bug#61507: 29.0.60; "free(): invalid pointer" on latest emacs-29 commit when loading init.el

bug#61507: 29.0.60; "free(): invalid pointer" on latest emacs-29 commit when loading init.el

[Simon Pugnet]

[-- Attachment #1: Type: text/plain, Size: 14499 bytes --]

Dear Emacs maintainers,

I've just built Emacs from commit 
4bb27a5ca93f8269d9cd4b85fd948176304236eb on the emacs-29 branch and it 
fails to launch with the following message when loading my init.el 
file: -

free(): invalid pointer
Fatal error 6: Aborted

Launching with -q or -Q works fine. Checking out a previous commit 
(cc30422825a5acf460d026bfe912b327b70dedcf) and rebuilding causes 
everything to work as expected again too.

I've tried `make extraclean` and then `make bootstrap` in order to 
clear out any old byte-compiled or native-compiled elisp as I read 
another message earlier saying that a recent change might have caused 
a backwards incompatible change.

Output of `bt full` in GDB: -

#0  0x00007ffff34a08ec in  () at /usr/lib/libc.so.6
#1  0x00007ffff3451ea8 in raise () at /usr/lib/libc.so.6
#2  0x00007ffff343b53d in abort () at /usr/lib/libc.so.6
#3  0x00007ffff343c29e in  () at /usr/lib/libc.so.6
#4  0x00007ffff34aa657 in  () at /usr/lib/libc.so.6
#5  0x00007ffff34ac4bc in  () at /usr/lib/libc.so.6
#6  0x00007ffff34aee63 in free () at /usr/lib/libc.so.6
#7  0x0000555555741685 in xfree (block=<optimized out>) at alloc.c:814
#8  0x000055555577163c in safe_free (sa_count=...) at 
 /storage/Work/personal/emacs/src/lisp.h:5385
        arg_vector = 0x7fffffffcf40
        tem = 0x0
        sa_avail = <optimized out>
        sa_count = {bytes = 1280}
        numargs = 0
        args_left = <optimized out>
#9  apply_lambda (fun=0x55555c64b685, args=<optimized out>, count=...) 
 at eval.c:3109
        arg_vector = 0x7fffffffcf40
        tem = 0x0
        sa_avail = <optimized out>
        sa_count = {bytes = 1280}
        numargs = 0
        args_left = <optimized out>
#10 0x000055555576f922 in eval_sub (form=<optimized out>) at 
 eval.c:2588
        original_fun = 0xd49110
        original_args = 0x0
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x0, 0x555556020633, 0x1, 0x7fffffffd090, 0x2, 
        0x555555779da3 <mapcar1+115>, 0x7fffffffd0a0, 0x2aaa992060c0}
#11 0x0000555555772511 in internal_lisp_condition_case (var=0xfa3690, 
 bodyform=0x55555c2d8383, handlers=<optimized out>) at eval.c:1428
        oldhandlerlist = 0x555555ee3560
        clausenb = 1
        success_handler = 0x0
        clauses = 0x7fffffffd080
        result = 0x555555dc3460 <freloc>
#12 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d7193
        numargs = 3
        original_fun = 0x4f80
        original_args = 0x55555c2d7193
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x4a0, 0x7fffffffd1a8, 0x7fffffffd1a0, 
        0xffe12e80bef3ce00, 0x6, 0x0, 0x1, 0x55555c2d9b95}
#13 0x00005555557702ad in Fprogn (body=0x55555c2d7b93) at eval.c:436
        form = <optimized out>
        val = 0x0
#14 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d71c3
        numargs = 2
        original_fun = 0xd620
        original_args = 0x55555c2d71c3
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x5555560207c3, 0xffe12e80bef3ce00, 
        0x4000000011000000, 0x55555c2d78f3, 0x7fffffffd300, 
        0x55555576ffba <eval_sub+2266>, 0x1, 0x55555c2d7ff0}
#15 0x0000555555772511 in internal_lisp_condition_case (var=0xfa3690, 
 bodyform=0x55555c2d71b3, handlers=<optimized out>) at eval.c:1428
