bug#6284: Crash in w32_wnd_proc at frame deletion

[Lennart Borgman <lennart.borgman@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 344 bytes --]

On Thu, May 27, 2010 at 8:34 PM, Lennart Borgman
<lennart.borgman@gmail.com> wrote:
>
> There is a
> bug in w32fns.c where this happened. There should be a check if f is
> 0.
>
> There seems to be more places where this is not checked. I will look
> through them and add a patch here.

I have attached a patch. Please review it and install it.

[-- Attachment #2: bug6284-1.diff --]
[-- Type: text/x-patch, Size: 3617 bytes --]


C:\emacs-lp\bld\emacs\bug6284>bzr diff --old c:\emacs-lp\bld\emacs\trunk -p trunk/:bug6284/ 
=== modified file 'src/w32fns.c'
--- trunk/src/w32fns.c	2010-05-11 21:02:32 +0000
+++ bug6284/src/w32fns.c	2010-05-27 19:59:34 +0000
@@ -3195,6 +3195,9 @@
 	    break;
 
 	  f = x_window_to_frame (dpyinfo, hwnd);
+          if (!f)
+            break;
+
 	  w = XWINDOW (FRAME_SELECTED_WINDOW (f));
 
 	  form.dwStyle = CFS_RECT;
@@ -3349,8 +3352,10 @@
 
 	/* Ignore middle and extra buttons as long as the menu is active.  */
 	f = x_window_to_frame (dpyinfo, hwnd);
-	if (f && f->output_data.w32->menubar_active)
-	  return 0;
+        if (!f)
+          return 0;
+	if (f->output_data.w32->menubar_active)
+          return 0;
 
 	if (parse_button (msg, HIWORD (wParam), &button, &up))
 	  {
@@ -3379,7 +3384,9 @@
 	 it's wrong to handle them as if they happened on the
 	 underlying frame.  */
       f = x_window_to_frame (dpyinfo, hwnd);
-      if (f && f->output_data.w32->menubar_active)
+      if (!f)
+        return 0;
+      if (f->output_data.w32->menubar_active)
 	return 0;
 
       /* If the mouse has just moved into the frame, start tracking
@@ -3475,6 +3482,8 @@
 	  KillTimer (hwnd, menu_free_timer);
 	  menu_free_timer = 0;
 	  f = x_window_to_frame (dpyinfo, hwnd);
+          if (!f)
+            return 0;
           /* If a popup menu is active, don't wipe its strings.  */
 	  if (menubar_in_use
               && current_popup_menu == NULL)
@@ -3489,7 +3498,10 @@
 	{
 	  KillTimer (hwnd, hourglass_timer);
 	  hourglass_timer = 0;
-	  w32_show_hourglass (x_window_to_frame (dpyinfo, hwnd));
+	  f = x_window_to_frame (dpyinfo, hwnd);
+          if (!f)
+            return 0;
+	  w32_show_hourglass (f);
 	}
       return 0;
 
@@ -3522,14 +3534,15 @@
 	 being active).  */
 
       f = x_window_to_frame (dpyinfo, hwnd);
-      if (f
-	  && (f->output_data.w32->menubar_active
-	      /* We can receive this message even in the absence of a
-		 menubar (ie. when the system menu is activated) - in this
-		 case we do NOT want to forward the message, otherwise it
-		 will cause the menubar to suddenly appear when the user
-		 had requested it to be turned off!  */
-	      || f->output_data.w32->menubar_widget == NULL))
+      if (!f)
+        return 0;
+      if (f->output_data.w32->menubar_active
+          /* We can receive this message even in the absence of a
+             menubar (ie. when the system menu is activated) - in this
+             case we do NOT want to forward the message, otherwise it
+             will cause the menubar to suddenly appear when the user
+             had requested it to be turned off!  */
+          || f->output_data.w32->menubar_widget == NULL)
 	return 0;
 
       {

=== modified file 'src/w32term.c'
--- trunk/src/w32term.c	2010-04-10 16:28:30 +0000
+++ bug6284/src/w32term.c	2010-05-27 20:06:13 +0000
@@ -4375,7 +4375,7 @@
 	 But it was originally changed to this to fix a bug, so I have
 	 not removed it completely in case the bug is still there.  */
           if (help_echo_string != previous_help_echo_string ||
-	      (!NILP (help_echo_string) && !STRINGP (help_echo_string) && f->mouse_moved))
+	      (!NILP (help_echo_string) && !STRINGP (help_echo_string) && f && f->mouse_moved))
 #else /* This is what xterm.c does.  */
 	    if (!NILP (help_echo_string)
 		|| !NILP (previous_help_echo_string))
@@ -4554,7 +4554,8 @@
 	  else
 	    {
 	      f = x_window_to_frame (dpyinfo, msg.msg.hwnd);
-	      f->async_visible = msg.msg.wParam;
+              if (f)
+                f->async_visible = msg.msg.wParam;
 	    }
 #endif