The following invocation of emacs aborts with double-free: $ installed/bin/emacs -Q -L . -batch --eval '(progn (message "before") (make-local-variable (make-symbol "\ s")) (kill-buffer) (garbage-collect) (garbage-collect) (message "after"))' before *** Error in `installed/bin/emacs': double free or corruption (!prev): 0x00000000014bff10 *** ======= Backtrace: ========= /lib64/libc.so.6(+0x7c619)[0x7efd02c32619] installed/bin/emacs[0x4e3fa1] installed/bin/emacs[0x4e917a] installed/bin/emacs[0x5006bc] installed/bin/emacs[0x500780] installed/bin/emacs[0x500439] installed/bin/emacs[0x503d30] installed/bin/emacs[0x500de6] installed/bin/emacs[0x538e31] installed/bin/emacs[0x500d63] installed/bin/emacs[0x538e31] installed/bin/emacs[0x500d63] installed/bin/emacs[0x538e31] installed/bin/emacs[0x4ffe73] installed/bin/emacs[0x5001a7] installed/bin/emacs[0x503d30] installed/bin/emacs[0x4ff454] installed/bin/emacs[0x49093c] installed/bin/emacs[0x4ff404] installed/bin/emacs[0x48e446] installed/bin/emacs[0x4928fe] installed/bin/emacs[0x492c15] installed/bin/emacs[0x406df3] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7efd02bd7c05] installed/bin/emacs[0x4079de] In emacs-26, running this in gdb prevents the error so I don't have a backtrace (though I have seen such a backtrace on a different machine with different build options for emacs). In emacs 25.2, though, the same error happens and there the backtrace is: (gdb) bt full #0 0x00007ffff20a11f7 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x00007ffff20a28e8 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x00007ffff20e0f47 in __libc_message () from /lib64/libc.so.6 No symbol table info available. #3 0x00007ffff20e8619 in _int_free () from /lib64/libc.so.6 No symbol table info available. #4 0x00000000005358d1 in sweep_symbols () at alloc.c:6839 this_free = sym = 0xd667b0 end = 0xd667e0 sblk = 0xd66720 sprev = lim = num_free = num_used = 1087 #5 0x000000000053b76a in gc_sweep () at alloc.c:6982 No locals. #6 garbage_collect_1 (end=) at alloc.c:5799 nextb = stack_top_variable = 0 '\000' i = message_p = false count = start = {tv_sec = 1509372540, tv_nsec = 974388982} retval = 0 tot_before = 0 total = {12342819, 12341875, 12341619, 12341299, 12340147, 12340035, 12339907, 12339715, 12339571, 12337939, 12337091} #7 0x000000000053c0d9 in Fgarbage_collect () at alloc.c:5983 end = 0x7fffffffd348 #8 0x0000000000551c2b in eval_sub (form=) at eval.c:2169 i = maxargs = 0 args_left = 0 numargs = fun = 11669013 val = original_fun = original_args = 0 funcar = count = 13 argvals = {0, 0, 12067264, 0, 14009168, 176093659181, 0, 40} #9 0x0000000000551ead in Fprogn (body=16724163) at eval.c:431 val = #10 0x0000000000551b11 in eval_sub (form=) at eval.c:2125 args_left = 16725811 numargs = fun = 11695045 val = original_fun = 37680 original_args = 16725811 funcar = count = 12 argvals = {0, 0, 12274656, 4611686019484352512, 1, 4599230, 20285716, 5508133} #11 0x0000000000553712 in Feval (form=16725891, lexical=) at eval.c:1994 count = 11 #12 0x0000000000552648 in Ffuncall (nargs=, args=0x7fffffffd588) at eval.c:2702 internal_argbuf = {16725891, 0, 0, 4599230, 9895560, 5508133, 22, 9893584} fun = 11696197 original_fun = funcar = numargs = lisp_numargs = 6 val = internal_args = 0x7fffffffd590 count = 10 #13 0x000000000058941d in exec_byte_code (bytestr=, vector=9893581, maxdepth=, args_template=, nargs=, args=) at bytecode.c:880 targets = {0x5894ba , 0x58b452 , 0x58b457 , 0x58b45c , 0x589282 , 0x589288 , 0x58952e , 0x5895ad , 0x5895a3 , 0x5895a8 , 0x589573 , 0x589578 , 0x5892c1 , 0x5892c8 , 0x5896e9 , 0x58957d , 0x589908 , 0x58990d , 0x589879 , 0x58987e , 0x589334 , 0x589338 , 0x589820 , 0x5897fa , 0x5896ae , 0x5896b3 , 0x5896b8 , 0x5896c5 , 0x5893b4 , 0x5893b8 , 0x589865 , 0x589688 , 0x589679 , 0x58967e , 0x589683 , 0x58964e , 0x5893f9 , 0x589400 , 0x5896d5 , 0x589653 , 0x58a53f , ---Type to continue, or q to quit--- 0x58a544 , 0x58a549 , 0x58a514 , 0x589443 , 0x589448 , 0x58a4d6 , 0x58a519 , 0x58a944 , 0x58a77d , 0x58a70b , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x589d04 , 0x589d90 , 0x589dc7 , 0x589e01 , 0x589e3b , 0x5897bb , 0x589883 , 0x589e81 , 0x589773 , 0x5898c0 , 0x589eb3 , 0x589ef0 , 0x589f22 , 0x589f5f , 0x589f98 , 0x58a022 , 0x58a054 , 0x58a091 , 0x58a0dc , 0x58a10e , 0x58a140 , 0x58a17d , 0x58a1ba , 0x58a1f7 , 0x58a23e , 0x58a277 , 0x58a2b0 , 0x58a33d , 0x58a380 , 0x58a3c7 , 0x58a494 , 0x58a410 , 0x58a452 , 0x589bb4 , 0x589bf6 , 0x589c2f , 0x589c71 , 0x58b195 , 0x58b1ce , 0x58b207 , 0x58afea , 0x589489 , 0x58b02b , 0x58b059 , 0x58b0e1 , 0x58b122 , 0x58b163 , 0x58ac6d , 0x58ac9d , 0x58accd , 0x58ad05 , 0x5894ba , 0x58ad39 , 0x58ad69 , 0x58ad99 , 0x58adc9 , 0x58adf9 , 0x58ae29 , 0x589489 , 0x5894ba , 0x58ae5b , 0x58ae9d , 0x58aecf , 0x58af01 , 0x58af3e , 0x58af7b , 0x58ac0e , 0x58ac30 , 0x58b63e , 0x58b67b , 0x58b60e , 0x58b735 , 0x5894ba , 0x58aada , 0x58a555 , 0x5896fd , 0x58a5e4 , 0x58a825 , 0x58a896 , 0x589b72 , 0x58a801 , 0x589834 , 0x5894fd , 0x589912 , 0x58a698 , 0x58a6c9 , 0x58abbf , 0x58ab2d , 0x58ab74 , 0x589caa , 0x58a4ea , 0x58b6b8 , 0x58b703 , 0x58b465 , 0x58b497 , 0x58b4c9 , 0x58b4fb , 0x58b538 , 0x58b575 , 0x58b5b2 , 0x58b5ef , 0x58b279 , 0x58b2b6 , 0x58b2f3 , 0x58b325 , 0x58b362 , 0x58b39f , 0x58b3dc , 0x58b419 , 0x58b240 , 0x58afad , 0x589975 , 0x5899be , 0x5894ba , 0x58a784 , 0x58aa0f , 0x58a975 , 0x58aa76 , 0x589adc , 0x589fd1 , 0x58a2e9 , 0x58b08d , 0x589606 , 0x5899f8 , 0x5894ba , 0x5894ba , 0x589a54 , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x589aa2 } count = 8 op = 1 vectorp = 0x96f6d0 stack = { pc = 0xaaa4a8 "\210\202L\003\016A权\317\001\313\347\350\016C\"\003\206m\001\n\211A\022\242\211\262\r\313\332\036D\322\003\003\003#)\266\203\203\211\001\006\n\327\313O\262\vڲ\001\351\352\006\f!!