Re: Message's text-properties in *Messages*

[Stefan Monnier <monnier@iro.umontreal.ca>]

>> - Why would arbitrary Lisp code be dangerous (I understand that message_dolog
>>   can be called from within redisplay, but redisplay runs Elisp code
>>   at several places, so "from redisplay" doesn't inherently imply you
>>   can't run Elisp code).
> When Lisp code is called from redisplay, we always do that via
> safe_call.  Anything else is not safe, AFAIR.

I see.  This doesn't answer all the questions, tho:

- The current code still does

    call0 (intern ("messages-buffer-mode"));

  hence doesn't use safe_call here.  This is likely a bug (introduced
  when we added messages-buffer-mode) and it hasn't bitten us simply
  because it's run rarely enough (only after you kill the *Messages*
  buffer) and by default it probably doesn't do anything dangerous, so
  to trigger this bug, we'd need a "perfect storm" (i.e. set
  a nasty messages-buffer-mode-hook, then kill *Messages*, then arrange
  for the next message to come from within the redisplay code).

- AFAICT message_dolog avoids running before/after change functions, so
  the comment about the GC being sometimes called because we run
  before/after change hooks seems odd.

- If after/before change functions do end up called, are they really
  called via safe_call?  I don't see any trace of that.

- Would let-binding inhibit-foo-hooks good enough to avoid running
  Elisp code unsafely?


        Stefan