bug#26047: 26.0.50; emacs crash by cl-caff2

[Andreas Politz <politza@hochschule-trier.de>]

Below is a slightly simpler test-case and a full back-trace.

Looks like the function byte-compile-inline-expand, which is the value
of cl-concatenate's byte-optimizer property, creates bad byte-code;
because this bug does not occur after setting this property to nil.


#+BEGIN_SRC emacs-lisp
  (require 'cl-lib)
  (cl-concatenate 'string "abcd" "efg")
  (provide 'foo)
#+END_SRC

Save this to foo.el, byte-compile it and start emacs like this

$ emacs -Q -l foo.elc

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
Ffuncall (nargs=2, args=) at eval.c:2761

(gdb) bt
#0  Ffuncall (nargs=2, args=) at eval.c:2761
#1  exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=)
    at bytecode.c:641
#2  Fbyte_code (bytestr=..., vector=..., maxdepth=...) at bytecode.c:321
#3  eval_sub (form=...) at eval.c:2247
#4  readevalloop (readcharfun=..., stream=, sourcename=..., printflag=false, unibyte=..., readfun=..., start=..., end=...) at lread.c:1927
#5  Fload (file=..., noerror=..., nomessage=..., nosuffix=..., must_suffix=...) at lread.c:1332
#6  funcall_subr (subr=<Sload>, numargs=4, args=) at eval.c:2852
#7  Ffuncall (nargs=5, args=) at eval.c:2765
#8  exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=)
    at bytecode.c:641
#9  funcall_lambda (fun=..., nargs=1, arg_vector=) at eval.c:2965
#10 apply_lambda (fun=..., args=..., count=37) at eval.c:2902
#11 eval_sub (form=...) at eval.c:2286
#12 readevalloop_eager_expand_eval (val=..., macroexpand=...) at lread.c:1757
#13 readevalloop (readcharfun=..., stream=, sourcename=..., printflag=false, unibyte=..., readfun=..., start=..., end=...) at lread.c:1925
#14 Feval_buffer (buffer=..., printflag=..., filename=..., unibyte=..., do_allow_print=...)
    at lread.c:1991
#15 funcall_subr (subr=<Seval_buffer>, numargs=5, args=) at eval.c:2852
#16 Ffuncall (nargs=6, args=) at eval.c:2765
#17 exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=)
    at bytecode.c:641
#18 funcall_lambda (fun=..., nargs=4, arg_vector=<pure+196493>) at eval.c:3043
#19 Ffuncall (nargs=5, args=) at eval.c:2767
#20 call4 (fn=..., arg1=..., arg2=..., arg3=..., arg4=...) at eval.c:2652
#21 Fload (file=..., noerror=..., nomessage=..., nosuffix=..., must_suffix=...) at lread.c:1276
#22 funcall_subr (subr=<Sload>, numargs=3, args=) at eval.c:2852
#23 Ffuncall (nargs=4, args=) at eval.c:2765
#24 exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=)
    at bytecode.c:641
#25 funcall_lambda (fun=..., nargs=1, arg_vector=) at eval.c:2965
#26 Ffuncall (nargs=2, args=) at eval.c:2767
#27 exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=)
    at bytecode.c:641
#28 funcall_lambda (fun=..., nargs=0, arg_vector=) at eval.c:2965
#29 Ffuncall (nargs=1, args=) at eval.c:2767
#30 exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=)
    at bytecode.c:641
#31 funcall_lambda (fun=..., nargs=0, arg_vector=) at eval.c:2965
#32 apply_lambda (fun=..., args=..., count=4) at eval.c:2902
#33 eval_sub (form=...) at eval.c:2286
#34 Feval (form=..., lexical=...) at eval.c:2063
#35 top_level_2 () at keyboard.c:1121
#36 internal_condition_case (bfun=<top_level_2>, handlers=..., hfun=<cmd_error>) at eval.c:1324
#37 top_level_1 (ignore=...) at keyboard.c:1129
#38 internal_catch (tag=..., func=<top_level_1>, arg=...) at eval.c:1091
#39 command_loop () at keyboard.c:1090
#40 recursive_edit_1 () at keyboard.c:697
#41 Frecursive_edit () at keyboard.c:768
#42 main (argc=4, argv=) at emacs.c:1688

Lisp Backtrace:
Cannot access memory at address 0x800000dd5608
(gdb) pp args[0]
#<INVALID_LISP_OBJECT 0x7fffffff9cf0>
(gdb) pp args[1]
#<INVALID_LISP_OBJECT 0x0068b154>

-ap