Fix EXC_BAD_ACCESS crash: MPDocument.editor IBOutlet was unsafe_unretained

Reported as a crash on the Underline toolbar action, but the bug wasn't
in the underline code path itself (toggleForMarkupPrefix:suffix: in
NSTextView+Autocomplete.m was untouched and correct) -- it was in how
MPDocument holds its reference to the editor view. 'editor' was the only
IBOutlet on the class declared unsafe_unretained; every sibling outlet
(toolbar, splitView, editorContainer, preview, ...) is weak. Traced via
git blame to the original 2014 project setup, never updated since.

unsafe_unretained is a raw, non-zeroing pointer: if the MPEditorView is
ever deallocated and recreated (window/layout churn), 'editor' keeps
pointing at freed memory, and the next message sent to it -- from any
action, not just Underline -- is a dangling-pointer access, i.e.
EXC_BAD_ACCESS. weak makes the pointer nil itself out instead, turning a
crash into a safe no-op.

Author: robertobissanti

CHANGELOG.md

@@ -141,6 +141,18 @@ compliance. The Markdown parser (Hoedown) is untouched.
 
 ### Fixed
 
+- Crash (`EXC_BAD_ACCESS`) on toolbar formatting actions (reported on
+  Underline, but not specific to it — any action touching `self.editor`
+  was at risk). `MPDocument`'s `editor` IBOutlet was declared
+  `unsafe_unretained`, the one holdout among all of its sibling outlets
+  (`toolbar`, `splitView`, `editorContainer`, `preview`, ...), which are
+  all `weak` — traced via `git blame` to the original 2014 project setup,
+  predating this codebase's adoption of `weak` IBOutlets, never updated
+  since. A raw, non-zeroing pointer means that if the underlying
+  `MPEditorView` is ever deallocated and recreated (window/layout churn),
+  `editor` keeps pointing at freed memory; any later message to it is a
+  dangling-pointer access. Changed to `weak`, matching every other outlet
+  on the class.
 - `Tools/update_build_number.sh`: unquoted `$(pwd -P)` broke the build when
   the checkout path contained a space (pre-existing bug, unrelated to this
   modernization pass).

MacDown/Code/Document/MPDocument.m

@@ -159,7 +159,16 @@ typedef NS_ENUM(NSUInteger, MPWordCountType) {
 @property (weak) IBOutlet NSToolbar *toolbar;
 @property (weak) IBOutlet MPDocumentSplitView *splitView;
 @property (weak) IBOutlet NSView *editorContainer;
-@property (unsafe_unretained) IBOutlet MPEditorView *editor;
+// unsafe_unretained here (unlike every sibling IBOutlet above, all `weak`)
+// dates back to the original 2014 project setup, predating this codebase's
+// adoption of `weak` IBOutlets, and was never updated. A raw, non-zeroing
+// pointer means that if the underlying MPEditorView is ever deallocated
+// and recreated (e.g. during window/layout churn), `editor` keeps pointing
+// at freed memory -- any later message to it (toggleForMarkupPrefix:suffix:,
+// .selectedRange, .string, ...) is then a dangling-pointer access, i.e.
+// EXC_BAD_ACCESS. `weak` makes the pointer nil itself out instead of
+// dangling, turning a crash into a safe no-op.
+@property (weak) IBOutlet MPEditorView *editor;
 @property (weak) IBOutlet NSLayoutConstraint *editorPaddingBottom;
 // Instantiated programmatically in -windowControllerDidLoadNib: and swapped
 // into the split view in place of a plain NSView placeholder (see