bug#39962: 27.0.90; Crash in Emacs 27.0.90

[Pieter van Oostrum]

Pip Cet <pipcet@gmail.com> writes:

> Another thing we could try is poisoning the memory area used by a
> vector when we put it on the free list. Something like the attached
> patch might work.

I made a new compile with the patch 
0001-poison-memory-of-vectors-put-on-the-free-list.patch applied and also the 
latest 0001-Don-t-collect-reachable-killed-buffers-during-GC.patch (from 
message ID 
<CAOqdjBfeL-T8grB+sW+jLoW-JX8Y0siFTzG1q0o+Skc+sKvtSQ@mail.gmail.com>) applied.

I get a crash about a mal-formed marker, but now in the running code, not in 
the GC.


./lisp.h:2623: Emacs fatal error: assertion failed: MARKERP (a)
--Type <RET> for more, q to quit, c to continue without paging--

Thread 3 hit Breakpoint 1, terminate_due_to_signal (sig=6, 
    backtrace_limit=2147483647) at emacs.c:371
371       signal (sig, SIG_DFL);
(gdb) bt
#0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at emacs.c:371
#1  0x00000001002a4b2b in die (msg=0x1004f65cc "MARKERP (a)", 
    file=0x1004f0449 "./lisp.h", line=2623) at alloc.c:7249
#2  0x000000010023c21f in XMARKER (a=XIL(0x12590f575)) at ./lisp.h:2623
#3  0x000000010023cdc5 in marker_position (marker=XIL(0x12590f575))
    at marker.c:691
#4  0x0000000100221335 in OVERLAY_POSITION (p=XIL(0x12590f575))
    at ./buffer.h:1394
#5  0x00000001002268d7 in report_overlay_modification (
    start=make_fixnum(40255), end=make_fixnum(40255), after=false, 
    arg1=make_fixnum(40255), arg2=make_fixnum(40255), arg3=XIL(0))
    at buffer.c:4496
#6  0x0000000100239462 in signal_before_change (start_int=40255, 
    end_int=40255, preserve_ptr=0x0) at insdel.c:2179
#7  0x000000010023878b in prepare_to_modify_buffer_1 (start=40255, end=40255, 
    preserve_ptr=0x0) at insdel.c:2007
#8  0x00000001002339a5 in prepare_to_modify_buffer (start=40255, end=40255, 
    preserve_ptr=0x0) at insdel.c:2018
#9  0x0000000100234067 in insert_from_string_1 (string=XIL(0x1607b3984), 
    pos=0, pos_byte=0, nchars=2, nbytes=2, inherit=false, before_markers=false)
    at insdel.c:1016
#10 0x0000000100233e88 in insert_from_string (string=XIL(0x1607b3984), pos=0, 
    pos_byte=0, length=2, length_byte=2, inherit=false) at insdel.c:967
#11 0x00000001002ec572 in general_insert_function (
    insert_func=0x100232120 <insert>, 
    insert_from_string_func=0x100233df0 <insert_from_string>, inherit=false, 
    nargs=1, args=0x7ffeefbe9af8) at editfns.c:1334
#12 0x00000001002ec28b in Finsert (nargs=1, args=0x7ffeefbe9af8)
    at editfns.c:1370
#13 0x00000001003a7df3 in exec_byte_code (bytestr=XIL(0x10d555e74), 
    vector=XIL(0x10dbc0e65), maxdepth=make_fixnum(6), args_template=XIL(0), 
    nargs=0, args=0x0) at bytecode.c:1075
#14 0x00000001003174d6 in funcall_lambda (fun=XIL(0x10dbc1005), nargs=1, 
    arg_vector=0x7ffeefbeac90) at eval.c:3067
#15 0x0000000100314c9e in Ffuncall (nargs=2, args=0x7ffeefbeac88)
    at eval.c:2796
#16 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10d555cd4), 
    vector=XIL(0x10dbbf105), maxdepth=make_fixnum(3), args_template=XIL(0), 
    nargs=0, args=0x0) at bytecode.c:633
#17 0x00000001003174d6 in funcall_lambda (fun=XIL(0x10dbbf155), nargs=0, 
    arg_vector=0x7ffeefbebc60) at eval.c:3067
#18 0x0000000100314c9e in Ffuncall (nargs=1, args=0x7ffeefbebc58)
    at eval.c:2796
#19 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10bcb9c54), 
    vector=XIL(0x105e347e5), maxdepth=make_fixnum(4), args_template=XIL(0), 
    nargs=0, args=0x0) at bytecode.c:633
#20 0x00000001003174d6 in funcall_lambda (fun=XIL(0x105e34885), nargs=1, 
    arg_vector=0x7ffeefbecc60) at eval.c:3067
#21 0x0000000100314c9e in Ffuncall (nargs=2, args=0x7ffeefbecc58)
--Type <RET> for more, q to quit, c to continue without paging--c
   
