GNU bug report logs - #26961
26.0.50; Possible timming issue in regex-tests.el

Previous Next

Full log

Message #29 received at 26961 <at> debbugs.gnu.org (full text, mbox):

From: Tino Calancha <tino.calancha <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 26961 <at> debbugs.gnu.org, tino.calancha <at> gmail.com, schwab <at> suse.de
Subject: Re: bug#26961: 26.0.50; Possible timming issue in regex-tests.el
Date: Fri, 19 May 2017 20:38:40 +0900

Eli Zaretskii <eliz <at> gnu.org> writes:

>> +  AUTO_STRING (inner_format, "`?%c'");
>>    CALLN (Fmessage,
>>           format, file,
>> -         Fmapconcat (Qstring,
>> +         Fmapconcat (list3 (Qlambda, list1 (Qchar),
>> +                            list3 (Qformat, inner_format, Qchar)),
>>                       Fsort (Vlread_unescaped_character_literals, Qlss),
>>                       separator));
>>  }
>> 
>> Do you think this code is wrong?
>
> This does indeed look dangerous: we are in effect consing Lisp data
> structures from stack-based Lisp objects, and then process them in a
> way that could leave some of them lying around when this function
> returns, and its stack becomes invalid.
>
> Can you present the evidence that caused you to suspect this
> particular change?  Were the "unescaped character literals" warning
> displayed during the session which crashed?
Yes, such warning always appear in the crash session.
Loading ‘/home/calancha/soft/emacs-master/test/src/regex-tests.el’: unescaped character literals `?;' detected!
Running 22 tests (2017-05-19 20:24:31+0900)

If i print out the string, when the object is a cons with its car the string
to print, as follows:


--8<-----------------------------cut here---------------start------------->8---
diff --git a/src/alloc.c b/src/alloc.c
index faa14eebb3..20cfb3c88e 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -6664,7 +6664,32 @@ mark_object (Lisp_Object arg)
 	    cdr_count = 0;
 	    goto loop;
 	  }
-	mark_object (ptr->car);
+        po = XPNTR (ptr->car);
+        switch (XTYPE (ptr->car))
+          {
+          case Lisp_String:
+            {
+              if (!STRING_MARKED_P (XSTRING (ptr->car)) &&
+                  !PURE_P (po)                          &&
+                  mem_find (po) == MEM_NIL)
+                {
+                  fprintf (stderr, "[ERROR] mem_find (po) = MEM_NIL, cons %p car %s cdr %p\n",
+                           ptr, XSTRING (ptr->car)->data, XPNTR (ptr->u.cdr));
+                  return;
+                }
+              else
+                {
+                  fprintf (stderr, "[OK] cons %p car %s cdr %p\n",
+                           ptr, XSTRING (ptr->car)->data, XPNTR (ptr->u.cdr));
+                }
+              break;
+            }
+          default:
+            {
+              mark_object (ptr->car);
+            }
+          }
+        mark_object (ptr->car);
 	obj = ptr->u.cdr;
 	cdr_count++;
 	if (cdr_count == mark_object_loop_halt)

--8<-----------------------------cut here---------------end--------------->8---
Then, i see that right before the crash, the string printed out is the name
of the test file containinig the unescaped characters.

[OK] cons 0x2f0a8f0 car /home/calancha/soft/emacs-master/test/src/regex-resources/BOOST.tests cdr 0x2f0a8e0
[ERROR] mem_find (po) = MEM_NIL, cons 0x2f45150 car ‚ cdr 0x2f45140
[OK] cons 0x16d8720 car /home/calancha/soft/emacs-master/test/src/regex-resources/PCRE.tests cdr 0x16d8730
[ERROR] mem_find (po) = MEM_NIL, cons 0x2f45150 car ‚ cdr 0x2f45140
[OK] cons 0x3009910 car /home/calancha/soft/emacs-master/test/src/regex-resources/PTESTS cdr 0x3009900
[ERROR] mem_find (po) = MEM_NIL, cons 0x2f45150 car ‚ cdr 0x2f45140


With:
Fmapconcat (Qstring,
insted of:
Fmapconcat (list3 (Qlambda, list1 (Qchar),
                   list3 (Qformat, inner_format, Qchar)),

we still see the warning, as we should because the test file contains
those chars, but there is _no_ crash.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.