bug#47067: 28.0.50; [feature/native-comp] Crash while scrolling through dispnew.c

[Eli Zaretskii <eliz@gnu.org>]

> From: Pip Cet <pipcet@gmail.com>
> Date: Sat, 13 Mar 2021 08:53:04 +0000
> Cc: Andrea Corallo <akrl@sdf.org>, 47067@debbugs.gnu.org
> 
> It's c-beginning-of-statement-1 that I think is the immediate caller.

It's nowhere in the C backtrace, only its caller
c-font-lock-cut-off-declarators is.  And I'm not sure we can trust the
C backtrace anyway, given its abnormalities that I cannot explain yet.
In particular, if I put a breakpoint in wrong_type_argument, which
seems to appear in the backtrace, that breakpoint never breaks during
the recipe.

> Can you disassemble the function around 0x09c32285 (or, in another
> dump, whatever calls Flss), particularly the 256 bytes or so before
> that EIP?

Below.  The updated address for the caller of Flss is 0x09d82285,
which is not in any function whose name is known to GDB.

(gdb) bt
#0  0x01236964 in arithcompare_driver (nargs=2, args=0x28, 
    comparison=ARITH_LESS) at data.c:2673
#1  0x01236a3c in Flss (nargs=2, args=0x28) at data.c:2691
#2  0x09d82285 in ?? ()
#3  0x01261a74 in funcall_lambda (fun=XIL(0xa000000000fcb7f8), nargs=5, 
    arg_vector=0x826a08) at eval.c:3292
#4  0x012603c9 in Ffuncall (nargs=6, args=0x826a00) at eval.c:3013
#5  0x09df0dbf in ?? ()
#6  0x012603c9 in Ffuncall (nargs=1, args=0x826bd8) at eval.c:3013
#7  0x09dde041 in ?? ()
#8  0x01261a74 in funcall_lambda (fun=XIL(0xa000000006a5d2c8), nargs=1, 
    arg_vector=0x826db8) at eval.c:3292
#9  0x012603c9 in Ffuncall (nargs=2, args=0x826db0) at eval.c:3013
#10 0x70895b36 in F632d666f6e742d6c6f636b2d6375742d6f66662d6465636c617261746f7273_c_font_lock_cut_off_declarators_0 ()
   from d:\usr\eli\.emacs.d\eln-cache\28.0.50-7d88f6c1\cc-fonts-d7d8a7f5-b7c359cd.eln
#11 0x01261a74 in funcall_lambda (fun=XIL(0xa0000000077a8918), nargs=1, 
    arg_vector=0x827050) at eval.c:3292
#12 0x012603c9 in Ffuncall (nargs=2, args=0x827048) at eval.c:3013
#13 0x068daf93 in ?? ()
#14 0x012dea14 in helper_save_restriction () at comp.c:4575
#15 0x0122eb86 in wrong_type_argument (predicate=XIL(0x892404890c245c89), 
    value=XIL(0x8244c89e45d8be0)) at data.c:143
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Lisp Backtrace:
"c-beginning-of-statement-1" (0x826a08)
"c-just-after-func-arglist-p" (0x826be0)
"c-back-over-member-initializers" (0x826db8)
"c-font-lock-cut-off-declarators" (0x827050)
"font-lock-fontify-keywords-region" (0x8273a8)
"font-lock-default-fontify-region" (0x8276b8)
"c-font-lock-fontify-region" (0x827868)
"font-lock-fontify-region" (0x827a58)
0x6ac13c8 PVEC_COMPILED
"jit-lock--run-functions" (0x8283f0)
"jit-lock-fontify-now" (0x8286b0)
"jit-lock-function" (0x8288d8)
"redisplay_internal (C function)" (0x0)
"sit-for" (0x82e040)
"isearch-lazy-highlight-new-loop" (0x82e320)
"isearch-update" (0x82e620)
"isearch-search-and-update" (0x82e830)
"isearch-process-search-string" (0x82ea58)
"isearch-process-search-char" (0x82ec90)
"isearch-printing-char" (0x82f030)
"funcall-interactively" (0x82f028)
"command-execute" (0x82f598)
(gdb) disassemble 0x9d82100,+0x200
Dump of assembler code from 0x9d82100 to 0x9d82300:
   0x09d82100:	mov    %edx,-0xe4(%ebp)
   0x09d82106:	mov    0x9e87564,%edx
   0x09d8210c:	mov    %eax,-0xe0(%ebp)
   0x09d82112:	mov    -0x100(%ebp),%eax
   0x09d82118:	mov    %edx,-0xdc(%ebp)
   0x09d8211e:	mov    %eax,0x4(%esp)
   0x09d82122:	call   *0xd84(%ebx)
   0x09d82128:	mov    %eax,-0xf0(%ebp)
   0x09d8212e:	mov    %edx,-0xec(%ebp)
   0x09d82134:	mov    %eax,(%esp)
   0x09d82137:	mov    %edx,0x4(%esp)
   0x09d8213b:	call   *0xad8(%ebx)
   0x09d82141:	mov    %eax,-0xf0(%ebp)
   0x09d82147:	mov    %edx,-0xec(%ebp)
   0x09d8214d:	call   *0xab0(%ebx)
   0x09d82153:	jmp    0x9d80934
   0x09d82158:	lea    0x0(%esi,%eiz,1),%esi
   0x09d8215f:	nop
   0x09d82160:	mov    0x9e87b50,%eax
