Hello,

Since updating to 29.4, my Emacs has suffered segmentation faults when I
attempt my usual Rust programming workflow.

The crash occurs during live update of a Corfu completion window in a
buffer containing Rust code, with lsp-mode enabled and connected to
rust-analyzer.

When I first triggered the bug, quick inputs (like rolling a finger from
key to key) which changed the current completion list, would cause the
crash.

With my minimal configuration, the most effective reproduction is to
trigger completion on a pair of characters, for which different completions
appear if their order is swapped, then transpose them until the crash
occurs.

The crash seems to only happen when the cape-capf-buster function from Cape
is installed to refresh the completion candidates.

I did not succeed in reproducing this issue with the clangd LSP backend.

I know that this is a bug in Emacs because it occurs in 29.4 and not in
29.3, with no changes to any other piece of the system. A cursory check
indicates no issue on dev version 31.0.50.173746.

Thank you for reading. See below for specific information.

Matthew Rothlisberger

* Minimal system packages required:
emacs (29.4), rust-analyzer, rustup.

* Minimal Emacs configuration:
#+BEGIN_SRC emacs-lisp
(require 'package)
(add-to-list 'package-archives
             '("melpa" . "https://melpa.org/packages/") t)

(package-initialize)

(unless package-archive-contents
  (package-refresh-contents))

(require 'use-package-ensure)
(setq use-package-always-ensure t)

(use-package cape)

(use-package corfu
  :custom
  (corfu-auto t)
  :init
  (global-corfu-mode))

(setq lsp-rust-server 'rust-analyzer)

(use-package lsp-mode
  :custom
  (lsp-completion-provider :none)
  :init
  (defun my/lsp-mode-setup-completion ()
    (setf (alist-get 'styles (alist-get 'lsp-capf
completion-category-defaults))
          '(flex))
    (setq-local completion-at-point-functions (list (cape-capf-buster
#'lsp-completion-at-point))) ;; <-- this line appears to make the difference
    )
  :hook
  (lsp-completion-mode . my/lsp-mode-setup-completion)
  :commands lsp)
#+END_SRC

* Minimal local file generation:
$ rustup install stable
$ cargo new testproj

* Minimal reproduction steps:
C-x C-f testproj/src/main.rs
M-x lsp
<RET>
<RET>
C-<
use std::at
(completion box should appear after entering the above)
C-t
... (hold C-t until segmentation fault; usually happens promptly)

* Output from coredumpctl gdb
(gdb) bt full
#0  0x00007a516d01fe44 in ?? () from /usr/lib/libc.so.6
No symbol table info available.
#1  0x00007a516cfc7a30 in raise () from /usr/lib/libc.so.6
No symbol table info available.
#2  0x0000588eed79a982 in ?? ()
No symbol table info available.
#3  0x0000588eed79b75a in ?? ()
No symbol table info available.
#4  0x0000588eeda4a545 in ?? ()
No symbol table info available.
#5  <signal handler called>
No symbol table info available.
#6  0x0000588eed99a22b in ?? ()
No symbol table info available.
#7  0x0000588eed8ef5f1 in ?? ()
No symbol table info available.
... (and so on for dozens of lines (this is the case even with debuginfo
loaded))

(gdb) xbacktrace
Undefined command: "xbacktrace".  Try "help".

* Output from report-emacs-bug
In GNU Emacs 29.4 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.24.42,
cairo version 1.18.0)
Windowing system distributor 'The X.Org Foundation', version 11.0.12101013
System Description: Arch Linux

Configured using:
 'configure --sysconfdir=/etc --prefix=/usr --libexecdir=/usr/lib
 --with-tree-sitter --localstatedir=/var --with-cairo
 --disable-build-details --with-harfbuzz --with-libsystemd
 --with-modules --with-x-toolkit=gtk3 'CFLAGS=-march=x86-64
 -mtune=generic -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3
 -Wformat -Werror=format-security -fstack-clash-protection
 -fcf-protection -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -g
 -ffile-prefix-map=/build/emacs/src=/usr/src/debug/emacs -flto=auto'
 'LDFLAGS=-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro
 -Wl,-z,now -Wl,-z,pack-relative-relocs -flto=auto''

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ JPEG
JSON LCMS2 LIBOTF LIBSYSTEMD LIBXML2 M17N_FLT MODULES NOTIFY INOTIFY
PDUMPER PNG RSVG SECCOMP SOUND SQLITE3 THREADS TIFF TOOLKIT_SCROLL_BARS
TREE_SITTER WEBP X11 XDBE XIM XINPUT2 XPM GTK3 ZLIB

Important settings:
  value of $LANG: C.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Fundamental

