3 files changed, 23 insertions, 11 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 0eb69f59efe..291eec18fe9 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,10 @@
+2012-11-08  Dmitry Antipov  <dmantipov@yandex.ru>
+
+        * keyboard.c (event_to_kboard): Do not dereference
+        frame_or_window field of SELECTION_REQUEST_EVENT
+        and SELECTION_CLEAR_EVENT events (Bug#12814).
+        * xterm.h (struct selection_input_event): Adjust comment.
+
 2012-11-07  Eli Zaretskii  <eliz@gnu.org>
 
         * w32fns.c (modifier_set): Don't report modifiers from toggle key,
diff --git a/src/keyboard.c b/src/keyboard.c
index dfd4d0c2648..8f3a206139d 100644
--- a/src/keyboard.c
+++ b/src/keyboard.c
@@ -3416,13 +3416,20 @@ int stop_character EXTERNALLY_VISIBLE;
 static KBOARD *
 event_to_kboard (struct input_event *event)
 {
-  Lisp_Object obj = event->frame_or_window;
-  /* There are some events that set this field to nil or string.  */
-  if (WINDOWP (obj))
-    obj = WINDOW_FRAME (XWINDOW (obj));
-  /* Also ignore dead frames here.  */
-  return ((FRAMEP (obj) && FRAME_LIVE_P (XFRAME (obj)))
-          ? FRAME_KBOARD (XFRAME (obj)) : NULL);
+  /* Not applicable for these special events.  */
+  if (event->kind == SELECTION_REQUEST_EVENT
+      || event->kind == SELECTION_CLEAR_EVENT)
+    return NULL;
+  else
+    {
+      Lisp_Object obj = event->frame_or_window;
+      /* There are some events that set this field to nil or string.  */
+      if (WINDOWP (obj))
+        obj = WINDOW_FRAME (XWINDOW (obj));
+      /* Also ignore dead frames here.  */
+      return ((FRAMEP (obj) && FRAME_LIVE_P (XFRAME (obj)))
+              ? FRAME_KBOARD (XFRAME (obj)) : NULL);
+    }
 }
 
 #ifdef subprocesses
diff --git a/src/xterm.h b/src/xterm.h
index 4bc8f9813ed..6ef3d11fe48 100644
--- a/src/xterm.h
+++ b/src/xterm.h
@@ -890,10 +890,8 @@ struct scroll_bar
    by this structure.  */
 
 /* For an event of kind SELECTION_REQUEST_EVENT,
-   this structure really describes the contents.
-   **Don't make this struct longer!**
-   If it overlaps the frame_or_window field of struct input_event,
-   that will cause GC to crash.  */
+   this structure really describes the contents.  */
+
 struct selection_input_event
 {
   int kind;