bug#23875: 25.0.95; Emacs crashes when closing a frame on OSX

[Ivan Cibrario Bertolotti]

Emacs occasionally crashes with a segmentation fault when deleting a
frame on OSX.  The crash occurs with low probability, I am sorry I
cannot provide a detailed recipe to reproduce it at the moment.

Looking at the crash report (at the bottom of this email) it seems to me
that an EmacsImage is being deallocated by autorelease after it has
already been freed, thus causing a NULL pointer dereference.

Might this be another case of omitted bracketing with
block_input()/unblock_input(), like in bug #23462?

I am now running Emacs with NSTRACE_ENABLED.  If you have any better
idea on how to gather more information, please let me know.  I am
willing to help.

Thanks and best regards,
ICB


Process:               Emacs-x86_64-10_9 [3325]
Path:                  /Users/USER/*/Emacs.app/Contents/MacOS/Emacs-x86_64-10_9
Identifier:            org.gnu.Emacs
Version:               Version 25.0.95 (9.0)
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           Emacs-x86_64-10_9 [3325]
User ID:               501

Date/Time:             2016-06-30 18:51:07.043 +0200
OS Version:            Mac OS X 10.11.5 (15F34)
Report Version:        11
Anonymous UUID:        12F2E9FF-07EA-3C6C-2998-78FF89BB8F8C

Sleep/Wake UUID:       C2DE9394-F9B8-453B-9D91-81E1D8F25C28

Time Awake Since Boot: 53000 seconds
Time Since Wake:       1800 seconds

System Integrity Protection: enabled

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGABRT)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000018
Exception Note:        EXC_CORPSE_NOTIFY

VM Regions Near 0x18:
--> 
    __TEXT                 0000000100000000-000000010020d000 [ 2100K] r-x/rwx 
SM=COW  /Users/USER/*/Emacs.app/Contents/MacOS/Emacs-x86_64-10_9

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib              0x00007fff8671a8ea __kill + 10
1   Emacs-x86_64-10_9                   0x00000001000b9b80 
terminate_due_to_signal + 144
2   Emacs-x86_64-10_9                   0x00000001000d6393 emacs_abort + 19
3   Emacs-x86_64-10_9                   0x00000001001a61ac ns_term_shutdown + 
124
4   Emacs-x86_64-10_9                   0x00000001000b9d45 shut_down_emacs + 261
5   Emacs-x86_64-10_9                   0x00000001000b9b45 
terminate_due_to_signal + 85
6   Emacs-x86_64-10_9                   0x00000001000d7cd6 
deliver_fatal_thread_signal + 134
7   Emacs-x86_64-10_9                   0x00000001000d8a26 handle_sigsegv + 150
8   libsystem_platform.dylib            0x00007fff9766452a _sigtramp + 26
9   ???                                 000000000000000000 0 + 0
10  libobjc.A.dylib                     0x00007fff8ff342f4 
objc_object::sidetable_release(bool) + 242
11  com.apple.CoreFoundation            0x00007fff99a58a4d -[__NSArrayM 
dealloc] + 205
12  libobjc.A.dylib                     0x00007fff8ff342f4 
objc_object::sidetable_release(bool) + 242
13  com.apple.AppKit                    0x00007fff967d0437 -[NSImage dealloc] + 
152
14  Emacs-x86_64-10_9                   0x00000001001c114e -[EmacsImage 
dealloc] + 94
15  libobjc.A.dylib                     0x00007fff8ff342f4 
objc_object::sidetable_release(bool) + 242
16  libobjc.A.dylib                     0x00007fff8ff32ac4 (anonymous 
namespace)::AutoreleasePoolPage::pop(void*) + 476
17  com.apple.CoreFoundation            0x00007fff99a72c12 
_CFAutoreleasePoolPop + 50
18  com.apple.Foundation                0x00007fff93c6e9ea -[NSAutoreleasePool 
drain] + 153
19  com.apple.AppKit                    0x00007fff967d9e53 -[NSApplication run] 
+ 893
20  Emacs-x86_64-10_9                   0x00000001001a6348 -[EmacsApp run] + 344
21  Emacs-x86_64-10_9                   0x00000001001b1916 ns_read_socket + 710
22  Emacs-x86_64-10_9                   0x00000001000c0600 gobble_input + 336
23  Emacs-x86_64-10_9                   0x00000001000c1412 read_char + 1986
24  Emacs-x86_64-10_9                   0x00000001000bed1c read_key_sequence + 
2092
25  Emacs-x86_64-10_9                   0x00000001000bd432 command_loop_1 + 1154
26  Emacs-x86_64-10_9                   0x0000000100138a36 
internal_condition_case + 70
27  Emacs-x86_64-10_9                   0x00000001000ce050 command_loop_2 + 48
28  Emacs-x86_64-10_9                   0x0000000100138596 internal_catch + 54
29  Emacs-x86_64-10_9                   0x00000001000bc67e command_loop + 158
30  Emacs-x86_64-10_9                   0x00000001000bc595 recursive_edit_1 + 
117
31  Emacs-x86_64-10_9                   0x00000001000bc7bc Frecursive_edit + 220
32  Emacs-x86_64-10_9                   0x00000001000bb48e main + 5854
33  libdyld.dylib                       0x00007fff8635c5ad start + 1

