bug#30931: abort() due to CHECK_ALLOCATED_AND_LIVE failure during GC

[Paul Eggert <eggert@cs.ucla.edu>]

[-- Attachment #1: Type: text/plain, Size: 229 bytes --]

Thanks, I installed that along with the attached minor refactoring so 
that the bugfix is in just one place. Closing the bug.

I assume that this fix should not be backported into the emacs-26 
branch, as the bug is in Emacs 25.

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-Centralize-Bug-30931-fix.patch --]
[-- Type: text/x-patch; name="0001-Centralize-Bug-30931-fix.patch", Size: 4376 bytes --]

From 529377bc392039dc253c8b5f2410964c8581ffd9 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Fri, 30 Mar 2018 14:23:55 -0700
Subject: [PATCH] Centralize Bug#30931 fix

* src/marker.c (detach_marker): New function.
* src/editfns.c (save_restriction_restore):
* src/insdel.c (signal_before_change): Use it.
---
 src/editfns.c |  9 +++------
 src/insdel.c  |  7 ++-----
 src/lisp.h    |  3 ++-
 src/marker.c  | 13 +++++++++++--
 4 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/src/editfns.c b/src/editfns.c
index 84de679273..608304c09a 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -3899,12 +3899,9 @@ save_restriction_restore (Lisp_Object data)
 
 	  buf->clip_changed = 1; /* Remember that the narrowing changed. */
 	}
-      /* This isn’t needed anymore, so don’t wait for GC.  Do not call
-         free_marker on XCAR (data) or XCDR (data), though, since
-         record_marker_adjustments may have put them on the buffer’s
-         undo list (Bug#30931).  Just detach them instead.  */
-      Fset_marker (XCAR (data), Qnil, Qnil);
-      Fset_marker (XCDR (data), Qnil, Qnil);
+      /* Detach the markers, and free the cons instead of waiting for GC.  */
+      detach_marker (XCAR (data));
+      detach_marker (XCDR (data));
       free_cons (XCONS (data));
     }
   else
diff --git a/src/insdel.c b/src/insdel.c
index 697395c507..173c243834 100644
--- a/src/insdel.c
+++ b/src/insdel.c
@@ -2148,13 +2148,10 @@ signal_before_change (ptrdiff_t start_int, ptrdiff_t end_int,
 				   FETCH_START, FETCH_END, Qnil);
     }
 
-  /* Detach the markers now that we're done with them.  Don't directly
-     free them, since the change functions could have caused them to
-     be inserted into the undo list (Bug#30931).  */
   if (! NILP (start_marker))
-    Fset_marker (start_marker, Qnil, Qnil);
+    detach_marker (start_marker);
   if (! NILP (end_marker))
-    Fset_marker (end_marker, Qnil, Qnil);
+    detach_marker (end_marker);
   RESTORE_VALUE;
 
   unbind_to (count, Qnil);
diff --git a/src/lisp.h b/src/lisp.h
index f471b21658..c931d9c8f0 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -4104,7 +4104,8 @@ extern ptrdiff_t marker_byte_position (Lisp_Object);
 extern void clear_charpos_cache (struct buffer *);
 extern ptrdiff_t buf_charpos_to_bytepos (struct buffer *, ptrdiff_t);
 extern ptrdiff_t buf_bytepos_to_charpos (struct buffer *, ptrdiff_t);
-extern void unchain_marker (struct Lisp_Marker *marker);
+extern void detach_marker (Lisp_Object);
+extern void unchain_marker (struct Lisp_Marker *);
 extern Lisp_Object set_marker_restricted (Lisp_Object, Lisp_Object, Lisp_Object);
 extern Lisp_Object set_marker_both (Lisp_Object, Lisp_Object, ptrdiff_t, ptrdiff_t);
 extern Lisp_Object set_marker_restricted_both (Lisp_Object, Lisp_Object,
diff --git a/src/marker.c b/src/marker.c
index 2a45ae636e..2d5b05cc2b 100644
--- a/src/marker.c
+++ b/src/marker.c
@@ -560,7 +560,7 @@ POSITION is nil, makes marker point nowhere so it no longer slows down
 editing in any buffer.  Returns MARKER.  */)
   (Lisp_Object marker, Lisp_Object position, Lisp_Object buffer)
 {
-  return set_marker_internal (marker, position, buffer, 0);
+  return set_marker_internal (marker, position, buffer, false);
 }
 
 /* Like the above, but won't let the position be outside the visible part.  */
@@ -569,7 +569,7 @@ Lisp_Object
 set_marker_restricted (Lisp_Object marker, Lisp_Object position,
 		       Lisp_Object buffer)
 {
-  return set_marker_internal (marker, position, buffer, 1);
+  return set_marker_internal (marker, position, buffer, true);
 }
 
 /* Set the position of MARKER, specifying both the
@@ -616,6 +616,15 @@ set_marker_restricted_both (Lisp_Object marker, Lisp_Object buffer,
   return marker;
 }
 
+/* Detach a marker so that it no longer points anywhere and no longer
+   slows down editing.  Do not free the marker, though, as a change
+   function could have inserted it into an undo list (Bug#30931).  */
+void
+detach_marker (Lisp_Object marker)
+{
+  Fset_marker (marker, Qnil, Qnil);
+}
+
 /* Remove MARKER from the chain of whatever buffer it is in,
    leaving it points to nowhere.  This is called during garbage
    collection, so we must be careful to ignore and preserve
-- 
2.14.3