bug#61504: 29.0.60; executing byte-code from previous build causes SIGSEGV crash

[Istvan Marko]

There seems to be a byte-code change between versions
0ec0a610ed226419269f519021cbe8fb2dde2ed5 (old) and
a4aa32bdfff7aaf54efbacbb04b7f2b52fef92a7 (new) which causes the new
version to crash with SIGSEGV when executing certain code from an .elc
built using the old version. Recompiling the file with the new version
causes the new .elc to work correctly.

I am able to reproduce this by calling (pdf-tools-install-noverify) from
the pdf-tools.elc (compiled with the older emacs version) from the
pdf-tools package which is available at
https://github.com/politza/pdf-tools

This snippet in particular triggers the crash:

  (dolist (buf (buffer-list))
    ;; This when check should not be necessary, but somehow dead
    ;; buffers are showing up here. See
    ;; https://github.com/vedang/pdf-tools/pull/93
    (when (buffer-live-p buf)
      (with-current-buffer buf
        (when (and (not (derived-mode-p 'pdf-view-mode))
                   (pdf-tools-pdf-buffer-p)
                   (buffer-file-name))
          (pdf-view-mode)))))

The crash happens in the pdf-tools-pdf-buffer-p function:

(defun pdf-tools-pdf-buffer-p (&optional buffer)
  "Check if the current buffer is a PDF document.

Optionally, take BUFFER as an argument and check if it is a PDF document."
  (save-current-buffer
    (when buffer (set-buffer buffer))
    (save-excursion
      (save-restriction
        (widen)
        (goto-char 1)
        (looking-at "%PDF")))))

I can try to create a smaller standalone reproducer if needed.

backtrace:

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
0x00001555529d17a7 in free () from /lib64/libc.so.6

