bug#26047: 26.0.50; emacs crash by cl-caff2

bug#26047: 26.0.50; emacs crash by cl-caff2

[Leo Liu]

1. Compile the following t.el file:

(require 'cl-lib)

(put 's 'buf "abcd")
(cl-callf2 cl-concatenate 'string (get 's 'buf) "efg")

(provide 't)

2. Load the compiled t.elc file

Crash on centos7:

Fatal error 11: Segmentation fault
Backtrace:
emacs[0x80e40be]
emacs[0x80ccbfd]
emacs[0x80e2c67]
emacs[0x80e2ebe]
emacs[0x80e2ee6]
[0xf77e0410]
emacs[0x813a17a]
emacs[0x816bffe]
emacs[0x816ddc7]
emacs[0x8139908]
emacs[0x815afc8]
emacs[0x815b42e]
emacs[0x813b1f4]
emacs[0x813a2ac]
emacs[0x816bffe]
emacs[0x8139ebb]
emacs[0x813a22b]
emacs[0x816bffe]
emacs[0x8139ebb]
emacs[0x813a22b]
emacs[0x816bffe]
emacs[0x8139ebb]
emacs[0x813a22b]
emacs[0x81364fb]
emacs[0x813a2ac]
emacs[0x8136e9f]
emacs[0x813a2ac]
emacs[0x816bffe]
emacs[0x8139fdd]
emacs[0x813a22b]
emacs[0x813a387]
emacs[0x80d9b72]
emacs[0x8138afe]
emacs[0x80ccfa4]
emacs[0x8138abb]
emacs[0x80ccf61]
emacs[0x80d116e]
emacs[0x80d146c]
emacs[0x804cc03]
/lib/libc.so.6(__libc_start_main+0xf3)[0xf75869a3]
emacs[0x804db03]
...
Segmentation fault

bug#26047: 26.0.50; emacs crash by cl-caff2

[Andreas Politz]

Below is a slightly simpler test-case and a full back-trace.

Looks like the function byte-compile-inline-expand, which is the value
of cl-concatenate's byte-optimizer property, creates bad byte-code;
because this bug does not occur after setting this property to nil.


#+BEGIN_SRC emacs-lisp
  (require 'cl-lib)
  (cl-concatenate 'string "abcd" "efg")
  (provide 'foo)
#+END_SRC

Save this to foo.el, byte-compile it and start emacs like this

$ emacs -Q -l foo.elc

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
Ffuncall (nargs=2, args=) at eval.c:2761

(gdb) bt
#0  Ffuncall (nargs=2, args=) at eval.c:2761
#1  exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=)
    at bytecode.c:641
#2  Fbyte_code (bytestr=..., vector=..., maxdepth=...) at bytecode.c:321
#3  eval_sub (form=...) at eval.c:2247
#4  readevalloop (readcharfun=..., stream=, sourcename=..., printflag=false, unibyte=..., readfun=..., start=..., end=...) at lread.c:1927
#5  Fload (file=..., noerror=..., nomessage=..., nosuffix=..., must_suffix=...) at lread.c:1332
#6  funcall_subr (subr=<Sload>, numargs=4, args=) at eval.c:2852
#7  Ffuncall (nargs=5, args=) at eval.c:2765
#8  exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=)
    at bytecode.c:641
#9  funcall_lambda (fun=..., nargs=1, arg_vector=) at eval.c:2965
#10 apply_lambda (fun=..., args=..., count=37) at eval.c:2902
#11 eval_sub (form=...) at eval.c:2286
#12 readevalloop_eager_expand_eval (val=..., macroexpand=...) at lread.c:1757
#13 readevalloop (readcharfun=..., stream=, sourcename=..., printflag=false, unibyte=..., readfun=..., start=..., end=...) at lread.c:1925
#14 Feval_buffer (buffer=..., printflag=..., filename=..., unibyte=..., do_allow_print=...)
    at lread.c:1991
#15 funcall_subr (subr=<Seval_buffer>, numargs=5, args=) at eval.c:2852
#16 Ffuncall (nargs=6, args=) at eval.c:2765
#17 exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=)
    at bytecode.c:641
#18 funcall_lambda (fun=..., nargs=4, arg_vector=<pure+196493>) at eval.c:3043
#19 Ffuncall (nargs=5, args=) at eval.c:2767
#20 call4 (fn=..., arg1=..., arg2=..., arg3=..., arg4=...) at eval.c:2652
#21 Fload (file=..., noerror=..., nomessage=..., nosuffix=..., must_suffix=...) at lread.c:1276
#22 funcall_subr (subr=<Sload>, numargs=3, args=) at eval.c:2852
#23 Ffuncall (nargs=4, args=) at eval.c:2765
#24 exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=)
    at bytecode.c:641
#25 funcall_lambda (fun=..., nargs=1, arg_vector=) at eval.c:2965
#26 Ffuncall (nargs=2, args=) at eval.c:2767
#27 exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=)
    at bytecode.c:641
#28 funcall_lambda (fun=..., nargs=0, arg_vector=) at eval.c:2965
#29 Ffuncall (nargs=1, args=) at eval.c:2767
#30 exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=)
    at bytecode.c:641
#31 funcall_lambda (fun=..., nargs=0, arg_vector=) at eval.c:2965
#32 apply_lambda (fun=..., args=..., count=4) at eval.c:2902
#33 eval_sub (form=...) at eval.c:2286
#34 Feval (form=..., lexical=...) at eval.c:2063
#35 top_level_2 () at keyboard.c:1121
#36 internal_condition_case (bfun=<top_level_2>, handlers=..., hfun=<cmd_error>) at eval.c:1324
#37 top_level_1 (ignore=...) at keyboard.c:1129
#38 internal_catch (tag=..., func=<top_level_1>, arg=...) at eval.c:1091
#39 command_loop () at keyboard.c:1090
#40 recursive_edit_1 () at keyboard.c:697
#41 Frecursive_edit () at keyboard.c:768
#42 main (argc=4, argv=) at emacs.c:1688

