bug#72238: 31.0.50; Segfault after treesit_delete_query

bug#72238: 31.0.50; Segfault after treesit_delete_query

[Noah Peart]

[-- Attachment #1: Type: text/plain, Size: 5423 bytes --]

After recent build, emacs is crashing frequently when using tree-sitter
modes.

The following backtrace was generated after opening a few C files,
enabling c-ts-mode, and moving the cursor around a bit. I dont have
precise steps for repeatability at this point (sorry!), as it seems to
occur during garbage collection.

Let me know if there is more useful output I could provide.

$ emacs -Q
Fatal error 11: Segmentation fault
Backtrace:
emacs(emacs_backtrace+0x47)[0x5f9bb9f83338]
emacs(terminate_due_to_signal+0x8f)[0x5f9bb9f5fb40]
emacs(+0x1dc391)[0x5f9bb9f81391]
emacs(+0x1dc3f6)[0x5f9bb9f813f6]
emacs(+0x1dc423)[0x5f9bb9f81423]
/lib/x86_64-linux-gnu/libc.so.6(+0x42520)[0x71c8fe442520]
/usr/local/lib/libtree-sitter.so.0(ts_query_cursor_delete+0x11)[0x71c902abf2c1]
emacs(treesit_delete_query+0x1a)[0x5f9bba078994]
emacs(+0x221b29)[0x5f9bb9fc6b29]
emacs(garbage_collect+0x705)[0x5f9bb9fcb1a2]
emacs(maybe_garbage_collect+0x2a)[0x5f9bb9fcb3c9]
emacs(Ffuncall+0x171)[0x5f9bb9feac4d]
emacs(internal_condition_case_n+0x7d)[0x5f9bb9fe9713]
emacs(+0xb1ec4)[0x5f9bb9e56ec4]
emacs(+0xb1f9d)[0x5f9bb9e56f9d]
emacs(+0xe2468)[0x5f9bb9e87468]
emacs(+0xe265e)[0x5f9bb9e8765e]
emacs(+0xe2517)[0x5f9bb9e87517]
emacs(+0xe265e)[0x5f9bb9e8765e]
emacs(+0xe3732)[0x5f9bb9e88732]
emacs(+0xe59b4)[0x5f9bb9e8a9b4]
emacs(+0xfb9d5)[0x5f9bb9ea09d5]
emacs(+0xfcfa6)[0x5f9bb9ea1fa6]
emacs(internal_condition_case_1+0x68)[0x5f9bb9fe95f8]
emacs(+0xe77ad)[0x5f9bb9e8c7ad]
emacs(redisplay+0xd)[0x5f9bb9e8cd39]
emacs(read_char+0x714)[0x5f9bb9f71d34]
emacs(+0x1cf6ff)[0x5f9bb9f746ff]
emacs(+0x1d21d3)[0x5f9bb9f771d3]
emacs(internal_condition_case+0x5f)[0x5f9bb9fe957a]
emacs(command_loop_2+0x27)[0x5f9bb9f627ef]
emacs(internal_catch+0x3e)[0x5f9bb9fe94ac]
emacs(+0x1bd7a5)[0x5f9bb9f627a5]
emacs(recursive_edit_1+0x69)[0x5f9bb9f67206]
emacs(Frecursive_edit+0xbf)[0x5f9bb9f6756d]
emacs(main+0x1f85)[0x5f9bb9f61b1d]
/lib/x86_64-linux-gnu/libc.so.6(+0x29d90)[0x71c8fe429d90]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80)[0x71c8fe429e40]
emacs(_start+0x25)[0x5f9bb9e3d9c5]
Segmentation fault



In GNU Emacs 31.0.50 (build 1, x86_64-pc-linux-gnu, GTK+ Version
 3.24.33, cairo version 1.16.0) of 2024-07-21 built on noah-X580VD
Repository revision: ccb856189f483abfaa584f428b09a863f816a040
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.12101004
System Description: Ubuntu 22.04.4 LTS

Configured using:
 'configure --prefix=/usr/local --with-modules --with-tree-sitter
 --with-threads --with-x-toolkit=gtk3 --with-xwidgets --with-gnutls
 --with-mailutils --with-jpeg --with-png --with-rsvg --with-tiff
 --with-xml2 --with-xpm --with-imagemagick CC=gcc-12 CXX=gcc-12
 CFLAGS=-ggdb3 CXXFLAGS='

Configured features:
CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ
IMAGEMAGICK JPEG LCMS2 LIBSELINUX LIBXML2 MODULES NATIVE_COMP NOTIFY
INOTIFY PDUMPER PNG RSVG SECCOMP SOUND SQLITE3 THREADS TIFF
TOOLKIT_SCROLL_BARS TREE_SITTER WEBP X11 XDBE XIM XINPUT2 XPM XWIDGETS
GTK3 ZLIB