\262\v\211\203\252\001\314\016E\006\fC\"\026E\006\t\203\313\001\016E\262\n\202\313\001\006\t\203\301\001\006\t\006\v\006\vAB\241\210\006\tA\262\n\202\313\001\006\n\016EB\211\026E\262\n\210\202L\003\016A띃\367\001\352\002\206\340\001\n\211A\022\242!\351\001!\354\001!\203\355\001\211\262\002\355\002\313\332#\266\003\202L\003\016A\027\002\352\002\206\b\002\n\211A\022\242!\351\001!\355\001\313ډ$\266\003\202L\003\016", ..., byte_string = 9893548, byte_string_start = 0xaaa355 "\306 \210\b\203\021", next = 0x7fffffffd900} top = 0x7fffffffd680 result = type = #14 0x00000000005523c3 in Ffuncall (nargs=, args=0x7fffffffd818) at eval.c:2760 fun = original_fun = 8587296 funcar = numargs = lisp_numargs = 6 val = internal_args = count = 7 #15 0x000000000058941d in exec_byte_code (bytestr=, vector=9870557, maxdepth=, args_template=, nargs=, args=) at bytecode.c:880 targets = {0x5894ba , 0x58b452 , 0x58b457 , 0x58b45c , 0x589282 , 0x589288 , 0x58952e , 0x5895ad , 0x5895a3 , 0x5895a8 , 0x589573 , 0x589578 , 0x5892c1 , 0x5892c8 , 0x5896e9 , 0x58957d , 0x589908 , 0x58990d , 0x589879 , 0x58987e , ---Type to continue, or q to quit--- 0x589334 , 0x589338 , 0x589820 , 0x5897fa , 0x5896ae , 0x5896b3 , 0x5896b8 , 0x5896c5 , 0x5893b4 , 0x5893b8 , 0x589865 , 0x589688 , 0x589679 , 0x58967e , 0x589683 , 0x58964e , 0x5893f9 , 0x589400 , 0x5896d5 , 0x589653 , 0x58a53f , 0x58a544 , 0x58a549 , 0x58a514 , 0x589443 , 0x589448 , 0x58a4d6 , 0x58a519 , 0x58a944 , 0x58a77d , 0x58a70b , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x589d04 , 0x589d90 , 0x589dc7 , 0x589e01 , 0x589e3b , 0x5897bb , 0x589883 , 0x589e81 , 0x589773 , 0x5898c0 , 0x589eb3 , 0x589ef0 , 0x589f22 , 0x589f5f , 0x589f98 , 0x58a022 , 0x58a054 , 0x58a091 , 0x58a0dc , 0x58a10e , 0x58a140 , 0x58a17d , 0x58a1ba , 0x58a1f7 , 0x58a23e , 0x58a277 , 0x58a2b0 , 0x58a33d , 0x58a380 , 0x58a3c7 , 0x58a494 , 0x58a410 , 0x58a452 , 0x589bb4 , 0x589bf6 , 0x589c2f , 0x589c71 , 0x58b195 , 0x58b1ce , 0x58b207 , 0x58afea , 0x589489 , 0x58b02b , 0x58b059 , 0x58b0e1 , 0x58b122 , 0x58b163 , 0x58ac6d , 0x58ac9d , 0x58accd , 0x58ad05 , 0x5894ba , 0x58ad39 , 0x58ad69 , 0x58ad99 , 0x58adc9 , 0x58adf9 , 0x58ae29 , 0x589489 , 0x5894ba , 0x58ae5b , 0x58ae9d , 0x58aecf , 0x58af01 , 0x58af3e , 0x58af7b , 0x58ac0e , 0x58ac30 , 0x58b63e , 0x58b67b , 0x58b60e , 0x58b735 , 0x5894ba , 0x58aada , 0x58a555 , 0x5896fd , 0x58a5e4 , 0x58a825 , 0x58a896 , 0x589b72 , 0x58a801 , 0x589834 , 0x5894fd , 0x589912 , 0x58a698 , 0x58a6c9 , 0x58abbf , 0x58ab2d , 0x58ab74 , 0x589caa , 0x58a4ea , 0x58b6b8 , 0x58b703 , 0x58b465 , 0x58b497 , 0x58b4c9 , 0x58b4fb , 0x58b538 , 0x58b575 , 0x58b5b2 , 0x58b5ef , 0x58b279 , 0x58b2b6 , 0x58b2f3 , 0x58b325 , 0x58b362 , 