core: fix use-after-free in Surface.setSelection (#12894) master
`setSelection` captured the previous selection, then called `Screen.select` (which deinits the previous selection's tracked pins), then compared the new selection against the now-freed previous pin via `sel.eql(prev)`. That read freed pin memory (use-after-free). The comparison was a copy-on-select optimization ("only re-copy if the selection changed"). Remove it rather than repair it because: - It never fired correctly. It compared against freed memory, so the shipped behavior was already "always copy". - It can't be repaired by copying `prev`'s pin before `Screen.select`. That fixes the use-after-free but not the logic: the call sites (e.g. mouse drag release) pass a selection equal to the one already set, so a working `eql` skip would suppress the very copy those sites exist to perform. A correct optimization would have to compare against the last-copied selection (before the mouse event mutated the live one), which would require extra state. - It isn't worth tracking that additional state. The copy runs once per selection gesture (mouse up, double-click), which isn't in a hot path, so skipping a redundant re-copy only saves a single clipboard write. Removing the skip eliminates the use-after-free and keeps the behavior consistent with what we've already been doing. --- _AI Disclosure_: Claude Opus 4.8 found this in a review while I was working on adjacent code.