#22 0x0000000100315d54 in call1 (fn=XIL(0x105e34885), arg1=XIL(0xda2bad0)) at 
eval.c:2654
#23 0x000000010037ab0d in mapatoms_1 (sym=XIL(0xda2bad0), 
function=XIL(0x105e34885)) at lread.c:4380
#24 0x000000010037a9ae in map_obarray (obarray=XIL(0x10e062585), fn=0x10037aaf0 
<mapatoms_1>, arg=XIL(0x105e34885)) at lread.c:4369
#25 0x000000010037aad1 in Fmapatoms (function=XIL(0x105e34885), 
obarray=XIL(0x10e062585)) at lread.c:4391
#26 0x000000010031666c in funcall_subr (subr=0x10055b588, numargs=2, 
args=0x7ffeefbecfb0) at eval.c:2869
#27 0x0000000100314c4e in Ffuncall (nargs=3, args=0x7ffeefbecfa8) at eval.c:2794
#28 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10bcb9c14), 
vector=XIL(0x105e348b5), maxdepth=make_fixnum(6), args_template=XIL(0), 
nargs=0, args=0x0) at bytecode.c:633
#29 0x00000001003174d6 in funcall_lambda (fun=XIL(0x105e349a5), nargs=0, 
arg_vector=0x7ffeefbedfd0) at eval.c:3067
#30 0x0000000100314c9e in Ffuncall (nargs=1, args=0x7ffeefbedfc8) at eval.c:2796
#31 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10d3c1e64), 
vector=XIL(0x104a577f5), maxdepth=make_fixnum(13), args_template=XIL(0), 
nargs=0, args=0x0) at bytecode.c:633
#32 0x00000001003174d6 in funcall_lambda (fun=XIL(0x10dcd81a5), nargs=9, 
arg_vector=0x7ffeefbef420) at eval.c:3067
#33 0x0000000100314c9e in Ffuncall (nargs=10, args=0x7ffeefbef418) at 
eval.c:2796
#34 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10d3c16a4), 
vector=XIL(0x10daee0a5), maxdepth=make_fixnum(11), args_template=XIL(0), 
nargs=0, args=0x0) at bytecode.c:633
#35 0x00000001003174d6 in funcall_lambda (fun=XIL(0x10dcfa1b5), nargs=2, 
arg_vector=0x7ffeefbf0770) at eval.c:3067
#36 0x0000000100314c9e in Ffuncall (nargs=3, args=0x7ffeefbf0768) at eval.c:2796
#37 0x00000001002fda6a in Ffuncall_interactively (nargs=3, args=0x7ffeefbf0768) 
at callint.c:254
#38 0x0000000100316526 in funcall_subr (subr=0x100558d98, numargs=3, 
args=0x7ffeefbf0768) at eval.c:2847
#39 0x0000000100314c4e in Ffuncall (nargs=4, args=0x7ffeefbf0760) at eval.c:2794
#40 0x0000000100314a06 in Fapply (nargs=3, args=0x7ffeefbf1500) at eval.c:2424
#41 0x00000001002fdfd0 in Fcall_interactively (function=XIL(0x54b0790), 
record_flag=XIL(0xa770), keys=XIL(0x11e7468a5)) at callint.c:342
#42 0x00000001003166a2 in funcall_subr (subr=0x100558d68, numargs=3, 
args=0x7ffeefbf17d0) at eval.c:2872
#43 0x0000000100314c4e in Ffuncall (nargs=4, args=0x7ffeefbf17c8) at eval.c:2794
#44 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10623df8c), 
vector=XIL(0x10623dadd), maxdepth=make_fixnum(13), 
args_template=make_fixnum(1025), nargs=2, args=0x7ffeefbf2848) at bytecode.c:633
#45 0x0000000100316d35 in funcall_lambda (fun=XIL(0x10623daad), nargs=2, 
arg_vector=0x7ffeefbf2838) at eval.c:2989
#46 0x0000000100314c9e in Ffuncall (nargs=3, args=0x7ffeefbf2830) at eval.c:2796
#47 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10627ee64), 
vector=XIL(0x10627e965), maxdepth=make_fixnum(15), 
args_template=make_fixnum(769), nargs=3, args=0x7ffeefbf3be8) at bytecode.c:633
#48 0x0000000100316d35 in funcall_lambda (fun=XIL(0x10627d80d), nargs=3, 
arg_vector=0x7ffeefbf3bd0) at eval.c:2989
#49 0x0000000100314c9e in Ffuncall (nargs=4, args=0x7ffeefbf3bc8) at eval.c:2796
