bug#6378: all-completions Segfault

[Lawrence Mitchell <wence@gmx.li>]

Nathan Weizenbaum wrote:
> This segfaults me on GNU Emacs 24.0.50.1 (i686-pc-linux-gnu, GTK+ Version
> 2.16.1) of 2010-05-09:

>   (all-completions "" [])

> I think the problem is on line 1593 of src/minibuf.c, but my
> Emacs-innards-fu isn't good enough to attempt a fix.

I think this patch should fix things

diff --git a/src/minibuf.c b/src/minibuf.c
index ad81bfd..1d93901 100644
--- a/src/minibuf.c
+++ b/src/minibuf.c
@@ -1590,7 +1590,7 @@ with a space are ignored unless STRING itself starts with a space.  */)
   if (type == 2)
     {
       obsize = XVECTOR (collection)->size;
-      bucket = XVECTOR (collection)->contents[index];
+      bucket = obsize == 0 ? zero : XVECTOR (collection)->contents[index];
     }
 
   while (1)


Although I don't understand why the code-path for the vector
version can't be simplified as in the following patch, which also
fixes the problem AFAICT:

diff --git a/src/minibuf.c b/src/minibuf.c
index ad81bfd..c6aae27 100644
--- a/src/minibuf.c
+++ b/src/minibuf.c
@@ -1610,22 +1610,14 @@ with a space are ignored unless STRING itself starts with a space.  */)
 	}
       else if (type == 2)
 	{
-	  if (!EQ (bucket, zero))
-	    {
-	      elt = bucket;
-	      eltstring = elt;
-	      if (XSYMBOL (bucket)->next)
-		XSETSYMBOL (bucket, XSYMBOL (bucket)->next);
-	      else
-		XSETFASTINT (bucket, 0);
-	    }
-	  else if (++index >= obsize)
-	    break;
-	  else
-	    {
-	      bucket = XVECTOR (collection)->contents[index];
-	      continue;
-	    }
+          if ( index < obsize )
+            {
+              elt = bucket;
+              eltstring = elt;
+              bucket = XVECTOR (collection)->contents[++index];
+            }
+          else
+            break;
 	}
       else /* if (type == 3) */
 	{

Cheers,
Lawrence
-- 
Lawrence Mitchell <wence@gmx.li>