bug#71929: 30.0.60; crash in mark_image_cache

[Po Lu]

Eli Zaretskii <eliz@gnu.org> writes:

> How does this answer my question?

I mentioned free_frame_faces.  That's the only function where image
caches are released.

> The use case I was thinking of is that the image cache was shared,
> then the last frame which shared the cache was deleted.  How do we
> make sure the cache is freed and set to NULL in this situation?

The cache (whose refcount is 1) is released in free_frame_faces when it
is called with this final frame, through free_image_cache, which also
resets its `FRAME_IMAGE_CACHE' to NULL.

> IOW, we seem to have a cache that is not NULL but is also not a real
> cache, as it cannot be accessed.  The question is how did that happen?

I don't know.  It can only be the case if its `refcount' was decremented
excessively for a reason not yet understood.