(gdb) bt
#0  0x00001555529d17a7 in free () from /lib64/libc.so.6
#1  0x00000000001e66bc in ?? ()
#2  0x00005555557693d4 in safe_free (sa_count=...) at 
/mnt/sdc1/tmp/emacs/src/lisp.h:5385
#3  apply_lambda (fun=0x555557654ccd, args=<optimized out>, count=...) at 
eval.c:3109
#4  0x00005555557679e6 in eval_sub (form=<optimized out>) at eval.c:2588
#5  0x000055555576800d in Fprogn (body=0x555557678033) at eval.c:436
#6  0x0000555555767cf2 in eval_sub (form=<optimized out>) at eval.c:2449
#7  0x000055555576a2b9 in internal_lisp_condition_case (var=0x927910, 
bodyform=0x555557677753, handlers=<optimized out>) at eval.c:1428
#8  0x0000555555767cf2 in eval_sub (form=<optimized out>) at eval.c:2449
#9  0x00005555557688bd in Fprogn (body=0x0) at eval.c:436
#10 Fif (args=<optimized out>) at eval.c:392
#11 Fif (args=<optimized out>) at eval.c:378
#12 0x0000555555767cf2 in eval_sub (form=<optimized out>) at eval.c:2449
#13 0x000055555576800d in Fprogn (body=0x5555576b4ee3) at eval.c:436
#14 0x0000555555767cf2 in eval_sub (form=<optimized out>) at eval.c:2449
#15 0x000055555576a2b9 in internal_lisp_condition_case (var=0x927910, 
bodyform=0x5555576ad993, handlers=<optimized out>) at eval.c:1428
#16 0x0000555555767cf2 in eval_sub (form=<optimized out>) at eval.c:2449
#17 0x000055555578f800 in readevalloop_eager_expand_eval (val=0x0, 
macroexpand=0xffffbffff97a1430) at /mnt/sdc1/tmp/emacs/src/lisp.h:1516
#18 0x0000555555797a7b in readevalloop (readcharfun=0x555555f7ecad, 
infile0=0x0, sourcename=0x55555618c784, printflag=false, unibyte=<optimized 
out>, readfun=0x0, start=0x0,
    end=0x0) at lread.c:2347
#19 0x0000555555798cfc in Feval_buffer (buffer=<optimized out>, printflag=0x0, 
filename=0x55555618c784, unibyte=0x0, do_allow_print=0x30) at lread.c:2420
#20 0x00005555557ab3e7 in exec_byte_code (fun=<optimized out>, 
args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>) at 
bytecode.c:809
#21 0x0000555555763f63 in Ffuncall (nargs=nargs@entry=5, 
args=args@entry=0x7fffffffdae0) at eval.c:2995
#22 0x0000555555798a9d in call4 (arg4=0x30, arg3=0x30, arg2=0x55555618c784, 
arg1=0x55555618c784, fn=<optimized out>) at /mnt/sdc1/tmp/emacs/src/lisp.h:3269
#23 Fload (file=<optimized out>, noerror=0xffffbffff9503bb0, 
nomessage=0xffffbffff9503ab0, nosuffix=<optimized out>, must_suffix=<optimized 
out>) at lread.c:1484
#24 0x00005555557ab3e7 in exec_byte_code (fun=<optimized out>, 
args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>) at 
bytecode.c:809
#25 0x0000555555769387 in apply_lambda (fun=0x15554f4bac2d, args=<optimized 
out>, count=...) at eval.c:3103
#26 0x00005555557679e6 in eval_sub (form=<optimized out>) at eval.c:2588
#27 0x000055555576a4b7 in Feval (form=0x15554f8f188b, lexical=<optimized out>) 
at eval.c:2361
#28 0x0000555555762627 in internal_condition_case 
(bfun=bfun@entry=0x5555556d5510 <top_level_2>, handlers=handlers@entry=0x90, 
hfun=hfun@entry=0x5555556dcd10 <cmd_error>)
    at eval.c:1474
#29 0x00005555556d5ee6 in top_level_1 (ignore=ignore@entry=0x0) at 
keyboard.c:1141
#30 0x0000555555762581 in internal_catch (tag=tag@entry=0xffc0, 
func=func@entry=0x5555556d5ec0 <top_level_1>, arg=arg@entry=0x0) at eval.c:1197
#31 0x00005555556d548f in command_loop () at keyboard.c:1101
#32 0x00005555556dc894 in recursive_edit_1 () at keyboard.c:711
#33 0x00005555556dcc1c in Frecursive_edit () at keyboard.c:794
#34 0x00005555555aa4bd in main (argc=<optimized out>, argv=<optimized out>) at 
emacs.c:2529

(gdb) xbacktrace
"pdf-tools-install-noverify" (0x4ed262b8)
"pdf-tools-install" (0xffffd120)
"progn" (0xffffd2a0)
"condition-case" (0xffffd400)
"if" (0xffffd4e0)
"progn" (0xffffd5c0)
"condition-case" (0xffffd720)
"eval-buffer" (0x4ed26248)
"load-with-code-conversion" (0xffffdae8)
"load" (0x4ed26168)
"startup--load-user-init-file" (0x4ed260c0)
"command-line" (0x4ed26040)
"normal-top-level" (0xffffdc50)



In GNU Emacs 29.0.60 (build 1, x86_64-pc-linux-gnu, GTK+ Version
 3.24.34, cairo version 1.16.0) of 2023-02-13 built on foo.bar.com
Repository revision: a4aa32bdfff7aaf54efbacbb04b7f2b52fef92a7
Repository branch: HEAD
System Description: Gentoo/Linux

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GSETTINGS HARFBUZZ JPEG JSON
LCMS2 LIBXML2 MODULES NOTIFY INOTIFY PDUMPER PNG RSVG SECCOMP SOUND
SQLITE3 THREADS TIFF TOOLKIT_SCROLL_BARS TREE_SITTER WEBP X11 XDBE XIM
XINPUT2 XPM GTK3 ZLIB


-- 
        Istvan