Fix bug with an attempt to select uninitialized frame (Bug#18161).

* xfns.c (Fx_create_frame): Move call to change_frame_size to
a section where Lisp evaluation is disabled.  This way a pointer
to uninitialized frame is not accessible from Lisp, which becomes
critical if following call to x_figure_window_size throws an error.

2 files changed, 28 insertions, 21 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 93c27a6e565..3f9b4577460 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,11 @@
+2014-08-03  Dmitry Antipov  <dmantipov@yandex.ru>
+
+        Fix bug with an attempt to select uninitialized frame (Bug#18161).
+        * xfns.c (Fx_create_frame): Move call to change_frame_size to
+        a section where Lisp evaluation is disabled.  This way a pointer
+        to uninitialized frame is not accessible from Lisp, which becomes
+        critical if following call to x_figure_window_size throws an error.
+
 2014-08-02  Paul Eggert  <eggert@cs.ucla.edu>
 
         Fix bug with clang + directory_files_internal + GC (Bug#16986).
diff --git a/src/xfns.c b/src/xfns.c
index 23fba44f1f3..96a4b07b150 100644
--- a/src/xfns.c
+++ b/src/xfns.c
@@ -2884,7 +2884,7 @@ This function is an internal primitive--use `make-frame' instead.  */)
   int minibuffer_only = 0;
   long window_prompting = 0;
   int width, height;
-  ptrdiff_t count = SPECPDL_INDEX ();
+  ptrdiff_t count = SPECPDL_INDEX (), count2;
   struct gcpro gcpro1, gcpro2, gcpro3, gcpro4;
   Lisp_Object display;
   struct x_display_info *dpyinfo = NULL;
@@ -3130,6 +3130,14 @@ This function is an internal primitive--use `make-frame' instead.  */)
      end up in init_iterator with a null face cache, which should not
      happen.  */
   init_frame_faces (f);
+  
+  /* Temporary disable window-configuration-change-hook to avoid
+     an infloop in next_frame and access to uninitialized frame
+     from Lisp code (Bug#18161).  */
+
+  count2 = SPECPDL_INDEX ();
+  record_unwind_protect (unwind_create_frame_1, inhibit_lisp_code);
+  inhibit_lisp_code = Qt;
 
   /* PXW: This is a duplicate from below.  We have to do it here since
      otherwise x_set_tool_bar_lines will work with the character sizes
@@ -3145,27 +3153,18 @@ This function is an internal primitive--use `make-frame' instead.  */)
   /* Set the menu-bar-lines and tool-bar-lines parameters.  We don't
      look up the X resources controlling the menu-bar and tool-bar
      here; they are processed specially at startup, and reflected in
-     the values of the mode variables.
+     the values of the mode variables.  */
 
-     Avoid calling window-configuration-change-hook; otherwise we
-     could get an infloop in next_frame since the frame is not yet in
-     Vframe_list.  */
-  {
-    ptrdiff_t count2 = SPECPDL_INDEX ();
-    record_unwind_protect (unwind_create_frame_1, inhibit_lisp_code);
-    inhibit_lisp_code = Qt;
-
-    x_default_parameter (f, parms, Qmenu_bar_lines,
-                         NILP (Vmenu_bar_mode)
-                         ? make_number (0) : make_number (1),
-                         NULL, NULL, RES_TYPE_NUMBER);
-    x_default_parameter (f, parms, Qtool_bar_lines,
-                         NILP (Vtool_bar_mode)
-                         ? make_number (0) : make_number (1),
-                         NULL, NULL, RES_TYPE_NUMBER);
-
-    unbind_to (count2, Qnil);
-  }
+  x_default_parameter (f, parms, Qmenu_bar_lines,
+                       NILP (Vmenu_bar_mode)
+                       ? make_number (0) : make_number (1),
+                       NULL, NULL, RES_TYPE_NUMBER);
+  x_default_parameter (f, parms, Qtool_bar_lines,
+                       NILP (Vtool_bar_mode)
+                       ? make_number (0) : make_number (1),
+                       NULL, NULL, RES_TYPE_NUMBER);
+
+  unbind_to (count2, Qnil);
 
   x_default_parameter (f, parms, Qbuffer_predicate, Qnil,
                        "bufferPredicate", "BufferPredicate",