bug#18473: 24.4.50; SEGFAULT when vconcatting more than 2048 vectors

[Dmitry Antipov <dmantipov@yandex.ru>]

[-- Attachment #1: Type: text/plain, Size: 1469 bytes --]

On 09/14/2014 09:10 PM, Dmitry Antipov wrote:

> In eval.c:
>
>    2134        else if (XSUBR (fun)->max_args == MANY)
>    2135          {
>    2136            /* Pass a vector of evaluated arguments.  */
>    2137            Lisp_Object *vals;
>    2138            ptrdiff_t argnum = 0;
>    2139            USE_SAFE_ALLOCA;
>    2140
>    2141            SAFE_ALLOCA_LISP (vals, XINT (numargs));
>    2142
>    2143            GCPRO3 (args_left, fun, fun);
>    2144            gcpro3.var = vals;
>    2145            gcpro3.nvars = 0;
>    2146
>    2147            while (!NILP (args_left))
>    2148              {
>    2149                vals[argnum++] = eval_sub (Fcar (args_left));
>    2150                args_left = Fcdr (args_left);
>    2151                gcpro3.nvars = argnum;
>    2152              }
>    2153
>    2154            set_backtrace_args (specpdl_ptr - 1, vals);
>    2155            set_backtrace_nargs (specpdl_ptr - 1, XINT (numargs));
>    2156
>    2157            val = (XSUBR (fun)->function.aMANY) (XINT (numargs), vals);
>    2158            UNGCPRO;
>    2159            SAFE_FREE ();
>    2160          }
>
> At 2141, if numargs is > 2047 (and so allocation size exceeds MAX_ALLOCA on
> a 64-bit system), SAFE_ALLOCA_LISP pushes an entry of type SPECPDL_UNWIND to
> specpdl stack.  At line 2154, set_backtrace_args modifies this entry assuming
> SPECPDL_BACKTRACE.  Oops.

Michael, try this.  Stefan, please review.

Dmitry



[-- Attachment #2: bug18473.patch --]
[-- Type: text/x-diff, Size: 1487 bytes --]

=== modified file 'src/eval.c'
--- src/eval.c	2014-09-02 06:29:01 +0000
+++ src/eval.c	2014-09-15 06:22:26 +0000
@@ -179,17 +179,11 @@
 /* Functions to modify slots of backtrace records.  */
 
 static void
-set_backtrace_args (union specbinding *pdl, Lisp_Object *args)
+set_backtrace_args (union specbinding *pdl, Lisp_Object *args, ptrdiff_t nargs)
 {
   eassert (pdl->kind == SPECPDL_BACKTRACE);
   pdl->bt.args = args;
-}
-
-static void
-set_backtrace_nargs (union specbinding *pdl, ptrdiff_t n)
-{
-  eassert (pdl->kind == SPECPDL_BACKTRACE);
-  pdl->bt.nargs = n;
+  pdl->bt.nargs = nargs;
 }
 
 static void
@@ -2151,8 +2145,7 @@
 	      gcpro3.nvars = argnum;
 	    }
 
-	  set_backtrace_args (specpdl_ptr - 1, vals);
-	  set_backtrace_nargs (specpdl_ptr - 1, XINT (numargs));
+	  set_backtrace_args (backtrace_top (), vals, XINT (numargs));
 
 	  val = (XSUBR (fun)->function.aMANY) (XINT (numargs), vals);
 	  UNGCPRO;
@@ -2173,8 +2166,7 @@
 
 	  UNGCPRO;
 
-	  set_backtrace_args (specpdl_ptr - 1, argvals);
-	  set_backtrace_nargs (specpdl_ptr - 1, XINT (numargs));
+	  set_backtrace_args (backtrace_top (), argvals, XINT (numargs));
 
 	  switch (i)
 	    {
@@ -2919,8 +2911,8 @@
 
   UNGCPRO;
 
-  set_backtrace_args (specpdl_ptr - 1, arg_vector);
-  set_backtrace_nargs (specpdl_ptr - 1, i);
+  set_backtrace_args (backtrace_top (), arg_vector, i);
+
   tem = funcall_lambda (fun, numargs, arg_vector);
 
   /* Do the debug-on-exit now, while arg_vector still exists.  */