Important settings:
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  minibuffer-regexp-mode: t
  line-number-mode: t
  indent-tabs-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message mailcap yank-media puny dired
dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg rfc6068
epg-config gnus-util text-property-search time-date subr-x mm-decode
mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader
cl-loaddefs cl-lib sendmail rfc2047 rfc2045 ietf-drums mm-util
mail-prsvr mail-utils rmc iso-transl tooltip cconv eldoc paren electric
uniquify ediff-hook vc-hooks lisp-float-type elisp-mode mwheel
term/x-win x-win term/common-win x-dnd touch-screen tool-bar dnd fontset
image regexp-opt fringe tabulated-list replace newcomment text-mode
lisp-mode prog-mode register page tab-bar menu-bar rfn-eshadow isearch
easymenu timer select scroll-bar mouse jit-lock font-lock syntax
font-core term/tty-colors frame minibuffer nadvice seq simple cl-generic
indonesian philippine cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
composite emoji-zwj charscript charprop case-table epa-hook
jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button loaddefs
theme-loaddefs faces cus-face macroexp files window text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget keymap
hashtable-print-readable backquote threads xwidget-internal dbusbind
inotify lcms2 dynamic-setting system-font-setting font-render-setting
cairo gtk x-toolkit xinput2 x multi-tty move-toolbar
make-network-process native-compile emacs)

Memory information:
((conses 16 49659 12038) (symbols 48 5384 0) (strings 32 13418 2082)
 (string-bytes 1 391638) (vectors 16 9589)
 (vector-slots 8 125589 8356) (floats 8 22 12) (intervals 56 279 0)
 (buffers 992 11))

[-- Attachment #2: Type: text/html, Size: 5907 bytes --]

bug#72238: 31.0.50; Segfault after treesit_delete_query

[john muhl]

Noah Peart <noah.v.peart@gmail.com> writes:

> After recent build, emacs is crashing frequently when using tree-sitter
> modes.
>
> The following backtrace was generated after opening a few C files,
> enabling c-ts-mode, and moving the cursor around a bit. I dont have
> precise steps for repeatability at this point (sorry!), as it seems to
> occur during garbage collection.
>
> Let me know if there is more useful output I could provide.

Could you try reverting 1abf3bdd7ed and see if that helps?

bug#72238: 31.0.50; Segfault after treesit_delete_query

[Yuan Fu]

> On Jul 21, 2024, at 3:24 PM, john muhl <jm@pub.pink> wrote:
> 
> Noah Peart <noah.v.peart@gmail.com> writes:
> 
>> After recent build, emacs is crashing frequently when using tree-sitter
>> modes.
>> 
>> The following backtrace was generated after opening a few C files,
>> enabling c-ts-mode, and moving the cursor around a bit. I dont have
>> precise steps for repeatability at this point (sorry!), as it seems to
>> occur during garbage collection.
>> 
>> Let me know if there is more useful output I could provide.
> 
> Could you try reverting 1abf3bdd7ed and see if that helps?

Hey guys, sorry for the segfault. It’s indeed caused by 1abf3bdd7ed, I just fixed it on master. 

Yuan

bug#72238: 31.0.50; Segfault after treesit_delete_query

[Noah Peart]

[-- Attachment #1: Type: text/plain, Size: 878 bytes --]

Thankyou! No longer seeing segfaults after rebuild.

On Sun, Jul 21, 2024 at 5:01 PM Yuan Fu <casouri@gmail.com> wrote:

>
>
> > On Jul 21, 2024, at 3:24 PM, john muhl <jm@pub.pink> wrote:
> >
> > Noah Peart <noah.v.peart@gmail.com> writes:
> >
> >> After recent build, emacs is crashing frequently when using tree-sitter
> >> modes.
> >>
> >> The following backtrace was generated after opening a few C files,
> >> enabling c-ts-mode, and moving the cursor around a bit. I dont have
> >> precise steps for repeatability at this point (sorry!), as it seems to
> >> occur during garbage collection.
> >>
> >> Let me know if there is more useful output I could provide.
> >
> > Could you try reverting 1abf3bdd7ed and see if that helps?
>
> Hey guys, sorry for the segfault. It’s indeed caused by 1abf3bdd7ed, I
> just fixed it on master.
>
> Yuan

[-- Attachment #2: Type: text/html, Size: 1338 bytes --]

bug#72238: 31.0.50; Segfault after treesit_delete_query

[Eli Zaretskii]

