374,7 @@ #define NSControlStateValueOff NSOffState
 #define NSBezelStyleRounded NSRoundedBezelStyle
 #define NSButtonTypeMomentaryPushIn NSMomentaryPushInButton
 #endif
+
+extern void mark_nsterm (void);
+
 #endif	/* HAVE_NS */
diff --git a/src/nsterm.m b/src/nsterm.m
index 514b790b15..ad50630763 100644
--- a/src/nsterm.m
+++ b/src/nsterm.m
@@ -9909,6 +9909,16 @@ -(bool)judge
   return ret;
 }
 
+- (void) mark
+{
+  if (window)
+    {
+      Lisp_Object win;
+      XSETWINDOW (win, window);
+      mark_object (win);
+    }
+}
+
 
 - (void)resetCursorRects
 {
@@ -10650,6 +10660,26 @@ Convert an X font name (XLFD) to an NS font name.
   return ret;
 }
 
+void
+mark_nsterm (void)
+{
+  NSTRACE ("mark_nsterm");
+  Lisp_Object tail, frame;
+  FOR_EACH_FRAME (tail, frame)
+    {
+      struct frame *f = XFRAME (frame);
+      if (FRAME_NS_P (f))
+	{
+	  NSArray *subviews = [[FRAME_NS_VIEW (f) superview] subviews];
+	  for (int i = [subviews count] - 1; i >= 0; --i)
+	    {
+	      id scroller = [subviews objectAtIndex: i];
+	      if ([scroller isKindOfClass: [EmacsScroller class]])
+                  [scroller mark];
+	    }
+	}
+    }
+}
 
 void
 syms_of_nsterm (void)
-- 
2.36.1