Fix crash upon call to Fset_fontset_font after X server disconnect

* src/image.c (free_image):

* src/xfaces.c (free_realized_face): Handle scenarios where
free_frame_faces is called with the display connection cut.

* src/xterm.c (x_free_frame_resources): Call free_frame_faces
unconditionally, lest fontsets for this dead frame contaminate
Vfontset_list and produce crashes afterwards.  (bug#66151)

1 files changed, 19 insertions, 7 deletions

diff --git a/src/image.c b/src/image.c
index 216bdc1ee66..3968145728f 100644
--- a/src/image.c
+++ b/src/image.c
@@ -1699,14 +1699,26 @@ free_image (struct frame *f, struct image *img)
       c->images[img->id] = NULL;
 
 #if !defined USE_CAIRO && defined HAVE_XRENDER
-      if (img->picture)
-        XRenderFreePicture (FRAME_X_DISPLAY (f), img->picture);
-      if (img->mask_picture)
-        XRenderFreePicture (FRAME_X_DISPLAY (f), img->mask_picture);
-#endif
+      /* FRAME_X_DISPLAY (f) could be NULL if this is being called from
+         the display IO error handler.*/
+
+      if (FRAME_X_DISPLAY (f))
+        {
+          if (img->picture)
+            XRenderFreePicture (FRAME_X_DISPLAY (f),
+                                img->picture);
+          if (img->mask_picture)
+            XRenderFreePicture (FRAME_X_DISPLAY (f),
+                                img->mask_picture);
+        }
+#endif /* !USE_CAIRO && HAVE_XRENDER */
+
+#ifdef HAVE_X_WINDOWS
+      if (FRAME_X_DISPLAY (f))
+#endif /* HAVE_X_WINDOWS */
+        /* Free resources, then free IMG.  */
+        img->type->free_img (f, img);
 
-      /* Free resources, then free IMG.  */
-      img->type->free_img (f, img);
       xfree (img->face_font_family);
       xfree (img);
     }