bug#39962: 27.0.90; Crash in Emacs 27.0.90

[Pip Cet <pipcet@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1042 bytes --]

On Sat, Mar 21, 2020 at 9:22 PM Pieter van Oostrum
<pieter-l@vanoostrum.org> wrote:
> Pip Cet <pipcet@gmail.com> writes:
> > On Thu, Mar 19, 2020 at 1:23 PM Pieter van Oostrum
> > <pieter-l@vanoostrum.org> wrote:
> > If you have the time, could you install the patch, start Emacs the
> > same way you did to produce your original crash, and do similar things
> > you did that time? If we're lucky, we'll be getting an assert failure
> > rather than mere corruption.
> >
> With that patch (the latest 0001-more-debugging.patch) Emacs gets extremely slow (about 10 times slower that normal). Also, while it is processing, it becomes completely unresponsive: the cursor becomes an spinning beach ball, it won't even resize the windows, or react to C-g.

That's okay, that's the extra delays to increase the race condition.
I've reduced them by an order of magnitude in this patch.

I've also added more checks for what's one potential erroneous code
path: corruption of the red-black tree we use in conservative stack
marking.

[-- Attachment #2: 0001-even-more-debugging.patch --]
[-- Type: text/x-patch, Size: 4742 bytes --]

From 487c503bbd20ac87111ca3718f9f43405cab488e Mon Sep 17 00:00:00 2001
From: Pip Cet <pipcet@gmail.com>
Date: Sun, 22 Mar 2020 14:58:07 +0000
Subject: [PATCH] even more debugging

---
 src/alloc.c | 46 ++++++++++++++++++++++++++++++++++++++++------
 src/lisp.h  |  2 +-
 2 files changed, 41 insertions(+), 7 deletions(-)

diff --git a/src/alloc.c b/src/alloc.c
index 1c6b664b22..e33fca8c7f 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -234,7 +234,7 @@ #define GC_DEFAULT_THRESHOLD (100000 * word_size)
 
 /* True during GC.  */
 
-bool gc_in_progress;
+volatile bool gc_in_progress;
 
 /* System byte and object counts reported by GC.  */
 
@@ -711,6 +711,8 @@ xmalloc (size_t size)
   if (!val && size)
     memory_full (size);
   MALLOC_PROBE (size);
+  if (val)
+    memset (val, 0xaa, size);
   return val;
 }
 
@@ -970,7 +972,12 @@ lisp_malloc (size_t nbytes, enum mem_type type)
 
 #ifndef GC_MALLOC_CHECK
   if (val && type != MEM_TYPE_NON_LISP)
-    mem_insert (val, (char *) val + nbytes, type);
+    {
+      eassert (!gc_in_progress);
+      gc_in_progress = true;
+      mem_insert (val, (char *) val + nbytes, type);
+      gc_in_progress = false;
+    }
 #endif
 
   MALLOC_UNBLOCK_INPUT;
@@ -1206,7 +1213,12 @@ lisp_align_malloc (size_t nbytes, enum mem_type type)
 
 #ifndef GC_MALLOC_CHECK
   if (type != MEM_TYPE_NON_LISP)
-    mem_insert (val, (char *) val + nbytes, type);
+    {
+      eassert (!gc_in_progress);
+      gc_in_progress = true;
+      mem_insert (val, (char *) val + nbytes, type);
+      gc_in_progress = false;
+    }
 #endif
 
   MALLOC_UNBLOCK_INPUT;
@@ -1301,7 +1313,10 @@ lmalloc (size_t size)
     {
       void *p = malloc (size);
       if (laligned (p, size))
-	return p;
+	{
+	  memset (p, 0x5a, size);
+	  return p;
+	}
       free (p);
       size_t bigger = size + LISP_ALIGNMENT;
       if (size < bigger)
@@ -2842,6 +2857,7 @@ setup_on_free_list (struct Lisp_Vector *v, ptrdiff_t nbytes)
   eassume (header_size <= nbytes);
   ptrdiff_t nwords = (nbytes - header_size) / word_size;
   XSETPVECTYPESIZE (v, PVEC_FREE, 0, nwords);
+  memset (v->contents, 0xa5, nbytes - header_size);
   eassert (nbytes % roundup_size == 0);
   ptrdiff_t vindex = VINDEX (nbytes);
   eassert (vindex < VECTOR_MAX_FREE_LIST_INDEX);
@@ -2857,8 +2873,13 @@ allocate_vector_block (void)
   struct vector_block *block = xmalloc (sizeof *block);
 
 #ifndef GC_MALLOC_CHECK
-  mem_insert (block->data, block->data + VECTOR_BLOCK_BYTES,
-	      MEM_TYPE_VECTOR_BLOCK);
+  {
+    eassert (!gc_in_progress);
+    gc_in_progress = true;
+    mem_insert (block->data, block->data + VECTOR_BLOCK_BYTES,
+		MEM_TYPE_VECTOR_BLOCK);
+    gc_in_progress = false;
+  }
 #endif
 
   block->next = vector_blocks;
@@ -3094,6 +3115,7 @@ sweep_vectors (void)
 #ifndef GC_MALLOC_CHECK
 	  mem_delete (mem_find (block->data));
 #endif
+	  memset (block, 0x55, VECTOR_BLOCK_BYTES);
 	  xfree (block);
 	}
       else
@@ -3139,6 +3161,10 @@ #define VECTOR_ELTS_MAX \
 static struct Lisp_Vector *
 allocate_vectorlike (ptrdiff_t len)
 {
+  eassert (!gc_in_progress);
+  gc_in_progress = true;
+  struct timespec ts = make_timespec (0, 100000);
+  nanosleep (&ts, NULL);
   eassert (0 < len && len <= VECTOR_ELTS_MAX);
   ptrdiff_t nbytes = header_size + len * word_size;
   struct Lisp_Vector *p;
@@ -3174,6 +3200,7 @@ allocate_vectorlike (ptrdiff_t len)
 
   MALLOC_UNBLOCK_INPUT;
 
+  gc_in_progress = false;
   return ptr_bounds_clip (p, nbytes);
 }
 
@@ -4001,6 +4028,9 @@ mem_insert (void *start, void *end, enum mem_type type)
   x->end = end;
   x->type = type;
   x->parent = parent;
+  if (parent && (parent->end >= start ||
+		 parent->start <= end))
+    eassert (0);
   x->left = x->right = MEM_NIL;
   x->color = MEM_RED;
 
@@ -5868,6 +5898,8 @@ garbage_collect (void)
   if (garbage_collection_inhibited)
     return;
 
+  eassert (!gc_in_progress);
+
   /* Record this function, so it appears on the profiler's backtraces.  */
   record_in_backtrace (QAutomatic_GC, 0, 0);
 
@@ -5934,6 +5966,8 @@ garbage_collect (void)
   shrink_regexp_cache ();
 
   gc_in_progress = 1;
+  struct timespec ts = make_timespec (0, 100000);
+  nanosleep (&ts, NULL);
 
   /* Mark all the special slots that serve as the roots of accessibility.  */
 
diff --git a/src/lisp.h b/src/lisp.h
index 8674fe11a6..4c94085170 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -4006,7 +4006,7 @@ #define ALLOCATE_ZEROED_PSEUDOVECTOR(type, field, tag)		       \
 				   PSEUDOVECSIZE (type, field),	       \
 				   VECSIZE (type), tag))
 
-extern bool gc_in_progress;
+extern volatile bool gc_in_progress;
 extern Lisp_Object make_float (double);
 extern void display_malloc_warning (void);
 extern ptrdiff_t inhibit_garbage_collection (void);
-- 
2.25.1