bug#30931: 27.0.50; Crash in "Automatic GC"

[Noam Postavsky <npostavs@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 526 bytes --]

Noam Postavsky <npostavs@gmail.com> writes:

> next time it was just mark_stack, but the object being marked still
> looks like an undo-list.

Here's the gdb evidence of that.  I note that the reproduction recipe
disables undo via (let ((buffer-undo-list t))...), but looking at its
code, I see that yasnippet unconditionally pushes entries onto the undo
list anyway.  Michał, is the binding of buffer-undo-list significant for
your reproduction (i.e., did the original crash happen in an
undo-disabled buffer)?


[-- Attachment #2: gdb session log --]
[-- Type: text/plain, Size: 4128 bytes --]

(gdb) bt 16
#0  terminate_due_to_signal (sig=6, backtrace_limit=40) at ../../src/emacs.c:364
#1  0x00000000005aa0c9 in emacs_abort () at ../../src/sysdep.c:2426
#2  0x0000000000612e7a in mark_object (arg=XIL(0x301c719)) at ../../src/alloc.c:6677
#3  0x0000000000613079 in mark_object (arg=XIL(0x355a503)) at ../../src/alloc.c:6730
#4  0x0000000000613079 in mark_object (arg=XIL(0x355a493)) at ../../src/alloc.c:6730
#5  0x000000000060f229 in mark_maybe_object (obj=XIL(0x355a493)) at ../../src/alloc.c:4846
#6  0x000000000060f4b9 in mark_memory (start=0x7fffffff21e0, end=0x7fffffffe8c8)
    at ../../src/alloc.c:4990
#7  0x000000000060f4ee in mark_stack (bottom=0x7fffffffe8c8 "a\036h\364\377\177", 
    end=0x7fffffff21e0 "\360!\377\377\377\177") at ../../src/alloc.c:5197
#8  0x00000000006cddb3 in mark_one_thread (thread=0xe103e0 <main_thread>) at ../../src/thread.c:616
#9  0x00000000006cdf48 in mark_threads_callback (ignore=0x0) at ../../src/thread.c:649
#10 0x000000000060f535 in flush_stack_call_func (func=0x6cdeb5 <mark_threads_callback>, arg=0x0)
    at ../../src/alloc.c:5224
#11 0x00000000006cdf7a in mark_threads () at ../../src/thread.c:656
#12 0x0000000000611502 in garbage_collect_1 (end=0x7fffffff23c0) at ../../src/alloc.c:6001
#13 0x0000000000611bef in Fgarbage_collect () at ../../src/alloc.c:6172
#14 0x00000000005799f8 in maybe_gc () at ../../src/lisp.h:4748
#15 0x000000000063c326 in Ffuncall (nargs=3, args=0x7fffffff2478) at ../../src/eval.c:2751
(More stack frames follow...)
(gdb) xbacktrace
"Automatic GC" (0x0)
"mapcar" (0xffff2480)
"yas-active-snippets" (0xffff2958)
"yas--place-overlays" (0xffff2e40)
"yas--move-to-field" (0xffff33d0)
0x320a050 PVEC_COMPILED
"funcall" (0xffff3860)
"let" (0xffff3b30)
"eval" (0xffff3cf0)
"yas-expand-snippet" (0xffff4410)
"yas--expand-or-prompt-for-template" (0xffff4910)
"yas-expand" (0xffff4da0)
"save-restriction" (0xffff5060)
"save-current-buffer" (0xffff51e0)
"update-fn" (0xffff53c0)
"ivy--insert-minibuffer" (0xffff58a0)
"ivy--exhibit" (0xffff5e70)
"ivy--queue-exhibit" (0xffff6340)
"execute-kbd-macro" (0xffff66e0)
"progn" (0xffff6880)
"if" (0xffff69e0)
"while" (0xffff6b90)
"let" (0xffff6db0)
0x3407a30 Lisp type 3
"apply" (0xffff7118)
"timer-event-handler" (0xffff7688)
"input-pending-p" (0xffff7988)
"sit-for" (0xffff7e80)
"yas-expand-snippet" (0xffff85a0)
"yas--expand-or-prompt-for-template" (0xffff8aa0)
"yas-expand" (0xffff8f30)
"save-restriction" (0xffff91f0)
"save-current-buffer" (0xffff9370)
"update-fn" (0xffff9550)
"ivy--insert-minibuffer" (0xffff9a30)
"ivy--exhibit" (0xffffa000)
"ivy--minibuffer-setup" (0xffffa510)
0x36bb630 PVEC_COMPILED
"read-from-minibuffer" (0xffffae58)
"ivy-read" (0xffffb5f0)
"condition-case" (0xffffb990)
"catch" (0xffffbb60)
"while" (0xffffbd10)
"let" (0xffffbf30)
"let" (0xffffc150)
"eval-buffer" (0xffffc440)
"load-with-code-conversion" (0xffffc9c8)
"load" (0xffffcd40)
0xad83e0 PVEC_COMPILED
"command-line" (0xffffdeb8)
"normal-top-level" (0xffffe4e0)
(gdb) frame 5
#5  0x000000000060f229 in mark_maybe_object (obj=XIL(0x355a493)) at ../../src/alloc.c:4846
4846		mark_object (obj);
(gdb) p obj
$100 = XIL(0x355a493)
(gdb) xxlist
Lisp_Cons:(Lisp_String:" " . Lisp_Int0:-36)
Lisp_Cons:(Lisp_Misc_Marker . Lisp_Int1:-1)
Lisp_Cons:(Lisp_Misc_Free . Lisp_Int1:1)
Lisp_Cons:(Lisp_Misc_Overlay . Lisp_Int1:1)
Lisp_Cons:(Lisp_Int0:4 . Lisp_Int0:36)
Lisp_Cons:(Lisp_String:"ah" . Lisp_Int0:4)
Lisp_Cons:(Lisp_Int1:3 . Lisp_Int0:6)
Lisp_Symbol:"nil"
Lisp_Cons:(Lisp_Symbol:"apply" Lisp_Symbol:"yas--take-care-of-redo" Lisp_Vectorlike: . Lisp_Symbol
:"nil")
Lisp_Cons:(Lisp_Int0:4 . Lisp_Int0:10)
Lisp_Cons:(Lisp_String:"a" . Lisp_Int0:4)
Lisp_Cons:(Lisp_Int1:3 . Lisp_Int1:5)
Lisp_Cons:(Lisp_Symbol:"apply" Lisp_Symbol:"yas--take-care-of-redo" Lisp_Vectorlike: . Lisp_Symbol
:"nil")
Lisp_Cons:(Lisp_Int0:4 . Lisp_Int0:10)
Lisp_Cons:(Lisp_String:"a" . Lisp_Int0:4)
Lisp_Cons:(Lisp_Int1:3 . Lisp_Int1:5)
Lisp_Symbol:"nil"
Lisp_Cons:(Lisp_Symbol:"apply" Lisp_Symbol:"yas--take-care-of-redo" Lisp_Vectorlike: . Lisp_Symbol
:"nil")
Lisp_Cons:(Lisp_String:" " . Lisp_Int0:-36)
Lisp_Cons:(Lisp_Misc_Marker . Lisp_Int1:-1)
...