0x58b39f , 0x58b3dc , 0x58b419 , 0x58b240 , 0x58afad , 0x589975 , 0x5899be , 0x5894ba , 0x58a784 , 0x58aa0f , 0x58a975 , 0x58aa76 , 0x589adc , 0x589fd1 , 0x58a2e9 , 0x58b08d , 0x589606 , 0x5899f8 , 0x5894ba , 0x5894ba , 0x589a54 , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x589aa2 } count = 7 op = 1 vectorp = 0x969ce0 stack = { pc = 0xaacef4 "\210\307\016@\211\203k\006\211@\002\204d\006\211;\203d\006\201", , byte_string = 9870524, byte_string_start = 0xaac8d3 "\306 \020\307\021\n\023\307\024\310\311!\211\307=\204\060", next = 0x7fffffffdab0} top = 0x7fffffffd818 result = type = #16 0x00000000005523c3 in Ffuncall (nargs=, args=0x7fffffffda10) at eval.c:2760 fun = original_fun = 8586560 funcar = numargs = lisp_numargs = 2 val = internal_args = count = 6 #17 0x000000000058941d in exec_byte_code (bytestr=, vector=9866565, maxdepth=, args_template=, nargs=, args=) at bytecode.c:880 targets = {0x5894ba , 0x58b452 , 0x58b457 , 0x58b45c , 0x589282 , 0x589288 , 0x58952e , 0x5895ad , 0x5895a3 , 0x5895a8 , 0x589573 , ---Type to continue, or q to quit--- 0x589578 , 0x5892c1 , 0x5892c8 , 0x5896e9 , 0x58957d , 0x589908 , 0x58990d , 0x589879 , 0x58987e , 0x589334 , 0x589338 , 0x589820 , 0x5897fa , 0x5896ae , 0x5896b3 , 0x5896b8 , 0x5896c5 , 0x5893b4 , 0x5893b8 , 0x589865 , 0x589688 , 0x589679 , 0x58967e , 0x589683 , 0x58964e , 0x5893f9 , 0x589400 , 0x5896d5 , 0x589653 , 0x58a53f , 0x58a544 , 0x58a549 , 0x58a514 , 0x589443 , 0x589448 , 0x58a4d6 , 0x58a519 , 0x58a944 , 0x58a77d , 0x58a70b , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x589d04 , 0x589d90 , 0x589dc7 , 0x589e01 , 0x589e3b , 0x5897bb , 0x589883 , 0x589e81 , 0x589773 , 0x5898c0 , 0x589eb3 , 0x589ef0 , 0x589f22 , 0x589f5f , 0x589f98 , 0x58a022 , 0x58a054 , 0x58a091 , 0x58a0dc , 0x58a10e , 0x58a140 , 0x58a17d , 0x58a1ba , 0x58a1f7 , 0x58a23e , 0x58a277 , 0x58a2b0 , 0x58a33d , 0x58a380 , 0x58a3c7 , 0x58a494 , 0x58a410 , 0x58a452 , 0x589bb4 , 0x589bf6 , 0x589c2f , 0x589c71 , 0x58b195 , 0x58b1ce , 0x58b207 , 0x58afea , 0x589489 , 0x58b02b , 0x58b059 , 0x58b0e1 , 0x58b122 , 0x58b163 , 0x58ac6d , 0x58ac9d , 0x58accd , 0x58ad05 , 0x5894ba , 0x58ad39 , 0x58ad69 , 0x58ad99 , 0x58adc9 , 0x58adf9 , 0x58ae29 , 0x589489 , 0x5894ba , 0x58ae5b , 0x58ae9d , 0x58aecf , 0x58af01 , 0x58af3e , 0x58af7b , 0x58ac0e , 0x58ac30 , 0x58b63e , 0x58b67b , 0x58b60e , 0x58b735 , 0x5894ba , 0x58aada , 0x58a555 , 0x5896fd , 0x58a5e4 , 0x58a825 , 0x58a896 , 0x589b72 , 0x58a801 , 0x589834 , 0x5894fd , 0x589912 , 0x58a698 , 0x58a6c9 , 0x58abbf , 0x58ab2d , 0x58ab74 , 0x589caa , 0x58a4ea , 0x58b6b8 , 0x58b703 , 0x58b465 , 0x58b497 , 0x58b4c9 , 0x58b4fb , 0x58b538 , 0x58b575 , 0x58b5b2 , 0x58b5ef , 0x58b279 , 0x58b2b6 , 0x58b2f3 , 0x58b325 , 0x58b362 , 0x58b39f , 0x58b3dc , 0x58b419 , 0x58b240 , 0x58afad , 0x589975 , 0x5899be , 0x5894ba , 0x58a784 , 0x58aa0f , 0x58a975 , 0x58aa76 , 0x589adc , 0x589fd1 , 0x58a2e9 , 0x58b08d , 0x589606 , 0x5899f8 , 0x5894ba , 0x5894ba , 0x589a54 , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x5894ba , 0x589aa2 } count = 5 op = 0 vectorp = 0x968d48 stack = {pc = 0xaad5d8 "\210)\210\375\376\377\"\210\201H", byte_string = 9866532, byte_string_start = 0xaad464 "\b\203\b", next = 0x0} top = 0x7fffffffda10 result = type = #18 0x000000000055166b in apply_lambda (fun=9866485, args=0, count=4) at eval.c:2800 args_left = 0 i = numargs = 0 arg_vector = 0x7fffffffdb00 tem = sa_avail = sa_count = 5 sa_must_free = false #19 0x0000000000551936 in eval_sub (form=) at eval.c:2247 fun = val = original_fun = 8584864 original_args = 0 funcar = count = 4 ---Type to continue, or q to quit--- argvals = {0, 0, 12274656, 3840, 1, 4599230, 140737488346536, 5508133} #20 0x0000000000553712 in Feval (form=17463347, lexical=) at eval.c:1994 count = 3 #21 0x00000000005512aa in internal_condition_case (bfun=0x4e2ae0 , handlers=, hfun=0x4eb100 ) at eval.c:1315 val = c = 0x104c #22 0x00000000004eb0bc in top_level_1 (ignore=) at keyboard.c:1129 No locals. #23 0x0000000000551338 in internal_catch (tag=, func=0x4eb060 , arg=0) at eval.c:1080 val = 0 c = 0x104c #24 0x00000000004eae56 in command_loop () at keyboard.c:1090 No locals. #25 0x00000000004eaef5 in recursive_edit_1 () at keyboard.c:697 count = 1 val = #26 0x00000000004eb035 in Frecursive_edit () at keyboard.c:768 count = 0 buffer = #27 0x00000000004dc82e in main (argc=, argv=) at emacs.c:1629 dummy = 4251459 stack_bottom_variable = 0 '\000' do_initial_setlocale = dumping = skip_args = 1 rlim = {rlim_cur = 20480000, rlim_max = 18446744073709551615} no_loadup = false junk = 0x0 dname_arg = 0x0 ch_to_dir = 0x0 original_pwd = 0x7
What a colleague (CC'ed) thinks happens is: This looks like it might be a bug in the emacs GC. Since the symbol is buffer-local, it has an auxiliary "SYMBOL_BLV" structure, allocated using [malloc], attached to it. The first garbage collection can be seen to be freeing this structure and changing the name (stored in the "function" member) to [Vdead] (in sweep_symbols in alloc.c). The symbols are stored in some kind of list of blocks. If any given block becomes full of free symbols as a result of the sweeping, it may be freed by the next garbage-collect call (see [sweep_symbols] again in alloc.c). However this clearly does not always happen as seen by the comments in the code. As such surely something has to be done, after freeing a symbol's blv structure and marking it dead, to make sure that a subsequent sweeping phase on the same block of symbols doesn't try to free the symbol's blv structure a second time. There seems to be no protection against this at the moment which is why we suspect a bug. The attached patch adds such protection