bug#73838: 31.0.50; Problems in note_mouse_highlight if -nw

[Gerd Möllmann]

Gerd Möllmann <gerd.moellmann@gmail.com> writes:

> Eli Zaretskii <eliz@gnu.org> writes:
>
>>> From: Gerd Möllmann <gerd.moellmann@gmail.com>
>>> Cc: 73838@debbugs.gnu.org
>>> Date: Thu, 17 Oct 2024 09:03:13 +0200
>>> 
>>> The immediate problem I'm facing is with tty child frames and
>>> xterm-mouse: I'm opening a buffer selection child frame (consult-buffer)
>>> and choose a candidate with a mouse click. The candidates are
>>> mouse-highlighted. Result is eventually an endless loop in
>>> process_mark_stack in the non-MPS GC. (Not using the mouse works just
>>> fine.)
>>
>> If you can show the details of that, i.e. step through the loop one
>> time until it gets to the same point, maybe someone could have an
>> idea.
>
> It's probably something pretty strange:
>
> I built with ASAN, no MPS but my workaround for the hightlighting, and
> get an error: GC marks char-code-property-alist (staticpro), and hits a
> char-table object that is somehow broken. pdumper-object-p says yes for
> it, but when checking the mark bit of that char-table with
> pdumper_marked_p_impl, ASAN complains about an access outside of the
> bitset being used for the pdumper mark bits.
>
> (Not sure if that's already the loop I see without ASAN.)
>
> Didn't get further than that today. LLDB decided to crash as well at
> some point.
>
> I'm a bit out of ideas how to find out what's up with that char-table.
> Maybe I'll wait a bit until I have an idea how I could find that out.

FWIW, this is also reproducible in scratch/igc by building it without
MPS and with ASAN.

'../src/emacs' -batch --no-site-file --no-site-lisp --eval "(setq 
load-prefer-newer t byte-compile-warnings 'all)" --eval "(setq 
org--inhibit-version-check t)"  -f batch-byte-compile gnus/spam.el
emacs(33650,0x1f4c0f240) malloc: nano zone abandoned due to inability to 
reserve vm space.
=================================================================
ERROR: AddressSanitizer: heap-buffer-overflow on address 0x00010408f87c at pc 
0x000100bc9e54 bp 0x00016f8d11b0 sp 0x00016f8d11a8
READ of size 4 at 0x00010408f87c thread T0
    #0 0x100bc9e50 in dump_bitset_bit_set_p pdumper.c:5401
    #1 0x100bca4ac in pdumper_marked_p_impl pdumper.c:5604
    #2 0x100bb6d70 in pdumper_marked_p pdumper.h:239
    #3 0x100bb239c in vector_marked_p alloc.c:4436
    #4 0x100bb0fec in process_mark_stack alloc.c:7555
    #5 0x100baf538 in mark_object alloc.c:7785
    #6 0x100bbc0e4 in mark_char_table alloc.c:7234
    #7 0x100bb1348 in process_mark_stack alloc.c:7621
    #8 0x100baf538 in mark_object alloc.c:7785
    #9 0x100bae71c in mark_object_root_visitor alloc.c:6682
    #10 0x100bac47c in visit_static_gc_roots alloc.c:6672
    #11 0x100bad420 in garbage_collect alloc.c:6895
...
0x00010408f87c is located 452 bytes after 372408-byte region 
[0x000104034800,0x00010408f6b8)
[1m[0m[1m[35mallocated by thread T0 here:[1m[0m
    #0 0x1032a0fd0 in calloc+0x9c 
(libclang_rt.asan_osx_dynamic.dylib:arm64e+0x54fd0)
    #1 0x100bcc2b8 in dump_bitsets_init pdumper.c:5376
    #2 0x100bcb79c in pdumper_load pdumper.c:6106
    #3 0x1009c10b0 in load_pdump emacs.c:980
    #4 0x1009bbe50 in main emacs.c:1436
    #5 0x19014c270  (<unknown module>)