[-- Attachment #3: xxlist gdb command --]
[-- Type: text/plain, Size: 1869 bytes --]


define xxlist
  xgetptr $
  set $cons = (struct Lisp_Cons *) $ptr
  xgetptr Qnil
  set $nil = $ptr
  set $i = 0
  while $cons != $nil && $i < 20
    set $car = $cons->u.s.car
    # xgettype $car
    # if $type == Lisp_Cons
    #   printf "(cons "
    #   set $consptr = $ptr
    #   xgetptr $car
    #   set $car_ptr = (struct Lisp_Cons *) $ptr
    #   xpp $car_ptr->u.s.car
    #   xgettype $car_ptr->u.s.u.cdr
    #   if $type == Lisp_Cons
    #     printf "..."
    #   end
    #   set $ptr = $consptr
    #   printf ")"
    # else
      xpp $car
    # end

    xgetptr $cons->u.s.u.cdr
    set $cons = (struct Lisp_Cons *) $ptr
    set $i = $i + 1
    printf "\n"
  end
  if $cons == $nil
    printf "nil\n"
  else
    printf "...\n"
    p $ptr
  end
end

define xpp
  xgettype $arg0
  if $type != Lisp_Misc
    output $type
    printf ":"
  end
  if $type == Lisp_String
    xgetptr $arg0
    set $caar_str = (struct Lisp_String *) $ptr
    xprintstr $caar_str
  end
  if $type == Lisp_Misc
    xgetptr $arg0
    output (enum Lisp_Misc_Type) (((struct Lisp_Free *) $ptr)->type)
  end
  if $type == Lisp_Int0 || $type == Lisp_Int1
    xgetint $arg0
    output $int
  end
  if $type == Lisp_Symbol
    xsymname $arg0
    xgetptr $symname
    set $caar_symname = (struct Lisp_String *) $ptr
    xprintstr $caar_symname
  end
  if $type == Lisp_Cons
    printf "("
    xgetptr $arg0
    set $xpp_cons = (struct Lisp_Cons *) $ptr
    while $xpp_cons != $nil
      set $xpp_car = $xpp_cons->u.s.car
      # this will likely fail for nested lists.
      xpp $xpp_car
      printf " "

      set $xpp_cdr = $xpp_cons->u.s.u.cdr
      xgettype $xpp_cdr
      if $type == Lisp_Cons
        xgetptr $xpp_cdr
        set $xpp_cons = (struct Lisp_Cons *) $ptr
      else
        printf ". "
        xpp $xpp_cdr
        loop_break
      end
    end
    printf ")"
  end
end