bug#61896: 30.0.50; Emacs crashes because of an invalid free

[Philip Kaludercic <philipk@posteo.net>]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Philip Kaludercic <philipk@posteo.net>
>> Date: Wed, 01 Mar 2023 20:25:11 +0000
>> 
>> Emacs just crashes out of nowhere, e.g. after I open a my init file.
>
> It would help if you could run Emacs under GDB and show the backtrace
> from one of those crashes, including the Lisp backtrace (the
> "xbacktrace" command defined on src/.gdbinit).

I tried debugging it using GDB, but didn't know about xbacktrace.  Sadly
I cannot reproduce the issue any more (at least for now).

>> I have had this device for a while on a device of mine, that I couldn't
>> reproduce on my main workstation or using emacs -Q.  Apparently this
>> could be related to some faulty byte-code.
>> 
>> The best I could do to detect this issue was to build Emacs using
>> -fsanitize=address and I managed to reprodce the issue reliably by
>> invoking package-recompile-all.  I collected the following log:
>
> Byte-code saw quite a bit of changes on master.  Adding Mattias in
> case he has some ideas.

From what I recall, the address being freed was on the stack.  How does
the byte-code interpreter behave when the input is broken?  Is there
some way of validating if the byte-code is "coherent"?  If I manually
modify the byte code and replace random bytes, is the interpreter
written to expect this kind of issue?