#50 0x00000001002fda6a in Ffuncall_interactively (nargs=4, args=0x7ffeefbf3bc8) 
at callint.c:254
#51 0x0000000100316526 in funcall_subr (subr=0x100558d98, numargs=4, 
args=0x7ffeefbf3bc8) at eval.c:2847
#52 0x0000000100314c4e in Ffuncall (nargs=5, args=0x7ffeefbf3bc0) at eval.c:2794
#53 0x0000000100314a06 in Fapply (nargs=3, args=0x7ffeefbf4970) at eval.c:2424
#54 0x00000001002fdfd0 in Fcall_interactively (function=XIL(0x5844aa8), 
record_flag=XIL(0), keys=XIL(0x160a78fd5)) at callint.c:342
#55 0x00000001003166a2 in funcall_subr (subr=0x100558d68, numargs=3, 
args=0x7ffeefbf4c40) at eval.c:2872
#56 0x0000000100314c4e in Ffuncall (nargs=4, args=0x7ffeefbf4c38) at eval.c:2794
#57 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10623df8c), 
vector=XIL(0x10623dadd), maxdepth=make_fixnum(13), 
args_template=make_fixnum(1025), nargs=1, args=0x7ffeefbf5ca8) at bytecode.c:633
#58 0x0000000100316d35 in funcall_lambda (fun=XIL(0x10623daad), nargs=1, 
arg_vector=0x7ffeefbf5ca0) at eval.c:2989
#59 0x0000000100314c9e in Ffuncall (nargs=2, args=0x7ffeefbf5c98) at eval.c:2796
#60 0x0000000100315d54 in call1 (fn=XIL(0x3960), arg1=XIL(0x5844aa8)) at 
eval.c:2654
#61 0x00000001001c76b0 in command_loop_1 () at keyboard.c:1463
#62 0x00000001001f4b5e in Fexecute_kbd_macro (macro=XIL(0x10e00fe05), 
count=XIL(0), loopfunc=XIL(0x43b13e0)) at macros.c:324
#63 0x00000001003166a2 in funcall_subr (subr=0x100553c98, numargs=3, 
args=0x7ffeefbf6600) at eval.c:2872
#64 0x0000000100314c4e in Ffuncall (nargs=4, args=0x7ffeefbf65f8) at eval.c:2794
#65 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10d506dd4), 
vector=XIL(0x10e0532c5), maxdepth=make_fixnum(4), args_template=XIL(0), 
nargs=0, args=0x0) at bytecode.c:633
#66 0x00000001003174d6 in funcall_lambda (fun=XIL(0x10e053305), nargs=4, 
arg_vector=0x7ffeefbf75a8) at eval.c:3067
#67 0x0000000100314c9e in Ffuncall (nargs=5, args=0x7ffeefbf75a0) at eval.c:2796
#68 0x0000000100314a06 in Fapply (nargs=3, args=0x7ffeefbf7978) at eval.c:2424
#69 0x0000000100316526 in funcall_subr (subr=0x100559368, numargs=3, 
args=0x7ffeefbf7978) at eval.c:2847
#70 0x0000000100314c4e in Ffuncall (nargs=4, args=0x7ffeefbf7970) at eval.c:2794
#71 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10612797c), 
vector=XIL(0x10e04ff55), maxdepth=make_fixnum(5), 
args_template=make_fixnum(128), nargs=3, args=0x7ffeefbf8930) at bytecode.c:633
#72 0x0000000100316d35 in funcall_lambda (fun=XIL(0x10e04ff85), nargs=3, 
arg_vector=0x7ffeefbf8930) at eval.c:2989
#73 0x0000000100314c9e in Ffuncall (nargs=4, args=0x7ffeefbf8928) at eval.c:2796
#74 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10d3650a4), 
vector=XIL(0x104e341b5), maxdepth=make_fixnum(6), 
args_template=make_fixnum(514), nargs=2, args=0x7ffeefbf97c0) at bytecode.c:633
#75 0x0000000100316d35 in funcall_lambda (fun=XIL(0x104e341e5), nargs=2, 
arg_vector=0x7ffeefbf97b0) at eval.c:2989
#76 0x0000000100311005 in apply_lambda (fun=XIL(0x104e341e5), 
args=XIL(0x10794c773), count=18) at eval.c:2926
#77 0x000000010030680d in eval_sub (form=XIL(0x10794c6d3)) at eval.c:2318
#78 0x000000010030705d in Fprogn (body=XIL(0)) at eval.c:462
#79 0x00000001003173ec in funcall_lambda (fun=XIL(0x10794c643), nargs=0, 