Lisp Backtrace:
Cannot access memory at address 0x800000dd5608
(gdb) pp args[0]
#<INVALID_LISP_OBJECT 0x7fffffff9cf0>
(gdb) pp args[1]
#<INVALID_LISP_OBJECT 0x0068b154>

-ap

bug#26047: 26.0.50; emacs crash by cl-caff2

[Andreas Politz]

Using git bisect, I narrowed the cause of this down to the following
list of commits, all of which deal with handling byte-code and have a
single author.

----
commit 19cb3985a3795539b51d70625904e95a6e581eef
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 26 01:00:41 2017 +0530

    * lisp/emacs-lisp/bytecomp.el:Use correct size for switch jump-table
commit 4e6140b28324a9a63d54084c920206d00aed094e
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 26 01:02:16 2017 +0530

    * lisp/emacs-lisp/disass.el: Display jump tables for switch.
commit c52a9b6ddd9166571e6bc8bb9426b0267874f9fa
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 26 00:58:36 2017 +0530

    * lisp/emacs-lisp/bytecomp.el: Simplify b-c-cond-valid-obj2-p
commit 6a82d19db18f8480342cc4c1a0ad76c75df41941
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 26 14:28:23 2017 +0530

    * lisp/emacs-lisp/disass.el: Fix spacing while showing jump tables
commit 8189b97e5ca12aff8ea34617431a868010643b5b
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 26 00:57:10 2017 +0530

    * lisp/emacs-lisp/bytecomp.el: Fix byte-switch codegen with symbols.
commit 0d3c57dcf3187864c0b6fd6115ee80ad33faf553
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 26 00:54:59 2017 +0530

    * lisp/emacs-lisp/byte-opt.el: Add support for decompiling switch
    
    * lisp/emacs-lisp/byte-opt.el: (byte-decompile-bytecode-1) When the
      constant encountered precedes a byte-switch op, replace all the
      addresses in the jump table with tags.
commit a7e4870f165e9fd36d5cfcabb19b215b94373602
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 26 14:31:16 2017 +0530

    * lisp/emacs-lisp/bytecomp.el: Use correct function to push nil
    
    * lisp/emacs-lisp/bytecomp.el: (byte-compile-cond-jump-table) Use
      byte-compile-constant instead of byte-compile-form to push nil.
commit 23a130ee0d61fc39cee157921679809017a02b39
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sat Jan 21 11:37:20 2017 +0530

    * lisp/emacs-lisp/bytecomp.el: Remove unused debugging statements.
commit 25d38a06eceb0853190a2d9acf53d85686f524bd
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 26 23:03:02 2017 +0530

    * lisp/emacs-lisp/bytecomp.el:(bc-cond-jump-table-info)add docstring
commit bf7f7c0d82a56ed1b76358657e74ca2833b19fe2
Merge: 25d38a06ec 9c4dfdd1af
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Mon Jan 30 18:35:43 2017 +0530

    Merge remote-tracking branch 'origin/master' into feature/byte-switch
commit fbe6b90b0ced594cf74d5fd0dc9a32666f0d7d38
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 19 23:13:53 2017 +0530

