Subject: bug#30931: closed (Re: bug#30931: abort() due to CHECK_ALLOCATED_AND_LIVE failure during GC)

From: [email-masked] (GNU bug Tracking System)
Date: Fri, 30 Mar 2018 21:30:02 +0000

Your bug report

#30931: abort() due to CHECK_ALLOCATED_AND_LIVE failure during GC

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
30931: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=30931
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#30931: abort() due to CHECK_ALLOCATED_AND_LIVE failure during GC
From: Paul Eggert <[email-masked]>
To: Noam Postavsky <[email-masked]>
Cc: Eli Zaretskii <[email-masked]>, [email-masked],Michał Kondraciuk <[email-masked]>
Date: Fri, 30 Mar 2018 14:29:07 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

Thanks, I installed that along with the attached minor refactoring so 
that the bugfix is in just one place. Closing the bug.

I assume that this fix should not be backported into the emacs-26 
branch, as the bug is in Emacs 25.
>From 529377bc392039dc253c8b5f2410964c8581ffd9 Mon Sep 17 00:00:00 2001
From: Paul Eggert <[email-masked]>
Date: Fri, 30 Mar 2018 14:23:55 -0700
Subject: [PATCH] Centralize Bug#30931 fix

* src/marker.c (detach_marker): New function.
* src/editfns.c (save_restriction_restore):
* src/insdel.c (signal_before_change): Use it.
---
 src/editfns.c |  9 +++------
 src/insdel.c  |  7 ++-----
 src/lisp.h    |  3 ++-
 src/marker.c  | 13 +++++++++++--
 4 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/src/editfns.c b/src/editfns.c
index 84de679273..608304c09a 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -3899,12 +3899,9 @@ save_restriction_restore (Lisp_Object data)
 
 	  buf->clip_changed = 1; /* Remember that the narrowing changed. */
 	}
-      /* This isn’t needed anymore, so don’t wait for GC.  Do not call
-         free_marker on XCAR (data) or XCDR (data), though, since
-         record_marker_adjustments may have put them on the buffer’s
-         undo list (Bug#30931).  Just detach them instead.  */
-      Fset_marker (XCAR (data), Qnil, Qnil);
-      Fset_marker (XCDR (data), Qnil, Qnil);
+      /* Detach the markers, and free the cons instead of waiting for GC.  */
+      detach_marker (XCAR (data));
+      detach_marker (XCDR (data));
       free_cons (XCONS (data));
     }
   else
diff --git a/src/insdel.c b/src/insdel.c
index 697395c507..173c243834 100644
--- a/src/insdel.c
+++ b/src/insdel.c
@@ -2148,13 +2148,10 @@ signal_before_change (ptrdiff_t start_int, ptrdiff_t end_int,
 				   FETCH_START, FETCH_END, Qnil);
     }
 
-  /* Detach the markers now that we're done with them.  Don't directly
-     free them, since the change functions could have caused them to
-     be inserted into the undo list (Bug#30931).  */
   if (! NILP (start_marker))
-    Fset_marker (start_marker, Qnil, Qnil);
+    detach_marker (start_marker);
   if (! NILP (end_marker))
-    Fset_marker (end_marker, Qnil, Qnil);
+    detach_marker (end_marker);
   RESTORE_VALUE;
 
   unbind_to (count, Qnil);
diff --git a/src/lisp.h b/src/lisp.h
index f471b21658..c931d9c8f0 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -4104,7 +4104,8 @@ extern ptrdiff_t marker_byte_position (Lisp_Object);
 extern void clear_charpos_cache (struct buffer *);
 extern ptrdiff_t buf_charpos_to_bytepos (struct buffer *, ptrdiff_t);
 extern ptrdiff_t buf_bytepos_to_charpos (struct buffer *, ptrdiff_t);
-extern void unchain_marker (struct Lisp_Marker *marker);
+extern void detach_marker (Lisp_Object);
+extern void unchain_marker (struct Lisp_Marker *);
 extern Lisp_Object set_marker_restricted (Lisp_Object, Lisp_Object, Lisp_Object);
 extern Lisp_Object set_marker_both (Lisp_Object, Lisp_Object, ptrdiff_t, ptrdiff_t);
 extern Lisp_Object set_marker_restricted_both (Lisp_Object, Lisp_Object,
diff --git a/src/marker.c b/src/marker.c
index 2a45ae636e..2d5b05cc2b 100644
--- a/src/marker.c
+++ b/src/marker.c
@@ -560,7 +560,7 @@ POSITION is nil, makes marker point nowhere so it no longer slows down
 editing in any buffer.  Returns MARKER.  */)
   (Lisp_Object marker, Lisp_Object position, Lisp_Object buffer)
 {
-  return set_marker_internal (marker, position, buffer, 0);
+  return set_marker_internal (marker, position, buffer, false);
 }
 
