Fix bug #14970 with crashes when deleting many frames on MS-Windows.

 src/w32fns.c (w32_wnd_proc) <WM_IME_STARTCOMPOSITION>: Make sure the
 frame which got the message is still alive, before dereferencing
 its pointer.
 src/frame.c (delete_frame): Test "this" frame's minibuffer window to
 be a live window, before using it as such.

3 files changed, 17 insertions, 3 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 95fdd2da94e..c5448fd1514 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,12 @@
+2013-07-28  Eli Zaretskii  <eliz@gnu.org>
+
+        * w32fns.c (w32_wnd_proc) <WM_IME_STARTCOMPOSITION>: Make sure the
+        frame which got the message is still alive, before dereferencing
+        its pointer.  (Bug#14970)
+
+        * frame.c (delete_frame): Test "this" frame's minibuffer window to
+        be a live window, before using it as such.  (Bug#14970)
+
 2013-07-27  Eli Zaretskii  <eliz@gnu.org>
 
         * w32term.c (w32_read_socket) <WM_KILLFOCUS>: Call
diff --git a/src/frame.c b/src/frame.c
index 5fa54052cd2..0b59b43a445 100644
--- a/src/frame.c
+++ b/src/frame.c
@@ -1157,10 +1157,13 @@ delete_frame (Lisp_Object frame, Lisp_Object force)
 
       FOR_EACH_FRAME (frames, this)
         {
+          Lisp_Object fminiw;
+          struct frame *this_f;
+
           if (! EQ (this, frame)
-              && EQ (frame,
-                     WINDOW_FRAME (XWINDOW
-                                   (FRAME_MINIBUF_WINDOW (XFRAME (this))))))
+              && (this_f = XFRAME (this))
+              && WINDOWP (fminiw = FRAME_MINIBUF_WINDOW (this_f))
+              && EQ (frame, WINDOW_FRAME (XWINDOW (fminiw))))
             {
               /* If we MUST delete this frame, delete the other first.
                  But do this only if FORCE equals `noelisp'.  */
diff --git a/src/w32fns.c b/src/w32fns.c
index 675b716f3b0..2b06936d119 100644
--- a/src/w32fns.c
+++ b/src/w32fns.c
@@ -3213,6 +3213,8 @@ w32_wnd_proc (HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
              described by W was deleted, as indicated by its buffer
              field being reset to nil.  */
           f = x_window_to_frame (dpyinfo, hwnd);
+          if (!(f && FRAME_LIVE_P (f)))
+            break;
           w = XWINDOW (FRAME_SELECTED_WINDOW (f));
           /* Punt if someone changed the frame's selected window
              behind our back. */