bug#18473: 24.4.50; SEGFAULT when vconcatting more than 2048 vectors

[Dmitry Antipov <dmantipov@yandex.ru>]

On 09/14/2014 06:37 AM, Michael Welsh Duggan wrote:

> With attached foo.el:
>
> emacs -Q -l foo.el
> (testbug 2049)
> C-j
>
> SEGFAULT

Also reproduced in emacs-24 branch (here and below, emacs-24 branch is assumed).

This looks a fundamental bug in eval_sub, probably introduced in r112828.
When compiling with --enable-checking, it gives:

../../emacs-24/src/eval.c:184: Emacs fatal error: assertion failed: pdl->kind == SPECPDL_BACKTRACE

(gdb) bt 10
#0  0x000000000056a602 in terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at ../../emacs-24/src/emacs.c:351
#1  0x00000000005f1d8e in die (msg=0x714b20 "pdl->kind == SPECPDL_BACKTRACE", file=0x714ab8 "../../emacs-24/src/eval.c", line=184)
     at ../../emacs-24/src/alloc.c:6833
#2  0x000000000060c5e6 in set_backtrace_args (pdl=0x1327bc0, args=0x7fffec33e010) at ../../emacs-24/src/eval.c:184
#3  0x0000000000611b76 in eval_sub (form=...) at ../../emacs-24/src/eval.c:2154
#4  0x0000000000611c3d in eval_sub (form=...) at ../../emacs-24/src/eval.c:2170
#5  0x000000000061141b in Feval (form=..., lexical=...) at ../../emacs-24/src/eval.c:2003
#6  0x000000000061347d in Ffuncall (nargs=3, args=0x7fffffffbfa8) at ../../emacs-24/src/eval.c:2818
#7  0x000000000065ce9a in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=0x7fffffffc7e0)
     at ../../emacs-24/src/bytecode.c:916
#8  0x0000000000613c9b in funcall_lambda (fun=..., nargs=1, arg_vector=0x7fffffffc7d8) at ../../emacs-24/src/eval.c:2983
#9  0x0000000000613633 in Ffuncall (nargs=2, args=0x7fffffffc7d0) at ../../emacs-24/src/eval.c:2864
#10 0x000000000065ce9a in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=0x7fffffffd050)
     at ../../emacs-24/src/bytecode.c:916

In eval.c:

   2134        else if (XSUBR (fun)->max_args == MANY)
   2135          {
   2136            /* Pass a vector of evaluated arguments.  */
   2137            Lisp_Object *vals;
   2138            ptrdiff_t argnum = 0;
   2139            USE_SAFE_ALLOCA;
   2140
   2141            SAFE_ALLOCA_LISP (vals, XINT (numargs));
   2142
   2143            GCPRO3 (args_left, fun, fun);
   2144            gcpro3.var = vals;
   2145            gcpro3.nvars = 0;
   2146
   2147            while (!NILP (args_left))
   2148              {
   2149                vals[argnum++] = eval_sub (Fcar (args_left));
   2150                args_left = Fcdr (args_left);
   2151                gcpro3.nvars = argnum;
   2152              }
   2153
   2154            set_backtrace_args (specpdl_ptr - 1, vals);
   2155            set_backtrace_nargs (specpdl_ptr - 1, XINT (numargs));
   2156
   2157            val = (XSUBR (fun)->function.aMANY) (XINT (numargs), vals);
   2158            UNGCPRO;
   2159            SAFE_FREE ();
   2160          }

At 2141, if numargs is > 2047 (and so allocation size exceeds MAX_ALLOCA on
a 64-bit system), SAFE_ALLOCA_LISP pushes an entry of type SPECPDL_UNWIND to
specpdl stack.  At line 2154, set_backtrace_args modifies this entry assuming
SPECPDL_BACKTRACE.  Oops.

Dmitry