> Cc: Noah Peart <noah.v.peart@gmail.com>, 72238@debbugs.gnu.org
> From: Yuan Fu <casouri@gmail.com>
> Date: Sun, 21 Jul 2024 17:01:31 -0700
> 
> 
> 
> > On Jul 21, 2024, at 3:24 PM, john muhl <jm@pub.pink> wrote:
> > 
> > Noah Peart <noah.v.peart@gmail.com> writes:
> > 
> >> After recent build, emacs is crashing frequently when using tree-sitter
> >> modes.
> >> 
> >> The following backtrace was generated after opening a few C files,
> >> enabling c-ts-mode, and moving the cursor around a bit. I dont have
> >> precise steps for repeatability at this point (sorry!), as it seems to
> >> occur during garbage collection.
> >> 
> >> Let me know if there is more useful output I could provide.
> > 
> > Could you try reverting 1abf3bdd7ed and see if that helps?
> 
> Hey guys, sorry for the segfault. It’s indeed caused by 1abf3bdd7ed, I just fixed it on master. 

Thanks, but I'm confused, since I see a fix both on emacs-30 and on
master.  What exactly did you fix and on which branch(es)?  Did the
problem exist on emacs-30 (it was reported for master)?

bug#72238: 31.0.50; Segfault after treesit_delete_query

[Eli Zaretskii]

Ping!

> Cc: noah.v.peart@gmail.com, jm@pub.pink, 72238@debbugs.gnu.org
> Date: Mon, 22 Jul 2024 14:17:08 +0300
> From: Eli Zaretskii <eliz@gnu.org>
> 
> > Cc: Noah Peart <noah.v.peart@gmail.com>, 72238@debbugs.gnu.org
> > From: Yuan Fu <casouri@gmail.com>
> > Date: Sun, 21 Jul 2024 17:01:31 -0700
> > 
> > 
> > 
> > > On Jul 21, 2024, at 3:24 PM, john muhl <jm@pub.pink> wrote:
> > > 
> > > Noah Peart <noah.v.peart@gmail.com> writes:
> > > 
> > >> After recent build, emacs is crashing frequently when using tree-sitter
> > >> modes.
> > >> 
> > >> The following backtrace was generated after opening a few C files,
> > >> enabling c-ts-mode, and moving the cursor around a bit. I dont have
> > >> precise steps for repeatability at this point (sorry!), as it seems to
> > >> occur during garbage collection.
> > >> 
> > >> Let me know if there is more useful output I could provide.
> > > 
> > > Could you try reverting 1abf3bdd7ed and see if that helps?
> > 
> > Hey guys, sorry for the segfault. It’s indeed caused by 1abf3bdd7ed, I just fixed it on master. 
> 
> Thanks, but I'm confused, since I see a fix both on emacs-30 and on
> master.  What exactly did you fix and on which branch(es)?  Did the
> problem exist on emacs-30 (it was reported for master)?
> 
> 
> 
> 

bug#72238: 31.0.50; Segfault after treesit_delete_query

[Yuan Fu]

> On Jul 22, 2024, at 4:17 AM, Eli Zaretskii <eliz@gnu.org> wrote:
> 
>> Cc: Noah Peart <noah.v.peart@gmail.com>, 72238@debbugs.gnu.org
>> From: Yuan Fu <casouri@gmail.com>
>> Date: Sun, 21 Jul 2024 17:01:31 -0700
>> 
>> 
>> 
>>> On Jul 21, 2024, at 3:24 PM, john muhl <jm@pub.pink> wrote:
>>> 
>>> Noah Peart <noah.v.peart@gmail.com> writes:
>>> 
>>>> After recent build, emacs is crashing frequently when using tree-sitter
>>>> modes.
>>>> 
>>>> The following backtrace was generated after opening a few C files,
>>>> enabling c-ts-mode, and moving the cursor around a bit. I dont have
>>>> precise steps for repeatability at this point (sorry!), as it seems to
>>>> occur during garbage collection.
>>>> 
>>>> Let me know if there is more useful output I could provide.
>>> 
>>> Could you try reverting 1abf3bdd7ed and see if that helps?
>> 
>> Hey guys, sorry for the segfault. It’s indeed caused by 1abf3bdd7ed, I just fixed it on master. 
> 
> Thanks, but I'm confused, since I see a fix both on emacs-30 and on
> master.  What exactly did you fix and on which branch(es)?  Did the
> problem exist on emacs-30 (it was reported for master)?

Yeah, there’re two bugs: 1) we shouldn’t delete the query object without checking for NULL, and 2) we shouldn’t delete the cursor object without checking for NULL. In emacs-30, only query could be NULL, cursor is always initialized; in emacs-master, due to my recent change, both query and cursor could be NULL.

So I added checks for both query and cursor in one commit and pushed to master, and cherry-picked the commit to emacs-30. 

Yuan