        oldhandlerlist = 0x555555ffbd30
        clausenb = 1
        success_handler = 0x0
        clauses = 0x7fffffffd2b0
        result = 0x55555575901b <Fset_default+11>
#16 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d6c53
        numargs = 3
        original_fun = 0x4f80
        original_args = 0x55555c2d6c53
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x4, 0x55555576c480 <Fapply+256>, 0x7fffef2bd695, 
        0xffe12e80bef3ce00, 0x55555c2cd0e3, 0x2, 0x4c0, 
        0x7fffffffd408}
#17 0x00005555557702ad in Fprogn (body=0x0) at eval.c:436
        form = <optimized out>
        val = 0x6524060
#18 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d6c83
        numargs = 2
        original_fun = 0xd620
        original_args = 0x55555c2d6c83
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x11, 0x1, 0xb, 0x2aaa994558c0, 0x0, 0x2, 
        0x55555c2d8333, 0x555555dc3460 <freloc>}
#19 0x00005555557702ad in Fprogn (body=0x0) at eval.c:436
        form = <optimized out>
        val = 0x0
#20 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d6cb3
        numargs = 1
        original_fun = 0xd620
        original_args = 0x55555c2d6cb3
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x55555c2d8333, 0x7fffeecdd4b9 
        <F696e7465726e616c2d6d6163726f657870616e642d666f722d6c6f6164_internal_macroexpand_for_load_0+233>, 
        0x7fffffff006c, 0x555555dc3460 <freloc>, 0x55555c2d7c23, 
        0xffe12e80bef3ce00, 0x55555c2d6cc3, 0x55555c2d6cd3}
#21 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d6cd3
        numargs = 2
        original_fun = 0x9000
        original_args = 0x55555c2d6cd3
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x2aaa99603200, 0x555556024e88, 0x0, 0x5555557979b8 
        <readevalloop_eager_expand_eval+376>, 0x0, 0xffe12e80bef3ce00, 
        0x2aaa99603200, 0x55555c2d7c23}
#22 0x00005555557a0009 in readevalloop (readcharfun=0x555556024e8d, 
 infile0=0x0, sourcename=0x555556030204, printflag=false, 
 unibyte=<optimized out>, readfun=0x0, start=0x0, end=<optimized out>) 
 at lread.c:2347
        c = <optimized out>
        val = 0x55555c2d8333
        b = <optimized out>
        continue_reading_p = true
        lex_bound = <optimized out>
        whole_buffer = true
        first_sexp = <optimized out>
        macroexpand = 0x2aaa99603200
#23 0x00005555557a12c7 in Feval_buffer (buffer=<optimized out>, 
 printflag=0x0, filename=0x555556030204, unibyte=0x0, 
 do_allow_print=<optimized out>) at lread.c:2420
        tem = <optimized out>
        buf = 0x555556024e8d
#24 0x00007fffeeadb478 in 
 F6c6f61642d776974682d636f64652d636f6e76657273696f6e_load_with_code_conversion_0 
 () at 
 /storage/Work/personal/emacs/src/../native-lisp/29.0.60-349da14f/preloaded/mule-3352613d-1fec1ce7.eln
#25 0x000055555576c266 in Ffuncall (nargs=nargs@entry=5, 
 args=args@entry=0x7fffffffd9c0) at eval.c:2995
        val = <optimized out>
#26 0x00005555557a0f07 in call4 (arg4=0x30, arg3=<optimized out>, 
 arg2=0x555556030204, arg1=<optimized out>, fn=<optimized out>) at 
 /storage/Work/personal/emacs/src/lisp.h:3269
        val = <optimized out>
        stream = 0x0
        fd = 19
        found = 0x555556030204
        efound = <optimized out>
        hist_file_name = 0x555556030204
        newer = false
        compiled = false
        handler = <optimized out>
        fmode = 0x55555585a19c "r"
        version = <optimized out>
        no_native = <optimized out>