    * lisp/emacs-lisp/bytecomp.el: Fix errors with matching quoted forms
    
    * lisp/emacs-lisp/bytecomp.el: (byte-compile-cond-jump-table-info)
      eval obj2 to avoid quoted forms being stored as is.
commit 5f3379b33866ff7dc16856b6c29712eae860af0e
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 19 23:13:13 2017 +0530

    lisp/emacs-lisp/bytecomp.el: Use byte-switch only for quoted symbols
commit f441451658ecb8d0d8ba386d9fd3eebf3b17d549
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Mon Jan 30 19:22:09 2017 +0530

    * lisp/emacs-lisp/bytecomp.el: Create jump tables with :purecopy t
commit 46193d5209780d21b848374d8c377fb6c8896d1b
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 19 23:12:09 2017 +0530

    * lisp/emacs-lisp/bytecomp.el: Add default-case for last cond clause.
    
    * lisp/emacs-lisp/bytecomp.el: (byte-compile-cond-jump-table) Add
    default-case for last cond clause.
commit bfa88520136dd6b187ba101e6db5a5f8f0d5e874
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Wed Feb 1 18:15:59 2017 +0530

    Use maphash instead of cl-loop.
    
    * lisp/emacs-lisp/bytecomp.el: (byte-compile-lapcode) Use maphash
      instead of cl-loop
commit 522f16dac945eee351cefb066af40f0d1a683f38
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 19 18:35:46 2017 +0530

    Add type checking for Bswitch, when enabled at compile time.
    
    * src/bytecode.c: (exec_byte_code) If BYTE_CODE_SAFE is enabled at
      compile time, use CHECK_TYPE to verify that the jump table is a hash table.
commit de456d1e4a1d7e34be6d040e0d8a04c42b14e62e
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Fri Feb 3 23:23:28 2017 +0530

    Revert "Use maphash instead of cl-loop."
    
    This reverts commit bfa88520136dd6b187ba101e6db5a5f8f0d5e874.
commit 1fcbd352f8116aca1ecdb62e84f3d86b89bc446f
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Thu Jan 19 18:02:40 2017 +0530

    Use byte-switch for all symbols.
    
    * lisp/emacs-lisp/bytecomp.el: (byte-compile-cond-valid-obj2-p) Return
      t for all symbols (instead for just keywords)
commit 44c95c58b26b7b9d75965a83930ec3d77ffae28f
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Feb 5 15:37:43 2017 +0530

    bytecomp.el: Don't store non-keyword symbols in jump-tables.
    
    * lisp/emacs-lisp/bytecomp.el (byte-compile-cond-valid-obj2-p) return
      nil when OBJ is a non-keyword symbol (i.e a variable), as the jump
      table can only be used when comparing variables with constant values.
commit 086c4eaf9d4ecc5074088115fa01c0b2fb061246
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Wed Jan 18 22:40:50 2017 +0530

    * src/bytecode.c: (exec_byte_code) Use hash_lookup for Bswitch
    
    Fgethash type checks the provided table object, which is unnecessary
    for compiled bytecode.
commit 84eef501554324b22c7a838aabed77aa79315121
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Feb 5 18:49:24 2017 +0530

    byte-opt.el: Replace jump tables while decompiling correctly.
    
    * lisp/emacs-lisp/byte-opt.el (byte-decompile-bytecode-1):
      Don't make a copy of the constant vector, as it isn't used with
      the decompiled lapcode.
      Make sure that the correct lapcode pair/list is being modified while
      replacing the jump table.
commit 37956463d67795819fe7d8fe02d6249388364783
Merge: 309b46420e fd6b829d91
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Mon Jan 16 19:49:24 2017 +0530

    update branch
commit fea1ad36a0f7b1538984ab0f077095a53c570aa4
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Feb 5 18:55:45 2017 +0530

    ; * byte-opt.el (byte-decompile-bytecode-1): Add more documentation.
commit 309b46420e83826ed1e0b947f98a47e8525e3c36
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Jan 15 21:38:31 2017 +0530

    * lisp/emacs-lisp/byte-opt.el: Optimize how tags are checked for use.
    
    * byte-opt.el: (byte-optimize-lapcode): Return nil instantly on
      finding the tag in a jump table.
commit cadb044fc2e69266308cdcabe6181be0f624b484
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Feb 5 19:23:53 2017 +0530

    bytecomp.el: Inline lapcode containing `byte-switch' correctly.
    