Minor modes in effect:
  flymake-mode: t
  lsp-diagnostics-mode: t
  lsp-headerline-breadcrumb-mode: t
  lsp-modeline-workspace-status-mode: t
  lsp-modeline-diagnostics-mode: t
  lsp-modeline-code-actions-mode: t
  lsp-lens-mode: t
  lsp-completion-mode: t
  lsp-managed-mode: t
  lsp-mode: t
  global-corfu-mode: t
  corfu-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  line-number-mode: t
  indent-tabs-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message yank-media dired dired-loaddefs
rfc822 mml mml-sec epa derived gnus-util mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047
rfc2045 ietf-drums mm-util mail-prsvr mail-utils time-date flymake-proc
flymake warnings lsp-diagnostics lsp-headerline lsp-icons lsp-modeline
lsp-lens view lsp-zig lsp-yang lsp-yaml lsp-xml lsp-wgsl lsp-volar
lsp-vimscript lsp-vhdl lsp-vetur lsp-html lsp-verilog lsp-vala lsp-v
lsp-typeprof lsp-ttcn3 lsp-trunk lsp-toml lsp-tilt lsp-tex lsp-terraform
lsp-svelte lsp-steep lsp-sqls lsp-sql lsp-sorbet lsp-solidity
lsp-solargraph lsp-semgrep lsp-rust lsp-ruff-lsp lsp-ruby-syntax-tree
lsp-ruby-lsp lsp-rubocop lsp-rf lsp-remark lsp-racket lsp-r lsp-qml
lsp-pylsp lsp-pyls lsp-pwsh lsp-purescript lsp-pls lsp-php
lsp-perlnavigator lsp-perl lsp-openscad lsp-ocaml lsp-nushell lsp-nix
lsp-nim lsp-nginx lsp-move lsp-mojo lsp-mint lsp-meson lsp-mdx
lsp-marksman lsp-markdown lsp-magik lsp-lua lsp-lisp lsp-kotlin lsp-json
lsp-jq lsp-javascript lsp-idris lsp-haxe lsp-hack lsp-groovy lsp-graphql
lsp-golangci-lint lsp-glsl lsp-gleam lsp-gdscript lsp-fsharp lsp-fortran
lsp-eslint lsp-erlang lsp-emmet lsp-elm lsp-elixir lsp-earthly
lsp-dockerfile lsp-dhall lsp-d lsp-cypher lsp-cucumber lsp-css
lsp-csharp gnutls lsp-crystal lsp-credo lsp-cobol lsp-cmake lsp-clojure
lsp-clangd dom lsp-bufls lsp-go lsp-completion lsp-beancount lsp-bash
lsp-awk lsp-autotools lsp-astro lsp-asm lsp-ansible lsp-angular lsp-ada
lsp-semantic-tokens lsp-actionscript lsp-mode lsp-protocol xref project
tree-widget wid-edit spinner pcase network-stream puny nsm markdown-mode
rx color thingatpt noutline outline icons lv inline imenu ht filenotify
f s ewoc epg rfc6068 epg-config dash compile text-property-search comint
ansi-osc ansi-color ring vc-git diff-mode easy-mmode vc-dispatcher corfu
cape compat cl-extra help-mode use-package-ensure use-package-core
finder-inf cape-autoloads corfu-autoloads compat-autoloads
lsp-mode-autoloads ht-autoloads f-autoloads info dash-autoloads
lv-autoloads markdown-mode-autoloads s-autoloads spinner-autoloads
package browse-url url url-proxy url-privacy url-expand url-methods
url-history url-cookie generate-lisp-file url-domsuf url-util mailcap
url-handlers url-parse auth-source cl-seq eieio eieio-core cl-macs
password-cache json subr-x map byte-opt gv bytecomp byte-compile
url-vars cl-loaddefs cl-lib rmc iso-transl tooltip cconv eldoc paren
electric uniquify ediff-hook vc-hooks lisp-float-type elisp-mode mwheel
term/x-win x-win term/common-win x-dnd tool-bar dnd fontset image
regexp-opt fringe tabulated-list replace newcomment text-mode lisp-mode
prog-mode register page tab-bar menu-bar rfn-eshadow isearch easymenu
timer select scroll-bar mouse jit-lock font-lock syntax font-core
term/tty-colors frame minibuffer nadvice seq simple cl-generic
indonesian philippine cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
composite emoji-zwj charscript charprop case-table epa-hook
jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button loaddefs
theme-loaddefs faces cus-face macroexp files window text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget keymap
hashtable-print-readable backquote threads dbusbind inotify lcms2
dynamic-setting system-font-setting font-render-setting cairo
move-toolbar gtk x-toolkit xinput2 x multi-tty make-network-process
emacs)

Memory information:
((conses 16 385317 19912)
 (symbols 48 28244 0)
 (strings 32 141070 3514)
 (string-bytes 1 3381789)
 (vectors 16 56432)
 (vector-slots 8 876785 30432)
 (floats 8 186 41)
 (intervals 56 436 0)
 (buffers 984 15))