bug#81585: 31.0.91 and 32.0.50; Crash on macos hiding header-line with pixel-scroll-precision-mode

On Sun, Aug 9, 2026 at 2:53 PM Alan Third <[email protected]> wrote:

> On Sun, Aug 09, 2026 at 11:49:04AM -0400, Stéphane Marks wrote:
> > On Sun, Aug 9, 2026 at 12:25 AM Corwin Kerr <[email protected]>
> wrote:
> >
> > > Hi,
> > >
> > > I found a crash (Fatal error 10: Bus error; Abort trap: 6) on macos and
> > > narrowed it down to turning off the header line when
> > > pixel-scroll-precision-mode is enabled.
> > >
> > > file minimal.el
> > > ;; -*- lexical-binding: t; -*-
> > > (pixel-scroll-precision-mode)
> > > (defun toggle-header ()
> > >   (interactive)
> > >   (setq header-line-format
> > >         (unless header-line-format "Pixel scroll, then press C-t to
> > > crash")))
> > > (toggle-header)
> > > (bind-key "C-t" #'toggle-header)
> > >
> > > To reproduce
> > > 1 . emacs -Q --load minimal.el
> > > 2. Scroll on the trackpad so half a line of buffer text is going off
> > > screen to the top.
> > > 3. C-t crash
> > >
> > > I built from source in debug mode and reproduced it on master at
> 32.0.50
> > > and emacs-31 at 31.0.91. Happy to help test any fixes.
> <snip>
> > I was able to reproduce this on emacs-31 and with a debug build I can see
> > generally what the problem is but not precisely sure what computation is
> > erroneous within the redisplay.  Perhaps Alan (cc'd here) has more
> > experience with this.
>
> Honestly, I don't know if redisplay should be sending negative values
> to *_scroll_run, but just in case I've tried changing copyRect:to: so
> it can handle negative values.
>
> copyRect:to: is used in one other place, so I thought it best to fix
> the values there rather than in ns_scroll_run.
>
> I tried to replicate on non-NS, but failed because I couldn't work out
> how to get my machine to scroll half a line...
>

Basic testing of the patch with my full configuration, which includes JD's
ultra-scroll, seems to have no ill effects.