    * lisp/emacs-lisp/bytecomp.el (byte-compile-inline-lapcode):
      Restore value of byte-compile-depth after emitting a jump to a tag
      in a jump table, or default/done tags.
      Set the depth of final tags for byte-switch to nil after emitting
      any jumps to them.
commit 490fc5a5029c0d8e527a0c7f423ba83fd6afda60
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Feb 5 21:48:27 2017 +0530

    ; bytecomp.el (-inline-lapcode): Fix incorrect parenthesis, refactor
commit 8c0f326ea237e8acd03c51c1b3a44d237c044562
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Jan 15 19:36:26 2017 +0530

    * lisp/emacs-lisp/bytecomp.el: Add documentation, remove code duplication
commit 382f6603ad4ba2a69b3961bdc68580ce77d222f9
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Feb 5 21:51:05 2017 +0530

    ; Fix typo.
    
    * lisp/emacs-lisp/bytecomp.el (byte-compile-cond-jump-table-info): Fix
      typo in docstring.
commit 88549ec38e9bb30e338a9985d0de4e6263b40fb7
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Jan 15 01:26:04 2017 +0530

    Add new 'switch' byte-code.
    
    'switch' takes two arguments from the stack: the variable to test, and
    a jump table (implemented as a hash-table with the appropriate :test
    function). By looking up the value of the variable in the hash table,
    the interpreter can jump to the label pointed to by the value, if any.
    This implementation can only be used for `cond' forms of the type
    `(cond ((test x 'foo) 'bar) ...)`, such that the function `test` and
    variable `x` is same for all clauses.
    
    * lisp/emacs-lisp/bytecomp.el:
    
      * Add (byte-compile-cond-valid-obj2-p), (byte-compile-cond-vars),
        (byte-compile-cond-jump-table-info), (byte-compile-jump-table-add-tag),
        (byte-compile-cond-jump-table), byte-compile-jump-tables.
    
      * Add defcustom `byte-compile-cond-use-jump-table'.
    
      * (byte-compile-cond): Use them.
    
      * (byte-compile-lapcode): Patch tags present in jump tables, if any.
    
    * lisp/emacs-lisp//byte-opt.el: (byte-optimize-lapcode): Add checks to
      some peephole optimizations to prevent them from messing up any code
      involving `byte-switch`.
    
    * src/bytecode.c: (exec_byte_code): Add bytecode Bswitch.
commit 74a3423b0b92b80d84f6de62d1f2d61c21e4bd90
Author: Vibhav Pant <vibhavp@gmail.com>
Date:   Sun Feb 5 22:10:22 2017 +0530

    * byte-opt.el (byte-decompile-bytecode-1): Use eq instead of =.

----
-ap

bug#26047: 26.0.50; emacs crash by cl-caff2

[Vibhav Pant]

Yes, I've been investigating for some time. For now, a workaround
would be to set byte-compile-cond-use-jump-table to nil before
compiling.

