bug#17168: 24.3.50; Segfault at mark_object

[Dmitry Antipov <dmantipov@yandex.ru>]

[-- Attachment #1: Type: text/plain, Size: 668 bytes --]

On 04/03/2014 01:08 PM, Daniel Colascione wrote:

> Found the bug: that symbol's name is in pure storage, so we ignore the
> value of sym->s.gcmarkbit and assume the symbol is always live: we
> never put it on the free list, so we never set its function slot to
> Vdead. Later, during another GC pass, conservative GC scanning happens
> to find a pointer to the symbol. We begin marking it, descend into the
> function slot, which is still pointing to the old, dead object value. We
> try to mark memory being used for some other purpose and enter la-la land.

What about this workaround? Until we find a better solution,
this should prevent crashes at least.

Dmitry

[-- Attachment #2: bug17168_workaround.patch --]
[-- Type: text/x-patch, Size: 1477 bytes --]

=== modified file 'src/alloc.c'
--- src/alloc.c	2014-04-03 00:37:51 +0000
+++ src/alloc.c	2014-04-03 13:59:58 +0000
@@ -3382,6 +3382,13 @@
 
   CHECK_STRING (name);
 
+  /* If not loadup, avoid symbols with names from pure space.
+     Current GC has problems treating such a symbols - see
+     http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17168.  */
+  if (NILP (Vpurify_flag) && PURE_POINTER_P (XPNTR (name)))
+    name = make_specified_string (SSDATA (name), SCHARS (name),
+				  SBYTES (name), STRING_MULTIBYTE (name));
+
   MALLOC_BLOCK_INPUT;
 
   if (symbol_free_list)
@@ -6174,6 +6181,12 @@
 	  break;
 	CHECK_ALLOCATED_AND_LIVE (live_symbol_p);
 	ptr->gcmarkbit = 1;
+	/* Attempt to catch bogus objects.  In particular, see
+	   http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17168.  */
+	eassert (SYMBOLP (ptr->function)
+		 || CONSP (ptr->function)
+		 || COMPILEDP (ptr->function)
+		 || SUBRP (ptr->function));
 	mark_object (ptr->function);
 	mark_object (ptr->plist);
 	switch (ptr->redirect)
@@ -6601,6 +6614,12 @@
               if (!pure_p)
                 eassert (!STRING_MARKED_P (XSTRING (sym->s.name)));
               sym->s.gcmarkbit = 0;
+	      /* Attempt to catch bogus objects.  In particular, see
+		 http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17168.  */
+	      eassert (SYMBOLP (sym->s.function)
+		       || CONSP (sym->s.function)
+		       || COMPILEDP (sym->s.function)
+		       || SUBRP (sym->s.function));
             }
         }