Re: editfns.c (Fformat): fix for segfault

[Jim Meyering <jim@meyering.net>]

Richard Stallman <rms@gnu.org> wrote:
> The only way that the value of format should be so different
> from format_start, and yet with the same text, is if
> there was a GC and it moved the string.
>
> I don't see what could possibly have caused a GC there.
> It would have to be something that calls eval.
>
> If it was really due to a GC, I have doubts that this change is
> enough, because the old location of the string could get overwritten
> with some other string.  Perhaps it will happen just a minority of the
> time, but it can happen.
>
> I added a facility to make Emacs abort if it GCs in the middle
> of that code.  That way we will really get to the bottom of this.
>
>     This is my analysis.  In the first scan, Fchar_to_string or
>     Fprint1_to_string are called, and they will relocate a data
>     of a Lisp string (in the current case, args[0]).
>
> How can either of these functions cause a GC?

Using emacs checked out and built this morning along
with Oort gnus 0.20, that new abort was triggered.

Do you need any more information than the following?

(gdb) r
Starting program: /t/emacs/src/emacs -f gnus-no-server

Program received signal SIGABRT, Aborted.
0x402e2a41 in kill () from /lib/libc.so.6
(gdb) xbacktrace
"format"
"nnmail-generate-active"
"nnmail-save-active"
"nnmail-get-new-mail"
"nnml-request-scan"
"gnus-request-scan"
"gnus-activate-group"
"gnus-get-unread-articles"
"gnus-group-get-new-news"
"call-interactively"
(gdb) w
#0  0x402e2a41 in kill () from /lib/libc.so.6
#1  0x080fefdd in abort () at /mirror/d/emacs/src/emacs.c:412
#2  0x0815f135 in Fgarbage_collect () at /mirror/d/emacs/src/alloc.c:4103
#3  0x08179a9e in Ffuncall (nargs=3, args=0xbfffd910)
    at /mirror/d/emacs/src/eval.c:2664
#4  0x081798a6 in run_hook_list_with_args (funlist=1490478012, nargs=3,
    args=0xbfffd910) at /mirror/d/emacs/src/eval.c:2446
#5  0x0812ad24 in signal_before_change (start_int=1, end_int=1,
    preserve_ptr=0x0) at /mirror/d/emacs/src/insdel.c:2058
#6  0x0812aa5a in prepare_to_modify_buffer (start=1, end=1, preserve_ptr=0x0)
    at /mirror/d/emacs/src/insdel.c:1956
#7  0x081286f8 in insert_1_both (
    string=0x9271ba0 "u\\.seq<@eailebsdÌ=ø\bÀc\0378¬\e'\tÀc\0378´\e'\tÀc\0378¼\e'
\tÀc\0378Ä\e'\tÀc\0378Ì\e'\tÀc\0378Ô\e'\tÀc\0378Ü\e'\tÀc\0378ä\e'\tÀc\0378ì\e'\tÀ
c\0378ô\e'\tÀc\0378ü\e'\tÀc\0378\004\034'\tÀc\0378\f\034'\tÀc\0378\024\034'\tÀc\0
378\034\034'\tÀc\0378$\034'\tÀc\0378,\034'\tÀc\03784\034'\tÀc\0378<\034'\tÀc\0378
D\034'\tÀc\0378L\034'\tÀc\0378T\034'\tÀc\0378"..., nchars=6, nbytes=6,
    inherit=0, prepare=1, before_markers=0) at /mirror/d/emacs/src/insdel.c:1001
#8  0x0818c010 in Fprin1_to_string (object=411432292, noescape=405896804)
    at /mirror/d/emacs/src/print.c:775
#9  0x08171690 in Fformat (nargs=4, args=0xbfffdc24)
    at /mirror/d/emacs/src/editfns.c:3353
#10 0x08179c3c in Ffuncall (nargs=5, args=0xbfffdc20)
    at /mirror/d/emacs/src/eval.c:2705