Thanks,
Vibhav

On Tue, Mar 14, 2017 at 11:37 PM, Andreas Politz
<politza@hochschule-trier.de> wrote:
>
> Using git bisect, I narrowed the cause of this down to the following
> list of commits, all of which deal with handling byte-code and have a
> single author.
>
> ----
> commit 19cb3985a3795539b51d70625904e95a6e581eef
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 26 01:00:41 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el:Use correct size for switch jump-table
> commit 4e6140b28324a9a63d54084c920206d00aed094e
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 26 01:02:16 2017 +0530
>
>     * lisp/emacs-lisp/disass.el: Display jump tables for switch.
> commit c52a9b6ddd9166571e6bc8bb9426b0267874f9fa
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 26 00:58:36 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el: Simplify b-c-cond-valid-obj2-p
> commit 6a82d19db18f8480342cc4c1a0ad76c75df41941
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 26 14:28:23 2017 +0530
>
>     * lisp/emacs-lisp/disass.el: Fix spacing while showing jump tables
> commit 8189b97e5ca12aff8ea34617431a868010643b5b
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 26 00:57:10 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el: Fix byte-switch codegen with symbols.
> commit 0d3c57dcf3187864c0b6fd6115ee80ad33faf553
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 26 00:54:59 2017 +0530
>
>     * lisp/emacs-lisp/byte-opt.el: Add support for decompiling switch
>
>     * lisp/emacs-lisp/byte-opt.el: (byte-decompile-bytecode-1) When the
>       constant encountered precedes a byte-switch op, replace all the
>       addresses in the jump table with tags.
> commit a7e4870f165e9fd36d5cfcabb19b215b94373602
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 26 14:31:16 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el: Use correct function to push nil
>
>     * lisp/emacs-lisp/bytecomp.el: (byte-compile-cond-jump-table) Use
>       byte-compile-constant instead of byte-compile-form to push nil.
> commit 23a130ee0d61fc39cee157921679809017a02b39
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sat Jan 21 11:37:20 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el: Remove unused debugging statements.
> commit 25d38a06eceb0853190a2d9acf53d85686f524bd
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 26 23:03:02 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el:(bc-cond-jump-table-info)add docstring
> commit bf7f7c0d82a56ed1b76358657e74ca2833b19fe2
> Merge: 25d38a06ec 9c4dfdd1af
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Mon Jan 30 18:35:43 2017 +0530
>
>     Merge remote-tracking branch 'origin/master' into feature/byte-switch
> commit fbe6b90b0ced594cf74d5fd0dc9a32666f0d7d38
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 19 23:13:53 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el: Fix errors with matching quoted forms
>
>     * lisp/emacs-lisp/bytecomp.el: (byte-compile-cond-jump-table-info)
>       eval obj2 to avoid quoted forms being stored as is.
> commit 5f3379b33866ff7dc16856b6c29712eae860af0e
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 19 23:13:13 2017 +0530
>
>     lisp/emacs-lisp/bytecomp.el: Use byte-switch only for quoted symbols
> commit f441451658ecb8d0d8ba386d9fd3eebf3b17d549
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Mon Jan 30 19:22:09 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el: Create jump tables with :purecopy t
> commit 46193d5209780d21b848374d8c377fb6c8896d1b
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 19 23:12:09 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el: Add default-case for last cond clause.
>
>     * lisp/emacs-lisp/bytecomp.el: (byte-compile-cond-jump-table) Add
>     default-case for last cond clause.
> commit bfa88520136dd6b187ba101e6db5a5f8f0d5e874
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Wed Feb 1 18:15:59 2017 +0530
>
>     Use maphash instead of cl-loop.
>
>     * lisp/emacs-lisp/bytecomp.el: (byte-compile-lapcode) Use maphash
>       instead of cl-loop
> commit 522f16dac945eee351cefb066af40f0d1a683f38
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 19 18:35:46 2017 +0530
>
>     Add type checking for Bswitch, when enabled at compile time.
>
>     * src/bytecode.c: (exec_byte_code) If BYTE_CODE_SAFE is enabled at
>       compile time, use CHECK_TYPE to verify that the jump table is a hash table.
> commit de456d1e4a1d7e34be6d040e0d8a04c42b14e62e
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Fri Feb 3 23:23:28 2017 +0530
>
>     Revert "Use maphash instead of cl-loop."
>
>     This reverts commit bfa88520136dd6b187ba101e6db5a5f8f0d5e874.
> commit 1fcbd352f8116aca1ecdb62e84f3d86b89bc446f
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Thu Jan 19 18:02:40 2017 +0530
>
