bug#81585: 31.0.91 and 32.0.50; Crash on macos hiding header-line with pixel-scroll-precision-mode

On Sun, Aug 09, 2026 at 11:49:04AM -0400, Stéphane Marks wrote:
> On Sun, Aug 9, 2026 at 12:25 AM Corwin Kerr <[email protected]> wrote:
> 
> > Hi,
> >
> > I found a crash (Fatal error 10: Bus error; Abort trap: 6) on macos and
> > narrowed it down to turning off the header line when
> > pixel-scroll-precision-mode is enabled.
> >
> > file minimal.el
> > ;; -*- lexical-binding: t; -*-
> > (pixel-scroll-precision-mode)
> > (defun toggle-header ()
> >   (interactive)
> >   (setq header-line-format
> >         (unless header-line-format "Pixel scroll, then press C-t to
> > crash")))
> > (toggle-header)
> > (bind-key "C-t" #'toggle-header)
> >
> > To reproduce
> > 1 . emacs -Q --load minimal.el
> > 2. Scroll on the trackpad so half a line of buffer text is going off
> > screen to the top.
> > 3. C-t crash
> >
> > I built from source in debug mode and reproduced it on master at 32.0.50
> > and emacs-31 at 31.0.91. Happy to help test any fixes.
<snip>
> I was able to reproduce this on emacs-31 and with a debug build I can see
> generally what the problem is but not precisely sure what computation is
> erroneous within the redisplay.  Perhaps Alan (cc'd here) has more
> experience with this.

Honestly, I don't know if redisplay should be sending negative values
to *_scroll_run, but just in case I've tried changing copyRect:to: so
it can handle negative values.

copyRect:to: is used in one other place, so I thought it best to fix
the values there rather than in ns_scroll_run.

I tried to replicate on non-NS, but failed because I couldn't work out
how to get my machine to scroll half a line...
-- 
Alan Third

From ef715c0902b5973e47a412f96a4b97d63266e28c Mon Sep 17 00:00:00 2001
From: Alan Third <[email protected]>
Date: Sun, 9 Aug 2026 19:22:57 +0100
Subject: [PATCH] Fix crash in NS scroll code (bug#81585)

There may be a problem in the core redisplay code that it can send
negative values to the *_scroll_run functions, but this fixes the
problem at the actual scrolling code.

* src/nsterm.m ([EmacsView copyRect:to:]): If the destination is
negative, fix the source and destination to keep everything positive.
---
 src/nsterm.m | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/nsterm.m b/src/nsterm.m
index 20967b7581f..b4af6091c17 100644
--- a/src/nsterm.m
+++ b/src/nsterm.m
@@ -9316,6 +9316,16 @@ - (void)copyRect:(NSRect)srcRect to:(NSPoint)dest
   NSTRACE_RECT ("Source", srcRect);
   NSTRACE_POINT ("Destination", dest);
 
+  /* If the destination is off the top of the pixel buffer, fix the
+     source and destination to copy only to y = 0.  */
+  if (dest.y < 0)
+    {
+      int d = dest.y;
+      dest.y = 0;
+      srcRect.origin.y -= d;
+      srcRect.size.height += d;
+    }
+
   NSRect dstRect = NSMakeRect (dest.x, dest.y, NSWidth (srcRect),
                                NSHeight (srcRect));
 
-- 
2.55.0