Re: master 47b377f64b: Prevent non-local exits from ns-in-echo-area

[Po Lu]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

> Hmm... this still looks like an ugly hack, and still without any
> comments explaining why we're doing it.
>
> E.g. why do we need `safe_call` in addition to `internal_catch_all`?
> If we're using `safe_call`, why not use that code's handling of
> `inhibit_quit` and write our own around it instead?

safe_call binds inhibit-redisplay to t.

> AFAICT we don't *really* know why we need `internal_catch_all` or
> `inhibit-quit` and even less if/why we need both.

We need both because throw-on-input can otherwise cause the code inside
to throw, and as Gerd found out earlier it is not safe to call redisplay
inside an NS input callback.  Besides, it's Lisp, so a user could
plausibly shoot himself in the foot by advising that function.

I would rather write the entirety in C (see the calls to
xic_set_preeditarea in xterm.c), but I have no idea how input methods
work on NS.

> And we don't know what we *should* do if this code signals a weird
> error or `throw`s, really (currently, we just silently drop the
> error/throw, but maybe we should arrange for it to be "recreated"
> elsewhere).

I don't know either, but it's better than having Lisp longjmp out of the
NS code.

> I'm not in a position to dig any further, and it looks like noone here
> is either, but *please* add a comment explaining as much as you can
> about what we know now, so as to help the future guy who wants to try
> and figure it out (or so as to avoid re-introducing the problem when
> someone stumbles upon this weird code full of redundant protections and
> figures it can be simplified).

Okay.  How about:

  Use safe_call so redisplay is inhibited, and internal_catch_all so
  that the likes of `throw-on-input' or user advice can not cause a
  non-local exit out of the Lisp function being called, both of which
  are unsafe inside NS input callbacks.