>     Use byte-switch for all symbols.
>
>     * lisp/emacs-lisp/bytecomp.el: (byte-compile-cond-valid-obj2-p) Return
>       t for all symbols (instead for just keywords)
> commit 44c95c58b26b7b9d75965a83930ec3d77ffae28f
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Feb 5 15:37:43 2017 +0530
>
>     bytecomp.el: Don't store non-keyword symbols in jump-tables.
>
>     * lisp/emacs-lisp/bytecomp.el (byte-compile-cond-valid-obj2-p) return
>       nil when OBJ is a non-keyword symbol (i.e a variable), as the jump
>       table can only be used when comparing variables with constant values.
> commit 086c4eaf9d4ecc5074088115fa01c0b2fb061246
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Wed Jan 18 22:40:50 2017 +0530
>
>     * src/bytecode.c: (exec_byte_code) Use hash_lookup for Bswitch
>
>     Fgethash type checks the provided table object, which is unnecessary
>     for compiled bytecode.
> commit 84eef501554324b22c7a838aabed77aa79315121
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Feb 5 18:49:24 2017 +0530
>
>     byte-opt.el: Replace jump tables while decompiling correctly.
>
>     * lisp/emacs-lisp/byte-opt.el (byte-decompile-bytecode-1):
>       Don't make a copy of the constant vector, as it isn't used with
>       the decompiled lapcode.
>       Make sure that the correct lapcode pair/list is being modified while
>       replacing the jump table.
> commit 37956463d67795819fe7d8fe02d6249388364783
> Merge: 309b46420e fd6b829d91
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Mon Jan 16 19:49:24 2017 +0530
>
>     update branch
> commit fea1ad36a0f7b1538984ab0f077095a53c570aa4
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Feb 5 18:55:45 2017 +0530
>
>     ; * byte-opt.el (byte-decompile-bytecode-1): Add more documentation.
> commit 309b46420e83826ed1e0b947f98a47e8525e3c36
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Jan 15 21:38:31 2017 +0530
>
>     * lisp/emacs-lisp/byte-opt.el: Optimize how tags are checked for use.
>
>     * byte-opt.el: (byte-optimize-lapcode): Return nil instantly on
>       finding the tag in a jump table.
> commit cadb044fc2e69266308cdcabe6181be0f624b484
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Feb 5 19:23:53 2017 +0530
>
>     bytecomp.el: Inline lapcode containing `byte-switch' correctly.
>
>     * lisp/emacs-lisp/bytecomp.el (byte-compile-inline-lapcode):
>       Restore value of byte-compile-depth after emitting a jump to a tag
>       in a jump table, or default/done tags.
>       Set the depth of final tags for byte-switch to nil after emitting
>       any jumps to them.
> commit 490fc5a5029c0d8e527a0c7f423ba83fd6afda60
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Feb 5 21:48:27 2017 +0530
>
>     ; bytecomp.el (-inline-lapcode): Fix incorrect parenthesis, refactor
> commit 8c0f326ea237e8acd03c51c1b3a44d237c044562
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Jan 15 19:36:26 2017 +0530
>
>     * lisp/emacs-lisp/bytecomp.el: Add documentation, remove code duplication
> commit 382f6603ad4ba2a69b3961bdc68580ce77d222f9
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Feb 5 21:51:05 2017 +0530
>
>     ; Fix typo.
>
>     * lisp/emacs-lisp/bytecomp.el (byte-compile-cond-jump-table-info): Fix
>       typo in docstring.
> commit 88549ec38e9bb30e338a9985d0de4e6263b40fb7
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Jan 15 01:26:04 2017 +0530
>
>     Add new 'switch' byte-code.
>
>     'switch' takes two arguments from the stack: the variable to test, and
>     a jump table (implemented as a hash-table with the appropriate :test
>     function). By looking up the value of the variable in the hash table,
>     the interpreter can jump to the label pointed to by the value, if any.
>     This implementation can only be used for `cond' forms of the type
>     `(cond ((test x 'foo) 'bar) ...)`, such that the function `test` and
>     variable `x` is same for all clauses.
>
>     * lisp/emacs-lisp/bytecomp.el:
>
>       * Add (byte-compile-cond-valid-obj2-p), (byte-compile-cond-vars),
>         (byte-compile-cond-jump-table-info), (byte-compile-jump-table-add-tag),
>         (byte-compile-cond-jump-table), byte-compile-jump-tables.
>
>       * Add defcustom `byte-compile-cond-use-jump-table'.
>
>       * (byte-compile-cond): Use them.
>
>       * (byte-compile-lapcode): Patch tags present in jump tables, if any.
>
>     * lisp/emacs-lisp//byte-opt.el: (byte-optimize-lapcode): Add checks to
>       some peephole optimizations to prevent them from messing up any code
>       involving `byte-switch`.
>
>     * src/bytecode.c: (exec_byte_code): Add bytecode Bswitch.
> commit 74a3423b0b92b80d84f6de62d1f2d61c21e4bd90
> Author: Vibhav Pant <vibhavp@gmail.com>
> Date:   Sun Feb 5 22:10:22 2017 +0530
>
>     * byte-opt.el (byte-decompile-bytecode-1): Use eq instead of =.
>
> ----
> -ap



