bug#31373: 26.1; frame-list-z-order segfaults on initial daemon frame

[Noam Postavsky <npostavs@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1142 bytes --]

tags 31373 + patch
quit

"Basil L. Contovounesios" <contovob@tcd.ie> writes:

> On the latest emacs-26 and master branches, calling the function
> frame-list-z-order crashes a daemon Emacs via segfault:
>
> 1. ./src/emacs -Q --daemon=<name>
> 2. ./lib-src/emacsclient --socket-name=<name> --create-frame
> 3. cd src
> 4. gdb -p <PID of step (1)>
> 5. Issue 'continue' in gdb

You can also use

1. gdb ./emacs -Q --fg-daemon=<name>
2. Issue 'run' in gdb
3. ../lib-src/emacsclient --socket-name=<name> --create-frame

> 6. Evaluating (frame-list-z-order) in the emacsclient frame gives the
>    following output in gdb:
>
> Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
> 0x0000000000565112 in x_frame_list_z_order (dpy=0x33018f0, window=227) at xfns.c:5306
> 5306		    if (XFRAME (frame)->output_data.x->parent_desc == children[i]

> A quick step-through of x_frame_list_z_order indicates that the members
> of the struct XFRAME (frame)->output_data are initialised to NULL for
> the initial daemon frame F1.

Right, I think we need to check the frame's output_method field first.
I wonder if there are other cases like this?


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: patch --]
[-- Type: text/x-diff, Size: 1152 bytes --]

From b2c13a02a88fc8cc00c61ef8f56719fbb9b02897 Mon Sep 17 00:00:00 2001
From: Noam Postavsky <npostavs@gmail.com>
Date: Sun, 6 May 2018 10:07:25 -0400
Subject: [PATCH] Don't check non-X frames for z order (Bug#31373)

* src/xfns.c (x_frame_list_z_order): Only use frames with
`output_method' set to `output_x_window'.
---
 src/xfns.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/xfns.c b/src/xfns.c
index 20fe61bffd..29dd529e27 100644
--- a/src/xfns.c
+++ b/src/xfns.c
@@ -5303,8 +5303,9 @@ x_frame_list_z_order (Display* dpy, Window window)
 	    /* With a reparenting window manager the parent_desc field
 	       usually specifies the topmost windows of our frames.
 	       Otherwise FRAME_OUTER_WINDOW should do.  */
-	    if (XFRAME (frame)->output_data.x->parent_desc == children[i]
-		|| FRAME_OUTER_WINDOW (XFRAME (frame)) == children[i])
+	    if (XFRAME (frame)->output_method == output_x_window
+                && (XFRAME (frame)->output_data.x->parent_desc == children[i]
+                    || FRAME_OUTER_WINDOW (XFRAME (frame)) == children[i]))
 	      frames = Fcons (frame, frames);
 	}
 
-- 
2.11.0