#11 0x081b1b68 in Fbyte_code (bytestr=948814908, vector=1215031136, maxdepth=6)
    at /mirror/d/emacs/src/bytecode.c:709
#12 0x0817a494 in funcall_lambda (fun=1220009168, nargs=1,
    arg_vector=0xbfffdde4) at /mirror/d/emacs/src/eval.c:2911
#13 0x08179edd in Ffuncall (nargs=2, args=0xbfffdde0)
    at /mirror/d/emacs/src/eval.c:2772
#14 0x081b1b68 in Fbyte_code (bytestr=948817620, vector=1215289248, maxdepth=7)
    at /mirror/d/emacs/src/bytecode.c:709
#15 0x0817a494 in funcall_lambda (fun=1220005768, nargs=2,
    arg_vector=0xbfffdfa4) at /mirror/d/emacs/src/eval.c:2911
#16 0x08179edd in Ffuncall (nargs=3, args=0xbfffdfa0)
    at /mirror/d/emacs/src/eval.c:2772
#17 0x081b1b68 in Fbyte_code (bytestr=948766804, vector=1215174384, maxdepth=17)
    at /mirror/d/emacs/src/bytecode.c:709
#18 0x0817a494 in funcall_lambda (fun=1214748208, nargs=4,
    arg_vector=0xbfffe194) at /mirror/d/emacs/src/eval.c:2911
#19 0x08179edd in Ffuncall (nargs=5, args=0xbfffe190)
    at /mirror/d/emacs/src/eval.c:2772
#20 0x081b1b68 in Fbyte_code (bytestr=952458740, vector=1220896832, maxdepth=5)
    at /mirror/d/emacs/src/bytecode.c:709
#21 0x0817a494 in funcall_lambda (fun=1220896976, nargs=2,
    arg_vector=0xbfffe354) at /mirror/d/emacs/src/eval.c:2911
#22 0x08179edd in Ffuncall (nargs=3, args=0xbfffe350)
    at /mirror/d/emacs/src/eval.c:2772
#23 0x081b1b68 in Fbyte_code (bytestr=951599396, vector=1220038872, maxdepth=4)
    at /mirror/d/emacs/src/bytecode.c:709
#24 0x0817a494 in funcall_lambda (fun=1220039048, nargs=2,
    arg_vector=0xbfffe504) at /mirror/d/emacs/src/eval.c:2911
#25 0x08179edd in Ffuncall (nargs=3, args=0xbfffe500)
    at /mirror/d/emacs/src/eval.c:2772
#26 0x081b1b68 in Fbyte_code (bytestr=949718684, vector=1216787184, maxdepth=10)
    at /mirror/d/emacs/src/bytecode.c:709
#27 0x0817a494 in funcall_lambda (fun=1214237616, nargs=2,
    arg_vector=0xbfffe6d4) at /mirror/d/emacs/src/eval.c:2911
#28 0x08179edd in Ffuncall (nargs=3, args=0xbfffe6d0)
    at /mirror/d/emacs/src/eval.c:2772
#29 0x081b1b68 in Fbyte_code (bytestr=949686140, vector=1213293104, maxdepth=9)
    at /mirror/d/emacs/src/bytecode.c:709
#30 0x0817a494 in funcall_lambda (fun=1214365864, nargs=1,
    arg_vector=0xbfffe8a4) at /mirror/d/emacs/src/eval.c:2911
#31 0x08179edd in Ffuncall (nargs=2, args=0xbfffe8a0)
    at /mirror/d/emacs/src/eval.c:2772
#32 0x081b1b68 in Fbyte_code (bytestr=948486652, vector=1219379032, maxdepth=3)
    at /mirror/d/emacs/src/bytecode.c:709
#33 0x0817a494 in funcall_lambda (fun=1219952584, nargs=1,
    arg_vector=0xbfffea84) at /mirror/d/emacs/src/eval.c:2911
#34 0x08179edd in Ffuncall (nargs=2, args=0xbfffea80)
    at /mirror/d/emacs/src/eval.c:2772
#35 0x08175bfd in Fcall_interactively (function=413867092,
    record_flag=405896804, keys=1222607368) at /mirror/d/emacs/src/callint.c:850
#36 0x08110736 in Fcommand_execute (cmd=413867092, record_flag=405896804,
    keys=405896804, special=405896804) at /mirror/d/emacs/src/keyboard.c:9641
---Type <return> to continue, or q <return> to quit---q