-- 
Vibhav Pant
vibhavp@gmail.com

bug#26047: 26.0.50; emacs crash by cl-caff2

[Andreas Politz]

Vibhav Pant <vibhavp@gmail.com> writes:

> Yes, I've been investigating for some time.

OK, thank you.

-ap

bug#26047: 26.0.50; emacs crash by cl-caff2

[Vibhav Pant]

[-- Attachment #1: Type: text/plain, Size: 317 bytes --]

Could you apply this patch, and see if the issue is fixed?

Thanks,
Vibhav

On Wed, Mar 15, 2017 at 12:12 AM, Andreas Politz
<politza@hochschule-trier.de> wrote:
> Vibhav Pant <vibhavp@gmail.com> writes:
>
>> Yes, I've been investigating for some time.
>
> OK, thank you.
>
> -ap



-- 
Vibhav Pant
vibhavp@gmail.com

[-- Attachment #2: fix-inline.patch --]
[-- Type: text/x-patch, Size: 4503 bytes --]

diff --git a/lisp/emacs-lisp/bytecomp.el b/lisp/emacs-lisp/bytecomp.el
index 7cbef8e434..da0a24c614 100644
--- a/lisp/emacs-lisp/bytecomp.el
+++ b/lisp/emacs-lisp/bytecomp.el
@@ -3140,7 +3140,7 @@ byte-compile-inline-lapcode
   ;; lexical-binding, but it's not true in general, and it's not true for
   ;; code output by bytecomp.el with lexical-binding.
   ;; We also restore the value of `byte-compile-depth' and remove TAG depths
-  ;; accordingly when inlining lapcode containing lap-code, exactly as
+  ;; accordingly when inlining lapcode which uses `byte-switch', exactly as
   ;; documented in `byte-compile-cond-jump-table'.
   (let ((endtag (byte-compile-make-tag))
         last-jump-tag ;; last TAG we have jumped to
@@ -3148,22 +3148,27 @@ byte-compile-inline-lapcode
         last-constant ;; value of the last constant encountered
         last-switch ;; whether the last op encountered was byte-switch
         switch-tags ;; a list of tags that byte-switch could jump to
+        last-tag ;; last TAG that we have output
+        restore-depth ;; if non-nil, `byte-compile-depth' is set to `last-depth'
         ;; a list of tags byte-switch will jump to, if the value doesn't
         ;; match any entry in the hash table
         switch-default-tags)
     (dolist (op lap)
       (cond
        ((eq (car op) 'TAG)
-        (when (or (member op switch-tags) (member op switch-default-tags))
+        (when (or restore-depth
+                  (member op switch-tags)
+                  (member op switch-default-tags))
           ;; This TAG is used in a jump table, this means the last goto
           ;; was to a done/default TAG, and thus it's cddr should be set to nil.
           (when last-jump-tag
             (setcdr (cdr last-jump-tag) nil))
           ;; Also, restore the value of `byte-compile-depth' to what it was
-          ;; before the last goto.
+          ;; before the last goto/return.
           (setq byte-compile-depth last-depth
-                last-jump-tag nil))
-        (byte-compile-out-tag op))
+                last-jump-tag nil
+                restore-depth nil))
+        (byte-compile-out-tag (setq last-tag op)))
        ((memq (car op) byte-goto-ops)
         (setq last-depth byte-compile-depth
               last-jump-tag (cdr op))
@@ -3176,7 +3181,15 @@ byte-compile-inline-lapcode
           (setq byte-compile-depth last-depth
                 last-switch nil)))
        ((eq (car op) 'byte-return)
-        (byte-compile-discard (- byte-compile-depth end-depth) t)
+        ;; the byte optimizer replaces some goto's with returns,
+        ;; we check whether the goto replaced was a jump to a
+        ;; switch DONETAG, and set `restore-depth' and
+        ;; `last-depth' accordingly
+        (if (member last-tag switch-tags)
+            (progn (setq last-depth byte-compile-depth
+                         restore-depth t)
+                   (byte-compile-discard 1 t))
+          (byte-compile-discard (- byte-compile-depth end-depth) t))
         (byte-compile-goto 'byte-goto endtag))
        (t
         (when (eq (car op) 'byte-switch)
@@ -4031,6 +4044,7 @@ byte-compile-cond-jump-table-info
 The condition for each clause is of the form (TEST VAR VALUE).
 VAR is a variable.
 TEST and VAR are the same throughout all conditions.
+TEST is either eq, eql or equal.
 VALUE satisfies `macroexp-const-p'.
 
 Return a list of the form ((TEST . VAR)  ((VALUE BODY) ...))"
@@ -4082,7 +4096,7 @@ byte-compile-cond-jump-table
             donetag (byte-compile-make-tag))
       ;; The structure of byte-switch code:
       ;;
-      ;; varref var
+      ;; varref var/stack-ref <n>
       ;; constant #s(hash-table purecopy t data (val1 (TAG1) val2 (TAG2)))
       ;; switch
       ;; goto DEFAULT-TAG
@@ -4092,9 +4106,9 @@ byte-compile-cond-jump-table
       ;; TAG2
       ;; <clause body>
       ;; goto DONETAG
-      ;; DEFAULT-TAG
+      ;; DEFAULT-TAG:
       ;; <body for `t' clause, if any (else `constant nil')>
-      ;; DONETAG
+      ;; DONETAG:
 
       (byte-compile-variable-ref var)
       (byte-compile-push-constant jump-table)
@@ -4114,6 +4128,8 @@ byte-compile-cond-jump-table
               cases (butlast cases 1)))
 
       (dolist (case cases)
+        ;; TODO: Perhaps use a new tag type (SWITCH-TAG) for this, so we can
+        ;; recognize and deal with switch bytecode/lapcode more easily.
         (setq tag (byte-compile-make-tag)
               test-obj (nth 0 case)
               body (nth 1 case))

bug#26047: 26.0.50; emacs crash by cl-caff2

[Andreas Politz]

Vibhav Pant <vibhavp@gmail.com> writes:

> Could you apply this patch, and see if the issue is fixed?

