From: Eli Zaretskii <eliz@gnu.org>
Date: Wed, 14 Jan 2015 18:51:33 +0000 (+0200)
Subject: Fix crashes on MS-Windows due to pop-up menus  (Bug#19596)
X-Git-Tag: emacs-25.0.90~2603^2~3
X-Git-Url: http://git.eshelyaron.com/gitweb/?a=commitdiff_plain;h=e7db8e8d5de70be5e047c961cdfbf692d52e33c6;p=emacs.git

Fix crashes on MS-Windows due to pop-up menus  (Bug#19596)

 src/w32fns.c (w32_wnd_proc): Ignore MENUITEMINFO's dwItemData data
 when FLAGS indicate the item is not highlighted, i.e. it's not our
 help-echo string.
---

diff --git a/src/ChangeLog b/src/ChangeLog
index be2e89fedbf..b2588f1451f 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,8 @@
+2015-01-14  Eli Zaretskii  <eliz@gnu.org>
+
+	* w32fns.c (w32_wnd_proc): Ignore MENUITEMINFO's dwItemData data
+	when FLAGS indicate the item is not highlighted.  (Bug#19596)
+
 2015-01-14  Martin Rudalics  <rudalics@gmx.at>
 
 	* xmenu.c (update_frame_menubar): Remove garbaged code.
diff --git a/src/w32menu.c b/src/w32menu.c
index 2742276d3f6..2a1dafbd6d7 100644
--- a/src/w32menu.c
+++ b/src/w32menu.c
@@ -1476,11 +1476,24 @@ w32_menu_display_help (HWND owner, HMENU menu, UINT item, UINT flags)
       struct frame *f = x_window_to_frame (&one_w32_display_info, owner);
       Lisp_Object frame, help;
 
-      /* No help echo on owner-draw menu items, or when the keyboard is used
-	 to navigate the menus, since tooltips are distracting if they pop
-	 up elsewhere.  */
-      if (flags & MF_OWNERDRAW || flags & MF_POPUP
-	  || !(flags & MF_MOUSESELECT))
+      /* No help echo on owner-draw menu items, or when the keyboard
+	 is used to navigate the menus, since tooltips are distracting
+	 if they pop up elsewhere.  */
+      if ((flags & MF_OWNERDRAW) || (flags & MF_POPUP)
+	  || !(flags & MF_MOUSESELECT)
+	  /* Ignore any dwItemData for menu items whose flags don't
+	     have the MF_HILITE bit set.  These are dwItemData that
+	     Windows sends our way, but they aren't pointers to our
+	     Lisp_String objects, so trying to create Lisp_Strings out
+	     of them below and pass that to the keyboard queue will
+	     crash Emacs when we try to display those "strings".  It
+	     is unclear why we get these dwItemData, or what they are:
+	     sometimes they point to a wchar_t string that is the menu
+	     title, sometimes to someting that doesn't look like text
+	     at all.  (The problematic data also comes with the 0x0800
+	     bit set, but this bit is not documented, so we don't want
+	     to depend on it.)  */
+	  || !(flags & MF_HILITE))
 	help = Qnil;
       else
 	{