bug#29066: 26.0.90; crash in gc involving buffer local symbols

[Eli Zaretskii <eliz@gnu.org>]

> From: Andreas Schwab <schwab@linux-m68k.org>
> Cc: Valentin Gatien-Baron <vgatien-baron@janestreet.com>,  29066@debbugs.gnu.org,  mshinwell@janestreet.com
> Date: Tue, 31 Oct 2017 07:32:14 +0100
> 
> On Okt 31 2017, Eli Zaretskii <eliz@gnu.org> wrote:
> 
> >>            if (!sym->s.gcmarkbit)
> >>              {
> >> -              if (sym->s.redirect == SYMBOL_LOCALIZED)
> >> +              if (sym->s.redirect == SYMBOL_LOCALIZED) {
> >>                  xfree (SYMBOL_BLV (&sym->s));
> >> +                sym->s.val.blv = NULL;
> >> +              }
> >
> > That was my first attempt, but various macros like SYMBOL_BLV and
> > SET_SYMBOL_BLV insist on val.blv being non-NULL.
> 
> SET_SYMBOL_BLV doesn't.

Maybe I'm blind, or misunderstand what you mean, but if the intent was
to do this:

   SET_SYMBOL_BLV (&sym->s, NULL);

then it does:

  INLINE void
  SET_SYMBOL_BLV (struct Lisp_Symbol *sym, struct Lisp_Buffer_Local_Value *v)
  {
    eassume (sym->redirect == SYMBOL_LOCALIZED && v);  <<<<<<<<<<<<<<<<
    sym->val.blv = v;
  }


> And calling SYMBOL_BLV with a freed symbol is a bug anyway.

It isn't freed, it's on the symbol_free_list.  Only its buffer-local
value is freed.