        is_module = false
        is_native_elisp = false
        found_eff = <optimized out>
        is_elc = false
        input = {stream = 0x0, lookahead = 0 '\000', buf = 
        "\000\000\000"}
#27 Fload (file=0x555556030084, noerror=<optimized out>, 
 nomessage=<optimized out>, nosuffix=<optimized out>, 
 must_suffix=<optimized out>) at lread.c:1484
        val = <optimized out>
        stream = 0x0
        fd = 19
        found = 0x555556030204
        efound = <optimized out>
        hist_file_name = 0x555556030204
        newer = false
        compiled = false
        handler = <optimized out>
        fmode = 0x55555585a19c "r"
        version = <optimized out>
        no_native = <optimized out>
        is_module = false
        is_native_elisp = false
        found_eff = <optimized out>
        is_elc = false
        input = {stream = 0x0, lookahead = 0 '\000', buf = 
        "\000\000\000"}
#28 0x000055555576c266 in Ffuncall (nargs=4, args=0x7fffffffdb20) at 
 eval.c:2995
        val = <optimized out>
#29 0x00007fffeeb05276 in 
 F737461727475702d2d6c6f61642d757365722d696e69742d66696c65_startup__load_user_init_file_0 
 () at 
 /storage/Work/personal/emacs/src/../native-lisp/29.0.60-349da14f/preloaded/startup-bbc6ea72-476504a2.eln
#30 0x000055555576c266 in Ffuncall (nargs=4, args=0x7fffffffdc10) at 
 eval.c:2995
        val = <optimized out>
#31 0x00007fffeeb07268 in F636f6d6d616e642d6c696e65_command_line_0 () 
 at 
 /storage/Work/personal/emacs/src/../native-lisp/29.0.60-349da14f/preloaded/startup-bbc6ea72-476504a2.eln
#32 0x000055555576c266 in Ffuncall (nargs=1, args=0x7fffffffdce8) at 
 eval.c:2995
        val = <optimized out>
#33 0x00007fffeeb03460 in 
 F6e6f726d616c2d746f702d6c6576656c_normal_top_level_0 () at 
 /storage/Work/personal/emacs/src/../native-lisp/29.0.60-349da14f/preloaded/startup-bbc6ea72-476504a2.eln
#34 0x000055555576ffaf in eval_sub (form=<optimized out>) at 
 eval.c:2495
        i = <optimized out>
        maxargs = <optimized out>
        args_left = <optimized out>
        numargs = 0
        original_fun = 0x2aaa993b5180
        original_args = 0x0
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x7fffffffde00, 0x555555edff73, 0x555555dc3460 
        <freloc>, 0x0, 0x7fffffffddf8, 0x7fffffffde78, 0x7fffffffde70, 
        0x555555dc3460 <freloc>}
#35 0x0000555555772726 in Feval (form=0x7fffef5695ab, 
 lexical=<optimized out>) at eval.c:2361
#36 0x000055555576a8f7 in internal_condition_case 
 (bfun=bfun@entry=0x5555556da400 <top_level_2>, 
 handlers=handlers@entry=0x90, hfun=hfun@entry=0x5555556e19e0 
 <cmd_error>) at eval.c:1474
        val = <optimized out>
        c = 0x5555560490c0
#37 0x00005555556dad86 in top_level_1 (ignore=ignore@entry=0x0) at 
 keyboard.c:1141
#38 0x000055555576a851 in internal_catch (tag=tag@entry=0x10050, 
 func=func@entry=0x5555556dad60 <top_level_1>, arg=arg@entry=0x0) at 
 eval.c:1197
        val = <optimized out>
        c = 0x55555604ae00
#39 0x00005555556da37f in command_loop () at keyboard.c:1101
#40 0x00005555556e1562 in recursive_edit_1 () at keyboard.c:711
        val = <optimized out>
#41 0x00005555556e18f0 in Frecursive_edit () at keyboard.c:794
        buffer = <optimized out>
#42 0x00005555555aca5f in main (argc=1, argv=0x7fffffffe1b8) at 
 emacs.c:2529
        stack_bottom_variable = 0x555555e37a40
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>
        dump_mode = <optimized out>
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>


