Fix bug #14970 with crashes when deleting many frames on MS-Windows.

 src/w32fns.c (w32_wnd_proc) <WM_IME_STARTCOMPOSITION>: Make sure the
 frame which got the message is still alive, before dereferencing
 its pointer.
 src/frame.c (delete_frame): Test "this" frame's minibuffer window to
 be a live window, before using it as such.

diff --git a/src/ChangeLog b/src/ChangeLog
index 95fdd2da94e3a6807b64cb2fa219f0f28f5672f9..c5448fd1514fe2e04e26966a582513a22ff9f989 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,12 @@
+2013-07-28  Eli Zaretskii  <eliz@gnu.org>
+
+       * w32fns.c (w32_wnd_proc) <WM_IME_STARTCOMPOSITION>: Make sure the
+       frame which got the message is still alive, before dereferencing
+       its pointer.  (Bug#14970)
+
+       * frame.c (delete_frame): Test "this" frame's minibuffer window to
+       be a live window, before using it as such.  (Bug#14970)
+
 2013-07-27  Eli Zaretskii  <eliz@gnu.org>
 
        * w32term.c (w32_read_socket) <WM_KILLFOCUS>: Call

diff --git a/src/frame.c b/src/frame.c
index 5fa54052cd2ba1b1ea4939d543070d256d75e00e..0b59b43a445f2b34e53c1b6d3f9338cf1b0c2b66 100644 (file)
--- a/src/frame.c
+++ b/src/frame.c
@@ -1157,10 +1157,13 @@ delete_frame (Lisp_Object frame, Lisp_Object force)
 
       FOR_EACH_FRAME (frames, this)
        {
+         Lisp_Object fminiw;
+         struct frame *this_f;
+
          if (! EQ (this, frame)
-             && EQ (frame,
-                    WINDOW_FRAME (XWINDOW
-                                  (FRAME_MINIBUF_WINDOW (XFRAME (this))))))
+             && (this_f = XFRAME (this))
+             && WINDOWP (fminiw = FRAME_MINIBUF_WINDOW (this_f))
+             && EQ (frame, WINDOW_FRAME (XWINDOW (fminiw))))
            {
              /* If we MUST delete this frame, delete the other first.
                 But do this only if FORCE equals `noelisp'.  */

diff --git a/src/w32fns.c b/src/w32fns.c
index 675b716f3b06e0adde96b1b43ab18d1110f0f9a4..2b06936d119f03e4f43175fc5114ab9a35dad8eb 100644 (file)
--- a/src/w32fns.c
+++ b/src/w32fns.c
@@ -3213,6 +3213,8 @@ w32_wnd_proc (HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
             described by W was deleted, as indicated by its buffer
             field being reset to nil.  */
          f = x_window_to_frame (dpyinfo, hwnd);
+         if (!(f && FRAME_LIVE_P (f)))
+           break;
          w = XWINDOW (FRAME_SELECTED_WINDOW (f));
          /* Punt if someone changed the frame's selected window
             behind our back. */