In GNU Emacs 25.0.95.1 (x86_64-apple-darwin13.4.0, NS appkit-1265.21 Version 
10.9.5 (Build 13F1603))
of 2016-06-11 built on builder10-9.local
Windowing system distributor 'Apple', version 10.3.1404
Configured using:
'configure --with-ns '--enable-locallisppath=/Library/Application
Support/Emacs/${version}/site-lisp:/Library/Application
Support/Emacs/site-lisp''

Configured features:
NOTIFY ACL LIBXML2 ZLIB TOOLKIT_SCROLL_BARS NS

Important settings:
  value of $LANG: en_GB.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  show-paren-mode: t
  recentf-mode: t
  global-whitespace-mode: t
  display-time-mode: t
  display-battery-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent messages:
Loading whitespace...done
Loading recentf...done
Loading paren...done
Loading type-break...done
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list...

Load-path shadows:
None found.

Features:
(shadow sort flyspell ispell mail-extr emacsbug message dired
format-spec rfc822 mml mml-sec password-cache epg gnus-util mm-decode
mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader
sendmail rfc2047 rfc2045 ietf-drums mm-util help-fns mail-prsvr
mail-utils server printing ps-print ps-def lpr type-break paren recentf
tree-widget wid-edit whitespace time battery cus-start cus-load
exec-path-from-shell finder-inf info tex-site package epg-config seq
byte-opt gv bytecomp byte-compile cl-extra help-mode easymenu cconv
cl-loaddefs pcase cl-lib time-date mule-util tooltip eldoc electric
uniquify ediff-hook vc-hooks lisp-float-type mwheel ns-win ucs-normalize
term/common-win tool-bar dnd fontset image regexp-opt fringe
tabulated-list newcomment elisp-mode lisp-mode prog-mode register page
menu-bar rfn-eshadow timer select scroll-bar mouse jit-lock font-lock
syntax facemenu font-core frame cl-generic cham georgian utf-8-lang
misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms
cp51932 hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese charscript case-table epa-hook jka-cmpr-hook help
simple abbrev minibuffer cl-preloaded nadvice loaddefs button faces
cus-face macroexp files text-properties overlay sha1 md5 base64 format
env code-pages mule custom widget hashtable-print-readable backquote
kqueue cocoa ns multi-tty make-network-process emacs)

Memory information:
((conses 16 245035 7260)
(symbols 48 24308 0)
(miscs 40 59 278)
(strings 32 30488 6991)
(string-bytes 1 933458)
(vectors 16 38029)
(vector-slots 8 700699 3288)
(floats 8 454 200)
(intervals 56 256 0)
(buffers 976 12))