bug#23704: 25.1.50; Emacs crash in syntax.c

[Andreas Schwab <schwab@suse.de>]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Andreas Schwab <schwab@suse.de>
>> Date: Mon, 06 Jun 2016 09:36:07 +0200
>> Cc: 23704@debbugs.gnu.org
>> 
>> > 2233                  if (! fastmap[SYNTAX (*p)])
>> 
>> I think I have seen a similar crash with the emacs-25 branch as well,
>> but only once, and I couldn't reproduce it so far.
>
> If my reading of the code is correct, we have pointers to buffer text
> and the gap lying around, while invoking code that can GC (which
> compacts buffers).  For example, the sequence of calls
>
>    SETUP_SYNTAX_TABLE
>     -> SETUP_BUFFER_SYNTAX_TABLE
>         -> update_syntax_table_forward
>            -> parse_sexp_propertize
>
> could call Lisp, and that happens after we already computed the values
> of p, endp, and stop.  Likewise the call to UPDATE_SYNTAX_TABLE_FORWARD
> we make inside the loop.
>
> If GC decides to compact the gap, it could well make a previously
> valid pointer invalid.
>
> Could that be the reason?

Yes, that looks very likely.

Andreas.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."