In GNU Emacs 29.0.60 (build 1, x86_64-pc-linux-gnu, GTK+ Version
 3.24.36, cairo version 1.17.8) of 2023-02-14 built on palenque
Repository revision: 4bb27a5ca93f8269d9cd4b85fd948176304236eb
Repository branch: emacs-29
Windowing system distributor 'The X.Org Foundation', version 
11.0.12101007
System Description: Arch Linux

Configured using:
 'configure --with-native-compilation --with-json --with-modules
 --with-tree-sitter --with-xinput2'

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ 
JPEG
JSON LCMS2 LIBOTF LIBSYSTEMD LIBXML2 M17N_FLT MODULES NATIVE_COMP 
NOTIFY
INOTIFY PDUMPER PNG RSVG SECCOMP SOUND SQLITE3 THREADS TIFF
TOOLKIT_SCROLL_BARS TREE_SITTER WEBP X11 XDBE XIM XINPUT2 XPM GTK3 
ZLIB

Important settings:
  value of $LC_CTYPE: en_GB.UTF-8
  value of $LANG: en_GB.UTF-8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  line-number-mode: t
  indent-tabs-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message mailcap yank-media puny dired
dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg 
rfc6068
epg-config gnus-util text-property-search time-date mm-decode 
mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail
rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils comp 
comp-cstr
warnings icons subr-x rx cl-seq cl-macs gv cl-extra help-mode
cl-loaddefs cl-lib bytecomp byte-compile rmc iso-transl tooltip cconv
eldoc paren electric uniquify ediff-hook vc-hooks lisp-float-type
elisp-mode mwheel term/x-win x-win term/common-win x-dnd tool-bar dnd
fontset image regexp-opt fringe tabulated-list replace newcomment
text-mode lisp-mode prog-mode register page tab-bar menu-bar 
rfn-eshadow
isearch easymenu timer select scroll-bar mouse jit-lock font-lock 
syntax
font-core term/tty-colors frame minibuffer nadvice seq simple 
cl-generic
indonesian philippine cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew 
greek
romanian slovak czech european ethiopic indian cyrillic chinese
composite emoji-zwj charscript charprop case-table epa-hook
jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button 
loaddefs
theme-loaddefs faces cus-face macroexp files window text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget 
keymap
hashtable-print-readable backquote threads dbusbind inotify lcms2
dynamic-setting system-font-setting font-render-setting cairo
move-toolbar gtk x-toolkit xinput2 x multi-tty make-network-process
native-compile emacs)

Memory information:
((conses 16 98683 13034)
 (symbols 48 7145 0)
 (strings 32 28345 2128)
 (string-bytes 1 897813)
 (vectors 16 21940)
 (vector-slots 8 378753 18583)
 (floats 8 43 45)
 (intervals 56 219 0)
 (buffers 984 11))

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]

bug#61507: 29.0.60; "free(): invalid pointer" on latest emacs-29 commit when loading init.el

[Gregory Heytings]

[-- Attachment #1: Type: text/plain, Size: 112 bytes --]


Can you please try the attached patch (on top of the emacs-29 HEAD) and 
tell us if it fixes the bug?  Thanks.

[-- Attachment #2: Improve-backward-compatibility-of-save-restriction.patch --]
[-- Type: text/x-diff, Size: 4934 bytes --]

From 85f4a2851514fad981b74abe14b833196d5987b0 Mon Sep 17 00:00:00 2001
From: Gregory Heytings <gregory@heytings.org>
Date: Tue, 14 Feb 2023 09:22:22 +0000
Subject: [PATCH] Improve backward compatibility of save-restriction

* src/editfns.c (save_restriction_and_narrowing_locks_restore):
New function, combining 'save_restriction_restore' and
'narrowing_locks_restore'.
(narrowing_locks_restore): Make static.
(Fsave_restriction): Use the new function instead of the two ones
it combines.

