bug#23704: 25.1.50; Emacs crash in syntax.c

[Paul Eggert <eggert@cs.ucla.edu>]

[-- Attachment #1: Type: text/plain, Size: 293 bytes --]

Eli Zaretskii wrote:
> I think we need to fix the rest on the release branch as well.

Ah, sorry, I got confused by the phrase "release branch", and thought the phrase 
referred to master instead of to emacs-25. Anyway, attached is a revised patch 
that I think fixes the whole problem.

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-Fix-crash-in-syntax.c-after-GC.patch --]
[-- Type: text/x-diff; name="0001-Fix-crash-in-syntax.c-after-GC.patch", Size: 3029 bytes --]

From 2537a82e008e02fb620223509993c035e9645564 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Mon, 6 Jun 2016 22:37:12 -0700
Subject: [PATCH] Fix crash in syntax.c after GC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem reported by Vincent Belaïche (Bug#23704).
* src/syntax.c (skip_chars): Recompute pointers into the
buffer after every call to update_syntax_table_forward,
as it can GC.
---
 src/syntax.c | 59 ++++++++++++++++++++++++-----------------------------------
 1 file changed, 24 insertions(+), 35 deletions(-)

diff --git a/src/syntax.c b/src/syntax.c
index 16b7fab..6f53684 100644
--- a/src/syntax.c
+++ b/src/syntax.c
@@ -2171,63 +2171,51 @@ skip_syntaxes (bool forwardp, Lisp_Object string, Lisp_Object lim)
     ptrdiff_t start_point = PT;
     ptrdiff_t pos = PT;
     ptrdiff_t pos_byte = PT_BYTE;
-    unsigned char *p = PT_ADDR, *endp, *stop;
-
-    if (forwardp)
-      {
-	endp = (XINT (lim) == GPT) ? GPT_ADDR : CHAR_POS_ADDR (XINT (lim));
-	stop = (pos < GPT && GPT < XINT (lim)) ? GPT_ADDR : endp;
-      }
-    else
-      {
-	endp = CHAR_POS_ADDR (XINT (lim));
-	stop = (pos >= GPT && GPT > XINT (lim)) ? GAP_END_ADDR : endp;
-      }
+    unsigned char *p, *endp, *stop;
 
     immediate_quit = 1;
     SETUP_SYNTAX_TABLE (pos, forwardp ? 1 : -1);
+
     if (forwardp)
       {
-	if (multibyte)
+	while (true)
 	  {
-	    while (1)
+	    p = BYTE_POS_ADDR (pos_byte);
+	    endp = XINT (lim) == GPT ? GPT_ADDR : CHAR_POS_ADDR (XINT (lim));
+	    stop = pos < GPT && GPT < XINT (lim) ? GPT_ADDR : endp;
+
+	    do
 	      {
 		int nbytes;
 
 		if (p >= stop)
 		  {
 		    if (p >= endp)
-		      break;
+		      goto done;
 		    p = GAP_END_ADDR;
 		    stop = endp;
 		  }
-		c = STRING_CHAR_AND_LENGTH (p, nbytes);
+		if (multibyte)
+		  c = STRING_CHAR_AND_LENGTH (p, nbytes);
+		else
+		  c = *p, nbytes = 1;
 		if (! fastmap[SYNTAX (c)])
-		  break;
+		  goto done;
 		p += nbytes, pos++, pos_byte += nbytes;
-		UPDATE_SYNTAX_TABLE_FORWARD (pos);
-	      }
-	  }
-	else
-	  {
-	    while (1)
-	      {
-		if (p >= stop)
-		  {
-		    if (p >= endp)
-		      break;
-		    p = GAP_END_ADDR;
-		    stop = endp;
-		  }
-		if (! fastmap[SYNTAX (*p)])
-		  break;
-		p++, pos++, pos_byte++;
-		UPDATE_SYNTAX_TABLE_FORWARD (pos);
 	      }
+	    while (!parse_sexp_lookup_properties
+		   || pos < gl_state.e_property);
+
+	    update_syntax_table_forward (pos + gl_state.offset,
+					 false, gl_state.object);
 	  }
       }
     else
       {
+	p = BYTE_POS_ADDR (pos_byte);
+	endp = CHAR_POS_ADDR (XINT (lim));
+	stop = pos >= GPT && GPT > XINT (lim) ? GAP_END_ADDR : endp;
+
 	if (multibyte)
 	  {
 	    while (1)
@@ -2269,6 +2257,7 @@ skip_syntaxes (bool forwardp, Lisp_Object string, Lisp_Object lim)
 	  }
       }
 
+  done:
     SET_PT_BOTH (pos, pos_byte);
     immediate_quit = 0;
 
-- 
2.5.5