arg_vector=0x7ffeefbf9dc0) at eval.c:3060
#80 0x0000000100311005 in apply_lambda (fun=XIL(0x10794c643), args=XIL(0), 
count=15) at eval.c:2926
#81 0x0000000100306b79 in eval_sub (form=XIL(0x160a862b3)) at eval.c:2348
#82 0x000000010030705d in Fprogn (body=XIL(0)) at eval.c:462
#83 0x0000000100304a44 in eval_sub (form=XIL(0x160a862d3)) at eval.c:2226
#84 0x000000010030f55d in Feval (form=XIL(0x160a862d3), lexical=XIL(0x30)) at 
eval.c:2102
#85 0x000000010031666c in funcall_subr (subr=0x100559338, numargs=2, 
args=0x7ffeefbfa820) at eval.c:2869
#86 0x0000000100314c4e in Ffuncall (nargs=3, args=0x7ffeefbfa818) at eval.c:2794
#87 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10630312c), 
vector=XIL(0x106302905), maxdepth=make_fixnum(16), 
args_template=make_fixnum(257), nargs=1, args=0x7ffeefbfb800) at bytecode.c:633
#88 0x0000000100316d35 in funcall_lambda (fun=XIL(0x1063028d5), nargs=1, 
arg_vector=0x7ffeefbfb7f8) at eval.c:2989
#89 0x0000000100314c9e in Ffuncall (nargs=2, args=0x7ffeefbfb7f0) at eval.c:2796
#90 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10630327c), 
vector=XIL(0x10630287d), maxdepth=make_fixnum(4), 
args_template=make_fixnum(257), nargs=1, args=0x7ffeefbfca58) at bytecode.c:633
#91 0x0000000100316d35 in funcall_lambda (fun=XIL(0x106302845), nargs=1, 
arg_vector=0x7ffeefbfca50) at eval.c:2989
#92 0x0000000100314c9e in Ffuncall (nargs=2, args=0x7ffeefbfca48) at eval.c:2796
#93 0x00000001002fda6a in Ffuncall_interactively (nargs=2, args=0x7ffeefbfca48) 
at callint.c:254
#94 0x0000000100316526 in funcall_subr (subr=0x100558d98, numargs=2, 
args=0x7ffeefbfca48) at eval.c:2847
#95 0x0000000100314c4e in Ffuncall (nargs=3, args=0x7ffeefbfca40) at eval.c:2794
#96 0x0000000100301314 in Fcall_interactively (function=XIL(0x58c9b00), 
record_flag=XIL(0), keys=XIL(0x160a78fd5)) at callint.c:783
#97 0x00000001003166a2 in funcall_subr (subr=0x100558d68, numargs=3, 
args=0x7ffeefbfd9c0) at eval.c:2872
#98 0x0000000100314c4e in Ffuncall (nargs=4, args=0x7ffeefbfd9b8) at eval.c:2794
#99 0x00000001003a527f in exec_byte_code (bytestr=XIL(0x10623df8c), 
vector=XIL(0x10623dadd), maxdepth=make_fixnum(13), 
args_template=make_fixnum(1025), nargs=1, args=0x7ffeefbfea28) at bytecode.c:633
#100 0x0000000100316d35 in funcall_lambda (fun=XIL(0x10623daad), nargs=1, 
arg_vector=0x7ffeefbfea20) at eval.c:2989
#101 0x0000000100314c9e in Ffuncall (nargs=2, args=0x7ffeefbfea18) at 
eval.c:2796
#102 0x0000000100315d54 in call1 (fn=XIL(0x3960), arg1=XIL(0x58c9b00)) at 
eval.c:2654
#103 0x00000001001c76b0 in command_loop_1 () at keyboard.c:1463
#104 0x000000010030d65f in internal_condition_case (bfun=0x1001c6950 
<command_loop_1>, handlers=XIL(0x90), hfun=0x1001ea010 <cmd_error>) at 
eval.c:1355
#105 0x00000001001e9ef1 in command_loop_2 (ignore=XIL(0)) at keyboard.c:1091
#106 0x000000010030c798 in internal_catch (tag=XIL(0xc450), func=0x1001e9ec0 
<command_loop_2>, arg=XIL(0)) at eval.c:1116
#107 0x00000001001c59c5 in command_loop () at keyboard.c:1070
#108 0x00000001001c5797 in recursive_edit_1 () at keyboard.c:714
#109 0x00000001001c5c46 in Frecursive_edit () at keyboard.c:786
#110 0x00000001001c27ae in main (argc=1, argv=0x7ffeefbff660) at emacs.c:2054
[New Thread 0x2f53 of process 39258]