   0x09d82165:	mov    0x9e87b54,%edx
   0x09d8216b:	mov    %eax,-0xf0(%ebp)
   0x09d82171:	mov    0x9e87aa0,%eax
   0x09d82176:	mov    %edx,-0xec(%ebp)
   0x09d8217c:	mov    0x9e87aa4,%edx
   0x09d82182:	mov    %eax,(%esp)
   0x09d82185:	mov    %edx,0x4(%esp)
   0x09d82189:	call   *0x1358(%ebx)
   0x09d8218f:	movl   $0x4,(%esp)
   0x09d82196:	mov    %eax,-0xe8(%ebp)
   0x09d8219c:	mov    0x9e875f0,%eax
   0x09d821a1:	mov    %edx,-0xe4(%ebp)
   0x09d821a7:	mov    0x9e875f4,%edx
   0x09d821ad:	mov    %eax,-0xe0(%ebp)
   0x09d821b3:	mov    %eax,-0xd8(%ebp)
   0x09d821b9:	mov    -0x100(%ebp),%eax
   0x09d821bf:	mov    %edx,-0xdc(%ebp)
   0x09d821c5:	mov    %edx,-0xd4(%ebp)
   0x09d821cb:	mov    %eax,0x4(%esp)
   0x09d821cf:	call   *0xd84(%ebx)
   0x09d821d5:	mov    0x9e8a750,%ecx
   0x09d821db:	mov    %eax,-0xf0(%ebp)
   0x09d821e1:	mov    (%ecx),%ecx
   0x09d821e3:	mov    %edx,-0xec(%ebp)
   0x09d821e9:	mov    0x54(%ecx),%esi
   0x09d821ec:	mov    0x20(%esi),%esi
   0x09d821ef:	mov    %esi,0x54(%ecx)
   0x09d821f2:	jmp    0x9d808b2
   0x09d821f7:	lea    0x0(%esi,%eiz,1),%esi
   0x09d821fe:	xchg   %ax,%ax
   0x09d82200:	mov    0x9e87950,%eax
   0x09d82205:	mov    0x9e87954,%edx
   0x09d8220b:	mov    %eax,(%esp)
   0x09d8220e:	mov    %edx,0x4(%esp)
   0x09d82212:	call   *0x1358(%ebx)
   0x09d82218:	mov    %edx,-0xec(%ebp)
   0x09d8221e:	or     %eax,%edx
   0x09d82220:	mov    %eax,-0xf0(%ebp)
   0x09d82226:	je     0x9d82308
   0x09d8222c:	mov    0x9e87690,%eax
   0x09d82231:	mov    0x9e87694,%edx
   0x09d82237:	mov    %eax,(%esp)
   0x09d8223a:	mov    %edx,0x4(%esp)
   0x09d8223e:	call   *0x1358(%ebx)
   0x09d82244:	mov    %eax,-0xf0(%ebp)
   0x09d8224a:	mov    0x9e875a8,%eax
   0x09d8224f:	mov    %edx,-0xec(%ebp)
   0x09d82255:	mov    0x9e875ac,%edx
   0x09d8225b:	mov    %eax,(%esp)
   0x09d8225e:	mov    %edx,0x4(%esp)
   0x09d82262:	call   *0x1358(%ebx)
   0x09d82268:	mov    %edi,0x4(%esp)
   0x09d8226c:	mov    %eax,-0xe8(%ebp)
   0x09d82272:	mov    %edx,-0xe4(%ebp)
   0x09d82278:	movl   $0x2,(%esp)
   0x09d8227f:	call   *0x1318(%ebx)
   0x09d82285:	mov    %edx,-0xec(%ebp)  <<<<<<<<<<<<<<<<<<<<
   0x09d8228b:	or     %eax,%edx
   0x09d8228d:	mov    %eax,-0xf0(%ebp)
   0x09d82293:	jne    0x9d82308
   0x09d82295:	mov    0x9e87690,%eax
   0x09d8229a:	mov    0x9e87694,%edx
   0x09d822a0:	mov    %eax,(%esp)
   0x09d822a3:	mov    %edx,0x4(%esp)
   0x09d822a7:	call   *0x1358(%ebx)
   0x09d822ad:	mov    %eax,-0xf0(%ebp)
   0x09d822b3:	mov    0x9e87988,%eax
   0x09d822b8:	mov    %edx,-0xec(%ebp)
   0x09d822be:	mov    0x9e8798c,%edx
   0x09d822c4:	mov    %eax,(%esp)
   0x09d822c7:	mov    %edx,0x4(%esp)
   0x09d822cb:	call   *0x1358(%ebx)
   0x09d822d1:	mov    %edi,0x4(%esp)
   0x09d822d5:	mov    %eax,-0xe8(%ebp)
   0x09d822db:	mov    %edx,-0xe4(%ebp)
   0x09d822e1:	movl   $0x2,(%esp)
   0x09d822e8:	call   *0x130c(%ebx)
   0x09d822ee:	mov    %edx,-0xec(%ebp)
   0x09d822f4:	or     %eax,%edx
   0x09d822f6:	mov    %eax,-0xf0(%ebp)
   0x09d822fc:	je     0x9d7ee24
End of assembler dump.
(gdb) fr 2
#2  0x09d82285 in ?? ()
(gdb) info registers
eax            0x30                48
ecx            0x6a54fe8           111497192
edx            0x8                 8
ebx            0x187b8c0           25671872
esp            0x826650            0x826650
ebp            0x826778            0x826778
esi            0x4002d2b0          1073926832
edi            0x28                40
eip            0x9d82285           0x9d82285
eflags         0x10216             [ PF AF IF RF ]
cs             0x1b                27
ss             0x23                35
ds             0x23                35
es             0x23                35
fs             0x3b                59
gs             0x0                 0
(gdb) info symbol (0x187b8c0+0x1318)
freloc + 4888 in section .bss of D:\gnu\git\emacs\native-comp\src\emacs.exe