Subject: Re: bug#29066: 26.0.90; crash in gc involving buffer local symbols

From: Eli Zaretskii <[email-masked]>
Date: Tue, 31 Oct 2017 20:59:11 +0200

> From: Andreas Schwab <[email-masked]>
> Cc: Valentin Gatien-Baron <[email-masked]>,  [email-masked],  [email-masked]
> Date: Tue, 31 Oct 2017 07:32:14 +0100
> 
> On Okt 31 2017, Eli Zaretskii <[email-masked]> wrote:
> 
> >>            if (!sym->s.gcmarkbit)
> >>              {
> >> -              if (sym->s.redirect == SYMBOL_LOCALIZED)
> >> +              if (sym->s.redirect == SYMBOL_LOCALIZED) {
> >>                  xfree (SYMBOL_BLV (&sym->s));
> >> +                sym->s.val.blv = NULL;
> >> +              }
> >
> > That was my first attempt, but various macros like SYMBOL_BLV and
> > SET_SYMBOL_BLV insist on val.blv being non-NULL.
> 
> SET_SYMBOL_BLV doesn't.

Maybe I'm blind, or misunderstand what you mean, but if the intent was
to do this:

   SET_SYMBOL_BLV (&sym->s, NULL);

then it does:

  INLINE void
  SET_SYMBOL_BLV (struct Lisp_Symbol *sym, struct Lisp_Buffer_Local_Value *v)
  {
    eassume (sym->redirect == SYMBOL_LOCALIZED && v);  <<<<<<<<<<<<<<<<
    sym->val.blv = v;
  }

> And calling SYMBOL_BLV with a freed symbol is a bug anyway.

It isn't freed, it's on the symbol_free_list.  Only its buffer-local
value is freed.