* src/lisp.h: Make the new function externally visible.

* src/bytecode.c (exec_byte_code): Use the new function instead of
the two ones it combines.

* src/comp.c (helper_save_restriction): Use the new function
instead of the two ones it combines.

* lisp/emacs-lisp/bytecomp.el (byte-compile-save-restriction):
Decrement unbinding count.
---
 lisp/emacs-lisp/bytecomp.el |  2 +-
 src/bytecode.c              |  7 +++----
 src/comp.c                  |  7 +++----
 src/editfns.c               | 14 +++++++++++---
 src/lisp.h                  |  2 +-
 5 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/lisp/emacs-lisp/bytecomp.el b/lisp/emacs-lisp/bytecomp.el
index c6cda6b588a..5df1205869c 100644
--- a/lisp/emacs-lisp/bytecomp.el
+++ b/lisp/emacs-lisp/bytecomp.el
@@ -4900,7 +4900,7 @@ byte-compile-save-excursion
 (defun byte-compile-save-restriction (form)
   (byte-compile-out 'byte-save-restriction 0)
   (byte-compile-body-do-effect (cdr form))
-  (byte-compile-out 'byte-unbind 2))
+  (byte-compile-out 'byte-unbind 1))
 
 (defun byte-compile-save-current-buffer (form)
   (byte-compile-out 'byte-save-current-buffer 0)
diff --git a/src/bytecode.c b/src/bytecode.c
index 8e214560f30..ca7ae4766e1 100644
--- a/src/bytecode.c
+++ b/src/bytecode.c
@@ -940,10 +940,9 @@ #define DEFINE(name, value) [name] = &&insn_ ## name,
 	  }
 
 	CASE (Bsave_restriction):
-	  record_unwind_protect (save_restriction_restore,
-				 save_restriction_save ());
-	  record_unwind_protect (narrowing_locks_restore,
-				 narrowing_locks_save ());
+	  record_unwind_protect (save_restriction_and_narrowing_locks_restore,
+				 Fcons (save_restriction_save (),
+					narrowing_locks_save ()));
 	  NEXT;
 
 	CASE (Bcatch):		/* Obsolete since 25.  */
diff --git a/src/comp.c b/src/comp.c
index 0e2dfd3913b..fe2c9b054b6 100644
--- a/src/comp.c
+++ b/src/comp.c
@@ -5061,10 +5061,9 @@ helper_unbind_n (Lisp_Object n)
 static void
 helper_save_restriction (void)
 {
-  record_unwind_protect (save_restriction_restore,
-			 save_restriction_save ());
-  record_unwind_protect (narrowing_locks_restore,
-			 narrowing_locks_save ());
+  record_unwind_protect (save_restriction_and_narrowing_locks_restore,
+			 Fcons (save_restriction_save (),
+				narrowing_locks_save ()));
 }
 
 static bool
diff --git a/src/editfns.c b/src/editfns.c
index ce133785e0b..dbcc5728dda 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -2804,7 +2804,7 @@ narrowing_locks_save (void)
   return Fcons (buf, Fcopy_sequence (locks));
 }
 
-void
+static void
 narrowing_locks_restore (Lisp_Object buf_and_saved_locks)
 {
   Lisp_Object buf = XCAR (buf_and_saved_locks);
@@ -3068,6 +3068,13 @@ save_restriction_restore (Lisp_Object data)
     set_buffer_internal (cur);
 }
 
+void
+save_restriction_and_narrowing_locks_restore (Lisp_Object data)
+{
+  save_restriction_restore (XCAR (data));
+  narrowing_locks_restore (XCDR (data));
+}
+
 DEFUN ("save-restriction", Fsave_restriction, Ssave_restriction, 0, UNEVALLED, 0,
        doc: /* Execute BODY, saving and restoring current buffer's restrictions.
 The buffer's restrictions make parts of the beginning and end invisible.
@@ -3091,8 +3098,9 @@ DEFUN ("save-restriction", Fsave_restriction, Ssave_restriction, 0, UNEVALLED, 0
   register Lisp_Object val;
   specpdl_ref count = SPECPDL_INDEX ();
 
