bug#39962: 27.0.90; Crash in Emacs 27.0.90

[Pip Cet <pipcet@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 746 bytes --]

On Thu, Mar 19, 2020 at 1:23 PM Pieter van Oostrum
<pieter-l@vanoostrum.org> wrote:
> (gdb) p ((Lisp_Object) {(Lisp_Word) (0xd4269c0)})
> $5 = XIL(0xd4269c0)
> (gdb) xsymbol
> $6 = (struct Lisp_Symbol *) 0x10de5f6d0
> "<v>"

Okay, so that symbol is valid.

I think it's not a coincidence this crash happens during
keyboard/mouse input. I'm attaching a patch which increases the window
for the race condition that I think is happening. It slows down Emacs
significantly, but it should still be almost usable.

If you have the time, could you install the patch, start Emacs the
same way you did to produce your original crash, and do similar things
you did that time? If we're lucky, we'll be getting an assert failure
rather than mere corruption.

[-- Attachment #2: 0001-more-debugging.patch --]
[-- Type: text/x-patch, Size: 3519 bytes --]

From a5eb17ceb961d630c1c1c9f6963e95595c071a40 Mon Sep 17 00:00:00 2001
From: Pip Cet <pipcet@gmail.com>
Date: Tue, 17 Mar 2020 13:51:31 +0000
Subject: [PATCH] more debugging

---
 src/alloc.c  | 19 +++++++++++++++++--
 src/bignum.c |  2 ++
 src/lisp.h   |  2 +-
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/src/alloc.c b/src/alloc.c
index 469c4445bb..70e1736b01 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -234,7 +234,7 @@ #define GC_DEFAULT_THRESHOLD (100000 * word_size)
 
 /* True during GC.  */
 
-bool gc_in_progress;
+volatile bool gc_in_progress;
 
 /* System byte and object counts reported by GC.  */
 
@@ -711,6 +711,8 @@ xmalloc (size_t size)
   if (!val && size)
     memory_full (size);
   MALLOC_PROBE (size);
+  if (val)
+    memset (val, 0xaa, size);
   return val;
 }
 
@@ -1301,7 +1303,10 @@ lmalloc (size_t size)
     {
       void *p = malloc (size);
       if (laligned (p, size))
-	return p;
+	{
+	  memset (p, 0x5a, size);
+	  return p;
+	}
       free (p);
       size_t bigger = size + LISP_ALIGNMENT;
       if (size < bigger)
@@ -3095,6 +3100,7 @@ sweep_vectors (void)
 #ifndef GC_MALLOC_CHECK
 	  mem_delete (mem_find (block->data));
 #endif
+	  memset (block, 0x55, VECTOR_BLOCK_BYTES);
 	  xfree (block);
 	}
       else
@@ -3140,6 +3146,10 @@ #define VECTOR_ELTS_MAX \
 static struct Lisp_Vector *
 allocate_vectorlike (ptrdiff_t len)
 {
+  eassert (!gc_in_progress);
+  gc_in_progress = true;
+  struct timespec ts = make_timespec (0, 1000000);
+  nanosleep (&ts, NULL);
   eassert (0 < len && len <= VECTOR_ELTS_MAX);
   ptrdiff_t nbytes = header_size + len * word_size;
   struct Lisp_Vector *p;
@@ -3175,6 +3185,7 @@ allocate_vectorlike (ptrdiff_t len)
 
   MALLOC_UNBLOCK_INPUT;
 
+  gc_in_progress = false;
   return ptr_bounds_clip (p, nbytes);
 }
 
@@ -5869,6 +5880,8 @@ garbage_collect (void)
   if (garbage_collection_inhibited)
     return;
 
+  eassert (!gc_in_progress);
+
   /* Record this function, so it appears on the profiler's backtraces.  */
   record_in_backtrace (QAutomatic_GC, 0, 0);
 
@@ -5935,6 +5948,8 @@ garbage_collect (void)
   shrink_regexp_cache ();
 
   gc_in_progress = 1;
+  struct timespec ts = make_timespec (0, 1000000);
+  nanosleep (&ts, NULL);
 
   /* Mark all the special slots that serve as the roots of accessibility.  */
 
diff --git a/src/bignum.c b/src/bignum.c
index 51d90ffaef..8e0c0ead01 100644
--- a/src/bignum.c
+++ b/src/bignum.c
@@ -90,6 +90,7 @@ make_bignum_bits (size_t bits)
   if (integer_width < bits && 2 * max (INTMAX_WIDTH, UINTMAX_WIDTH) < bits)
     overflow_error ();
 
+  eassert (!gc_in_progress);
   struct Lisp_Bignum *b = ALLOCATE_PLAIN_PSEUDOVECTOR (struct Lisp_Bignum,
 						       PVEC_BIGNUM);
   mpz_init (b->value);
@@ -424,6 +425,7 @@ bignum_to_string (Lisp_Object num, int base)
 Lisp_Object
 make_bignum_str (char const *num, int base)
 {
+  eassert (!gc_in_progress);
   struct Lisp_Bignum *b = ALLOCATE_PLAIN_PSEUDOVECTOR (struct Lisp_Bignum,
 						       PVEC_BIGNUM);
   mpz_init (b->value);
diff --git a/src/lisp.h b/src/lisp.h
index 8674fe11a6..4c94085170 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -4006,7 +4006,7 @@ #define ALLOCATE_ZEROED_PSEUDOVECTOR(type, field, tag)		       \
 				   PSEUDOVECSIZE (type, field),	       \
 				   VECSIZE (type), tag))
 
-extern bool gc_in_progress;
+extern volatile bool gc_in_progress;
 extern Lisp_Object make_float (double);
 extern void display_malloc_warning (void);
 extern ptrdiff_t inhibit_garbage_collection (void);
-- 
2.25.1