Lisp Backtrace:
"vm-set-summary-pointer" (0xefbeac90)
"vm-do-needed-summary-rebuild" (0xefbebc60)
0x5e34880 PVEC_COMPILED
"mapatoms" (0xefbecfb0)
"vm-update-summary-and-mode-line" (0xefbedfd0)
"vm" (0xefbef420)
"vf" (0xefbf0770)
"funcall-interactively" (0xefbf0768)
"call-interactively" (0xefbf17d0)
"command-execute" (0xefbf2838)
"execute-extended-command" (0xefbf3bd0)
"funcall-interactively" (0xefbf3bc8)
"call-interactively" (0xefbf4c40)
"command-execute" (0xefbf5ca0)
0x553c98 PVEC_SUBR
"ad-Advice-execute-kbd-macro" (0xefbf75a8)
"apply" (0xefbf7978)
"execute-kbd-macro" (0xefbf8930)
"kmacro-exec-ring-item" (0xefbf97b0)
"test-emacs-crash" (0xefbf9dc0)
"progn" (0xefbfa448)
"eval" (0xefbfa820)
"elisp--eval-last-sexp" (0xefbfb7f8)
"eval-last-sexp" (0xefbfca50)
"funcall-interactively" (0xefbfca48)
"call-interactively" (0xefbfd9c0)
"command-execute" (0xefbfea20)
(gdb) f 3
#3  0x000000010023cdc5 in marker_position (marker=XIL(0x12590f575))
    at marker.c:691
691       register struct Lisp_Marker *m = XMARKER (marker);
(gdb) p marker
$1 = XIL(0x12590f575)
(gdb) xtype
Lisp_Vectorlike
PVEC_NORMAL_VECTOR
(gdb) p m
$2 = (struct Lisp_Marker *) 0x7ffeefbe92d0
(gdb) p *m
$3 = {
  header = {
    size = 140732920665232
  },
  buffer = 0x1002268d7 <report_overlay_modification+263>,
  need_adjustment = true,
  insertion_type = false,
  next = 0x0,
  charpos = 4406354344,
  bytepos = 4305685776
}
(gdb) 


-- 
Pieter van Oostrum
www: http://pieter.vanoostrum.org/
PGP key: [8DAE142BE17999C4]