-  record_unwind_protect (save_restriction_restore, save_restriction_save ());
-  record_unwind_protect (narrowing_locks_restore, narrowing_locks_save ());
+  record_unwind_protect (save_restriction_and_narrowing_locks_restore,
+			 Fcons (save_restriction_save (),
+				narrowing_locks_save ()));
   val = Fprogn (body);
   return unbind_to (count, val);
 }
diff --git a/src/lisp.h b/src/lisp.h
index 93197d38176..a86a2e823f9 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -4685,7 +4685,7 @@ XMODULE_FUNCTION (Lisp_Object o)
 extern Lisp_Object save_restriction_save (void);
 extern void save_restriction_restore (Lisp_Object);
 extern Lisp_Object narrowing_locks_save (void);
-extern void narrowing_locks_restore (Lisp_Object);
+extern void save_restriction_and_narrowing_locks_restore (Lisp_Object);
 extern Lisp_Object make_buffer_string (ptrdiff_t, ptrdiff_t, bool);
 extern Lisp_Object make_buffer_string_both (ptrdiff_t, ptrdiff_t, ptrdiff_t,
 					    ptrdiff_t, bool);
-- 
2.39.0

bug#61507: 29.0.60; "free(): invalid pointer" on latest emacs-29 commit when loading init.el

[Po Lu via Bug reports for GNU Emacs, the Swiss army knife of text editors]

Simon Pugnet <simon@polaris64.net> writes:

> Dear Emacs maintainers,
>
> I've just built Emacs from commit
> 4bb27a5ca93f8269d9cd4b85fd948176304236eb on the emacs-29 branch and it
> fails to launch with the following message when loading my init.el
> file: -
>
> free(): invalid pointer
> Fatal error 6: Aborted
>
> Launching with -q or -Q works fine. Checking out a previous commit
> (cc30422825a5acf460d026bfe912b327b70dedcf) and rebuilding causes
> everything to work as expected again too.
>
> I've tried `make extraclean` and then `make bootstrap` in order to
> clear out any old byte-compiled or native-compiled elisp as I read
> another message earlier saying that a recent change might have caused
> a backwards incompatible change.
>
> Output of `bt full` in GDB: -

Will you please run Emacs on top of some kind of memory error checker
and see if that shows the problem's cause?

I.E. with valgrind's memcheck:

  valgrind /path/to/emacs

it should complain about a double free.

bug#61507: 29.0.60; "free(): invalid pointer" on latest emacs-29 commit when loading init.el

[Simon Pugnet]

[-- Attachment #1: Type: text/plain, Size: 368 bytes --]

Gregory Heytings <gregory@heytings.org> writes:

> Can you please try the attached patch (on top of the emacs-29 HEAD)
> and tell us if it fixes the bug?  Thanks.
>
> [2. text/x-diff; 
> Improve-backward-compatibility-of-save-restriction.patch]...

Hi Gregory,

Yes that does indeed seem to fix the problem.

Kind regards,

-- 
Simon Pugnet
https://www.polaris64.net/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]

bug#61507: 29.0.60; "free(): invalid pointer" on latest emacs-29 commit when loading init.el

[Gregory Heytings]

>
> Hi Gregory,
>
> Yes that does indeed seem to fix the problem.
>

Thanks for the swift feedback!

bug#61507: 29.0.60; "free(): invalid pointer" on latest emacs-29 commit when loading init.el

[Simon Pugnet]

[-- Attachment #1: Type: text/plain, Size: 2893 bytes --]

Po Lu <luangruo@yahoo.com> writes:
> Simon Pugnet <simon@polaris64.net> writes:
>
>> I've just built Emacs from commit
>> 4bb27a5ca93f8269d9cd4b85fd948176304236eb on the emacs-29 branch and 
>> it
>> fails to launch with the following message when loading my init.el
>> file: -
>>
>> free(): invalid pointer
>> Fatal error 6: Aborted
>> [...]
>
> Will you please run Emacs on top of some kind of memory error 
> checker
> and see if that shows the problem's cause?
>
> I.E. with valgrind's memcheck:
>
>   valgrind /path/to/emacs
>
> it should complain about a double free.

