Fix crashes on MS-Windows due to pop-up menus (Bug#19596)

 src/w32fns.c (w32_wnd_proc): Ignore MENUITEMINFO's dwItemData data
 when FLAGS indicate the item is not highlighted, i.e. it's not our
 help-echo string.

diff --git a/src/ChangeLog b/src/ChangeLog
index be2e89fedbfca11ad9e569b304bbcbaa86e89866..b2588f1451fd7c1de672f5889cdbc0d278a66563 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2015-01-14  Eli Zaretskii  <eliz@gnu.org>
+
+       * w32fns.c (w32_wnd_proc): Ignore MENUITEMINFO's dwItemData data
+       when FLAGS indicate the item is not highlighted.  (Bug#19596)
+
 2015-01-14  Martin Rudalics  <rudalics@gmx.at>
 
        * xmenu.c (update_frame_menubar): Remove garbaged code.

diff --git a/src/w32menu.c b/src/w32menu.c
index 2742276d3f6b12fe4eb8d051905e125bbc69bb06..2a1dafbd6d7d740183280bd8938442956be4caf6 100644 (file)
--- a/src/w32menu.c
+++ b/src/w32menu.c
@@ -1476,11 +1476,24 @@ w32_menu_display_help (HWND owner, HMENU menu, UINT item, UINT flags)
       struct frame *f = x_window_to_frame (&one_w32_display_info, owner);
       Lisp_Object frame, help;
 
-      /* No help echo on owner-draw menu items, or when the keyboard is used
-        to navigate the menus, since tooltips are distracting if they pop
-        up elsewhere.  */
-      if (flags & MF_OWNERDRAW || flags & MF_POPUP
-         || !(flags & MF_MOUSESELECT))
+      /* No help echo on owner-draw menu items, or when the keyboard
+        is used to navigate the menus, since tooltips are distracting
+        if they pop up elsewhere.  */
+      if ((flags & MF_OWNERDRAW) || (flags & MF_POPUP)
+         || !(flags & MF_MOUSESELECT)
+         /* Ignore any dwItemData for menu items whose flags don't
+            have the MF_HILITE bit set.  These are dwItemData that
+            Windows sends our way, but they aren't pointers to our
+            Lisp_String objects, so trying to create Lisp_Strings out
+            of them below and pass that to the keyboard queue will
+            crash Emacs when we try to display those "strings".  It
+            is unclear why we get these dwItemData, or what they are:
+            sometimes they point to a wchar_t string that is the menu
+            title, sometimes to someting that doesn't look like text
+            at all.  (The problematic data also comes with the 0x0800
+            bit set, but this bit is not documented, so we don't want
+            to depend on it.)  */
+         || !(flags & MF_HILITE))
        help = Qnil;
       else
        {