Fix bug #17524 with crashes in creating a new frame with invalid font.

 src/w32fns.c (unwind_create_frame) [GLYPH_DEBUG]: If we are
 unwinding when frame's faces were not initialized yet, increment
 the frame's image-cache reference count before calling
 x_free_frame_resources.  Don't dereference
 dpyinfo->terminal->image_cache if it is NULL.

2 files changed, 21 insertions, 1 deletions

diff --git a/src/ChangeLog b/src/ChangeLog
index 2283677a448..cb54bbd0e70 100644
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,11 @@
+2014-05-20  Eli Zaretskii  <eliz@gnu.org>
+
+	* w32fns.c (unwind_create_frame) [GLYPH_DEBUG]: If we are
+	unwinding when frame's faces were not initialized yet, increment
+	the frame's image-cache reference count before calling
+	x_free_frame_resources.  Don't dereference
+	dpyinfo->terminal->image_cache if it is NULL.  (Bug#17524)
+
 2014-05-11  Glenn Morris  <rgm@gnu.org>
 
 	* fileio.c (Ffile_executable_p): Doc tweak.
diff --git a/src/w32fns.c b/src/w32fns.c
index 630059c38f1..638c617df99 100644
--- a/src/w32fns.c
+++ b/src/w32fns.c
@@ -4245,6 +4245,17 @@ unwind_create_frame (Lisp_Object frame)
     {
 #ifdef GLYPH_DEBUG
       struct w32_display_info *dpyinfo = FRAME_DISPLAY_INFO (f);
+
+      /* If the frame's image cache refcount is still the same as our
+	 private shadow variable, it means we are unwinding a frame
+	 for which we didn't yet call init_frame_faces, where the
+	 refcount is incremented.  Therefore, we increment it here, so
+	 that free_frame_faces, called in x_free_frame_resources
+	 below, will not mistakenly decrement the counter that was not
+	 incremented yet to account for this new frame.  */
+      if (FRAME_IMAGE_CACHE (f) != NULL
+	  && FRAME_IMAGE_CACHE (f)->refcount == image_cache_refcount)
+	FRAME_IMAGE_CACHE (f)->refcount++;
 #endif
 
       x_free_frame_resources (f);
@@ -4255,7 +4266,8 @@ unwind_create_frame (Lisp_Object frame)
       eassert (dpyinfo->reference_count == dpyinfo_refcount);
       eassert ((dpyinfo->terminal->image_cache == NULL
 		&& image_cache_refcount == 0)
-	       || dpyinfo->terminal->image_cache->refcount == image_cache_refcount);
+	       || (dpyinfo->terminal->image_cache != NULL
+		   && dpyinfo->terminal->image_cache->refcount == image_cache_refcount));
 #endif
       return Qt;
     }