I believe this has already been resolved by Gregory's patch, however 
here's what I see when running with valgrind: -

==203263== Invalid free() / delete / delete[] / realloc()
==203263==    at 0x484426F: free (vg_replace_malloc.c:872)
==203263==    by 0x32563B: safe_free (lisp.h:5385)
==203263==    by 0x32563B: apply_lambda (eval.c:3109)
==203263==    by 0x323921: eval_sub (eval.c:2588)
==203263==    by 0x326510: internal_lisp_condition_case (eval.c:1428)
==203263==    by 0x323FB9: eval_sub (eval.c:2449)
==203263==    by 0x3242AC: Fprogn (eval.c:436)
==203263==    by 0x323FB9: eval_sub (eval.c:2449)
==203263==    by 0x326510: internal_lisp_condition_case (eval.c:1428)
==203263==    by 0x323FB9: eval_sub (eval.c:2449)
==203263==    by 0x3242AC: Fprogn (eval.c:436)
==203263==    by 0x323FB9: eval_sub (eval.c:2449)
==203263==    by 0x3242AC: Fprogn (eval.c:436)
==203263==  Address 0x20987025 is 5 bytes inside a block of size 4,096 
alloc'd
==203263==    at 0x4841888: malloc (vg_replace_malloc.c:381)
==203263==    by 0x2F97B1: lmalloc (alloc.c:1365)
==203263==    by 0x2F97B1: xmalloc (alloc.c:755)
==203263==    by 0x2F97B1: allocate_vector_block (alloc.c:3003)
==203263==    by 0x2F97B1: allocate_vector_from_block (alloc.c:3066)
==203263==    by 0x2F97B1: allocate_vectorlike (alloc.c:3340)
==203263==    by 0x2F9B0F: allocate_pseudovector (alloc.c:3417)
==203263==    by 0x2F9B0F: allocate_buffer (alloc.c:3428)
==203263==    by 0x2B7D62: Fget_buffer_create.part.0 (buffer.c:566)
==203263==    by 0x1803AE: ensure_echo_area_buffers (xdisp.c:12155)
==203263==    by 0x186B14: with_echo_area_buffer (xdisp.c:12194)
==203263==    by 0x1B3230: set_message (xdisp.c:12840)
==203263==    by 0x1B3230: message3_nolog (xdisp.c:11952)
==203263==    by 0x1B34A7: message3 (xdisp.c:11893)
==203263==    by 0x318259: Fmessage (editfns.c:3151)
==203263==    by 0x318259: Fmessage (editfns.c:3119)
==203263==    by 0xE0BF4A3: 
F6c6f61642d776974682d636f64652d636f6e76657273696f6e_load_with_code_conversion_0 
(in 
/storage/Work/personal/emacs/native-lisp/29.0.60-349da14f/preloaded/mule-3352613d-1fec1ce7.eln)
==203263==    by 0x320265: Ffuncall (eval.c:2995)
==203263==    by 0x354F06: call4 (lisp.h:3269)
==203263==    by 0x354F06: Fload (lread.c:1484)


Kind regards,

-- 
Simon Pugnet
https://www.polaris64.net/

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 861 bytes --]

bug#61507: 29.0.60; "free(): invalid pointer" on latest emacs-29 commit when loading init.el

[Stefan Kangas]

Gregory Heytings <gregory@heytings.org> writes:

>>
>> Hi Gregory,
>>
>> Yes that does indeed seem to fix the problem.
>>
>
> Thanks for the swift feedback!

I'm therefore closing this bug report.