unofficial mirror of emacs-devel@gnu.org 
 help / color / mirror / code / Atom feed
* Nasty GC bug
@ 2012-08-24  7:26 Dmitry Antipov
  2012-08-24  8:56 ` Paul Eggert
  2012-08-27 13:25 ` Jim Meyering
  0 siblings, 2 replies; 5+ messages in thread
From: Dmitry Antipov @ 2012-08-24  7:26 UTC (permalink / raw)
  To: Emacs development discussions

It looks like live_cons_p (M, P) may be true if P is a cons cell from
the spare_memory[X], X = 1..4. So, mark_maybe_{object, pointer} may
call to mark_object for an uninitialized cons from spare blocks, with
random results (most probably a crash). This is very hard to reproduce
because it depends from the values found on a C stack.

The same looks to be true for live_string_p and spare_memory[5, 6].

Suggested fix is to use MEM_TYPE_NON_LISP for spare memory, e.g.:

=== modified file 'src/alloc.c'
--- src/alloc.c	2012-08-21 23:39:56 +0000
+++ src/alloc.c	2012-08-24 07:23:48 +0000
@@ -3816,22 +3816,22 @@
      spare_memory[0] = malloc (SPARE_MEMORY);
    if (spare_memory[1] == 0)
      spare_memory[1] = lisp_align_malloc (sizeof (struct cons_block),
-						  MEM_TYPE_CONS);
+						  MEM_TYPE_NON_LISP);
    if (spare_memory[2] == 0)
      spare_memory[2] = lisp_align_malloc (sizeof (struct cons_block),
-					 MEM_TYPE_CONS);
+					 MEM_TYPE_NON_LISP);
    if (spare_memory[3] == 0)
      spare_memory[3] = lisp_align_malloc (sizeof (struct cons_block),
-					 MEM_TYPE_CONS);
+					 MEM_TYPE_NON_LISP);
    if (spare_memory[4] == 0)
      spare_memory[4] = lisp_align_malloc (sizeof (struct cons_block),
-					 MEM_TYPE_CONS);
+					 MEM_TYPE_NON_LISP);
    if (spare_memory[5] == 0)
      spare_memory[5] = lisp_malloc (sizeof (struct string_block),
-				   MEM_TYPE_STRING);
+				   MEM_TYPE_NON_LISP);
    if (spare_memory[6] == 0)
      spare_memory[6] = lisp_malloc (sizeof (struct string_block),
-				   MEM_TYPE_STRING);
+				   MEM_TYPE_NON_LISP);
    if (spare_memory[0] && spare_memory[1] && spare_memory[5])
      Vmemory_full = Qnil;
  #endif

Comments?

Dmitry



^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2012-08-27 13:25 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-08-24  7:26 Nasty GC bug Dmitry Antipov
2012-08-24  8:56 ` Paul Eggert
2012-08-24 10:58   ` Dmitry Antipov
2012-08-24 17:25     ` Paul Eggert
2012-08-27 13:25 ` Jim Meyering

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).