and we confirm it stops the issue, both in the example above and in the original unreduced code. In GNU Emacs 26.0.90 (build 1, x86_64-pc-linux-gnu) of 2017-10-30 built on igm-qws-u12051a Repository revision: 46540a1c7adb1b89b6c2f6c9150fe8680c3a5fba System Description: CentOS Linux release 7.4.1708 (Core) Recent messages: For information about GNU Emacs and the GNU system, type C-h C-a. Making completion list... apropos-read-pattern: Command attempted to use minibuffer while in minibuffer Configured using: 'configure --with-gnutls=no --without-x --without-gsettings --without-gpm --without-dbus --without-gconf --without-selinux --without-imagemagick --with-gif=no --with-modules --disable-acl -prefix /home/vgatien-baron/local/clones/emacs/installed' Configured features: JPEG SOUND NOTIFY LIBXML2 ZLIB MODULES Important settings: value of $LANG: en_US.utf8 locale-coding-system: utf-8-unix Major mode: Lisp Interaction Minor modes in effect: tooltip-mode: t global-eldoc-mode: t eldoc-mode: t electric-indent-mode: t file-name-shadow-mode: t global-font-lock-mode: t font-lock-mode: t auto-composition-mode: t auto-encryption-mode: t auto-compression-mode: t line-number-mode: t transient-mark-mode: t Load-path shadows: None found. Features: (shadow sort mail-extr apropos emacsbug message rmc puny dired dired-loaddefs format-spec rfc822 mml mml-sec epa derived epg gnus-util rmail rmail-loaddefs mm-decode mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail regexp-opt rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils term/xterm xterm time-date elec-pair warnings finder-inf info tool-bar zenburn-theme-autoloads package easymenu epg-config url-handlers url-parse auth-source cl-seq eieio eieio-core cl-macs eieio-loaddefs password-cache url-vars seq byte-opt gv bytecomp byte-compile cconv cl-loaddefs cl-lib mule-util tooltip eldoc electric uniquify ediff-hook vc-hooks lisp-float-type tabulated-list replace newcomment text-mode elisp-mode lisp-mode prog-mode register page menu-bar rfn-eshadow isearch timer select mouse jit-lock font-lock syntax facemenu font-core term/tty-colors frame cl-generic cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european ethiopic indian cyrillic chinese composite charscript charprop case-table epa-hook jka-cmpr-hook help simple abbrev obarray minibuffer cl-preloaded nadvice loaddefs button faces cus-face macroexp files text-properties overlay sha1 md5 base64 format env code-pages mule custom widget hashtable-print-readable backquote inotify multi-tty make-network-process emacs) Memory information: ((conses 16 179056 9590) (symbols 48 24756 1) (miscs 40 36 144) (strings 32 53443 1520) (string-bytes 1 1383070) (vectors 16 18475) (vector-slots 8 545400 4472) (floats 8 51 765) (intervals 56 225 0) (buffers 992 14) (heap 1024 24122 1231))