I'm afraid not.  

Debugger entered--Lisp error: (void-function s)
  s(buf string "abcdefg")
  byte-code("\300\301!\210\302\303\304\305#\210\302\303\304\306\303\304N\307D.\310\267\2027.\311\312.\"\262.\202=.\311\313.\"\262.\202=.\311\314\211.\315\"\"\262.\202=.\316\317.\"\266\205#\210\320\321!\207" [require cl-lib put s buf "abcd" string "efg" #s(hash-table size 3 test eq rehash-size 1.5 rehash-threshold 0.8125 purecopy t data (vector 25 string 34 list 43)) apply vconcat concat append (nil) error "Not a sequence type name: %S" provide byte-code-bug] 12)

-ap

bug#26047: 26.0.50; emacs crash by cl-caff2

[Vibhav Pant]

This is possibly to do with byte-compile-inline-lapcode inlining some
byte-switch lapcode incorrectly. I'll send another patch as soon as I
rewrite it.

Thanks,
Vibhav

On Fri, Mar 17, 2017 at 3:47 PM, Andreas Politz
<politza@hochschule-trier.de> wrote:
> Vibhav Pant <vibhavp@gmail.com> writes:
>
>> Could you apply this patch, and see if the issue is fixed?
>
> I'm afraid not.
>
> Debugger entered--Lisp error: (void-function s)
>   s(buf string "abcdefg")
>   byte-code("\300\301!\210\302\303\304\305#\210\302\303\304\306\303\304N\307D.\310\267\2027.\311\312.\"\262.\202=.\311\313.\"\262.\202=.\311\314\211.\315\"\"\262.\202=.\316\317.\"\266\205#\210\320\321!\207" [require cl-lib put s buf "abcd" string "efg" #s(hash-table size 3 test eq rehash-size 1.5 rehash-threshold 0.8125 purecopy t data (vector 25 string 34 list 43)) apply vconcat concat append (nil) error "Not a sequence type name: %S" provide byte-code-bug] 12)
>
> -ap



-- 
Vibhav Pant
vibhavp@gmail.com

bug#26047: 26.0.50; emacs crash by cl-caff2

[Andreas Politz]

Here is a test case.

(ert-deftest byte-code-optimzier-1 ()
  (let* ((el-file (make-temp-file "test" nil ".el"))
         (elc-file (concat (file-name-sans-extension el-file) ".elc")))
    (unwind-protect
        (let ((byte-compile-warnings t))
          (with-temp-file el-file
            (dolist (form '((require 'cl-lib)
                            (put 's 'buf "abcd")
                            (cl-callf2 cl-concatenate 'string (get 's 'buf) "efg")
                            (provide 't)))
              (insert (prin1-to-string form))
              (insert "\n")))
          (byte-compile-file el-file)
          (should (progn (load-file elc-file) t)))
      (when (file-exists-p el-file)
        (delete-file el-file))
      (when (file-exists-p elc-file)
        (delete-file elc-file)))))

-ap

bug#26047: 26.0.50; emacs crash by cl-caff2

[npostavs]

tags 26047 fixed
close 26047 
quit

Andreas Politz <politza@hochschule-trier.de> writes:

> Here is a test case.
>
> (ert-deftest byte-code-optimzier-1 ()
>   (let* ((el-file (make-temp-file "test" nil ".el"))
>          (elc-file (concat (file-name-sans-extension el-file) ".elc")))
>     (unwind-protect
>         (let ((byte-compile-warnings t))
>           (with-temp-file el-file
>             (dolist (form '((require 'cl-lib)
>                             (put 's 'buf "abcd")
>                             (cl-callf2 cl-concatenate 'string (get 's 'buf) "efg")
>                             (provide 't)))
>               (insert (prin1-to-string form))
>               (insert "\n")))
>           (byte-compile-file el-file)
>           (should (progn (load-file elc-file) t)))
>       (when (file-exists-p el-file)
>         (delete-file el-file))
>       (when (file-exists-p elc-file)
>         (delete-file elc-file)))))
>
> -ap

This seems to be fixed now, I guess by [1: b389379c87].

[1: b389379c87]: 2017-04-20 21:23:08 +0530
  bytecomp: Don't inline functions that use byte-switch (Bug#26518)
  http://git.savannah.gnu.org/cgit/emacs.git/commit/?id=b389379c87481b6bc647ceb4d323f861281cad72