Fix bug #17524 with crashes in creating a new frame with invalid font.

 src/w32fns.c (unwind_create_frame) [GLYPH_DEBUG]: If we are
 unwinding when frame's faces were not initialized yet, increment
 the frame's image-cache reference count before calling
 x_free_frame_resources.  Don't dereference
 dpyinfo->terminal->image_cache if it is NULL.

diff --git a/src/ChangeLog b/src/ChangeLog
index 2283677a44896edcbbdcc03cb636a21f4645290f..cb54bbd0e703ae03852390e171993d56d6d3753d 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,11 @@
+2014-05-20  Eli Zaretskii  <eliz@gnu.org>
+
+       * w32fns.c (unwind_create_frame) [GLYPH_DEBUG]: If we are
+       unwinding when frame's faces were not initialized yet, increment
+       the frame's image-cache reference count before calling
+       x_free_frame_resources.  Don't dereference
+       dpyinfo->terminal->image_cache if it is NULL.  (Bug#17524)
+
 2014-05-11  Glenn Morris  <rgm@gnu.org>
 
        * fileio.c (Ffile_executable_p): Doc tweak.

diff --git a/src/w32fns.c b/src/w32fns.c
index 630059c38f10faef877bff9e24674e4343f3f83c..638c617df997a6c78c90cf0b9b61ec53e6ce2399 100644 (file)
--- a/src/w32fns.c
+++ b/src/w32fns.c
@@ -4245,6 +4245,17 @@ unwind_create_frame (Lisp_Object frame)
     {
 #ifdef GLYPH_DEBUG
       struct w32_display_info *dpyinfo = FRAME_DISPLAY_INFO (f);
+
+      /* If the frame's image cache refcount is still the same as our
+        private shadow variable, it means we are unwinding a frame
+        for which we didn't yet call init_frame_faces, where the
+        refcount is incremented.  Therefore, we increment it here, so
+        that free_frame_faces, called in x_free_frame_resources
+        below, will not mistakenly decrement the counter that was not
+        incremented yet to account for this new frame.  */
+      if (FRAME_IMAGE_CACHE (f) != NULL
+         && FRAME_IMAGE_CACHE (f)->refcount == image_cache_refcount)
+       FRAME_IMAGE_CACHE (f)->refcount++;
 #endif
 
       x_free_frame_resources (f);
@@ -4255,7 +4266,8 @@ unwind_create_frame (Lisp_Object frame)
       eassert (dpyinfo->reference_count == dpyinfo_refcount);
       eassert ((dpyinfo->terminal->image_cache == NULL
                && image_cache_refcount == 0)
-              || dpyinfo->terminal->image_cache->refcount == image_cache_refcount);
+              || (dpyinfo->terminal->image_cache != NULL
+                  && dpyinfo->terminal->image_cache->refcount == image_cache_refcount));
 #endif
       return Qt;
     }