 /* Like the above, but won't let the position be outside the visible part.  */
@@ -569,7 +569,7 @@ Lisp_Object
 set_marker_restricted (Lisp_Object marker, Lisp_Object position,
 		       Lisp_Object buffer)
 {
-  return set_marker_internal (marker, position, buffer, 1);
+  return set_marker_internal (marker, position, buffer, true);
 }
 
 /* Set the position of MARKER, specifying both the
@@ -616,6 +616,15 @@ set_marker_restricted_both (Lisp_Object marker, Lisp_Object buffer,
   return marker;
 }
 
+/* Detach a marker so that it no longer points anywhere and no longer
+   slows down editing.  Do not free the marker, though, as a change
+   function could have inserted it into an undo list (Bug#30931).  */
+void
+detach_marker (Lisp_Object marker)
+{
+  Fset_marker (marker, Qnil, Qnil);
+}
+
 /* Remove MARKER from the chain of whatever buffer it is in,
    leaving it points to nowhere.  This is called during garbage
    collection, so we must be careful to ignore and preserve
-- 
2.14.3

Subject: 27.0.50; Crash in "Automatic GC"
From: Michał Kondraciuk <[email-masked]>
To: [email-masked]
Date: Sat, 24 Mar 2018 21:30:56 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

Newest Emacs (and 25.3) crashes for me. Unfortunately I can only 
reproduce this using newest versions of Ivy and yasnippet packages.

Backtrace (full backtrace in attachment):

#0  0x00007ffff1190269 in raise (sig=6) at 
../sysdeps/unix/sysv/linux/pt-raise.c:35
#1  0x0000000000568a3a in terminate_due_to_signal (sig=6, 
backtrace_limit=40) at ../../src/emacs.c:395
#2  0x000000000058fc5d in emacs_abort () at ../../src/sysdep.c:2426
#3  0x000000000061719a in signal_or_quit (error_symbol=XIL(0x7b60), 
data=XIL(0x232e613), keyboard_quit=false) at ../../src/eval.c:1595
#4  0x00000000006170f1 in Fsignal (error_symbol=XIL(0x7b60), 
data=XIL(0x232e613)) at ../../src/eval.c:1565
#5  0x00000000005663e3 in xsignal (error_symbol=XIL(0x7b60), 
data=XIL(0x232e613)) at ../../src/lisp.h:3944
#6  0x00000000006175d9 in xsignal1 (error_symbol=XIL(0x7b60), 
arg=XIL(0x2233484)) at ../../src/eval.c:1702
#7  0x00000000005cddda in compile_pattern_1 (cp=0xcc4440 
<searchbufs+6688>, pattern=XIL(0x1904bf4), translate=XIL(0), 
posix=false) at ../../src/search.c:165
#8  0x00000000005ce09a in compile_pattern (pattern=XIL(0x1904bf4), 
regp=0x0, translate=XIL(0), posix=false, multibyte=true) at 
../../src/search.c:248
#9  0x00000000005ceb94 in fast_string_match_internal 
(regexp=XIL(0x1904bf4), string=XIL(0x1c99f34), table=XIL(0)) at 
../../src/search.c:481
#10 0x0000000000566444 in fast_string_match (regexp=XIL(0x1904bf4), 
string=XIL(0x1c99f34)) at ../../src/lisp.h:4150
#11 0x00000000005b2ca9 in Ffind_file_name_handler 
(filename=XIL(0x1c99f34), operation=XIL(0x5580)) at ../../src/fileio.c:306
#12 0x00000000005b39f6 in Fexpand_file_name (name=XIL(0x1c99f34), 
default_directory=XIL(0)) at ../../src/fileio.c:783
#13 0x00000000005bf41f in Fdo_auto_save (no_message=XIL(0xc0f0), 
current_only=XIL(0)) at ../../src/fileio.c:5574
#14 0x000000000056b219 in shut_down_emacs (sig=6, stuff=XIL(0)) at 
../../src/emacs.c:2111
#15 0x00000000005689e1 in terminate_due_to_signal (sig=6, 
backtrace_limit=40) at ../../src/emacs.c:378
#16 0x000000000058fc5d in emacs_abort () at ../../src/sysdep.c:2426
#17 0x00000000005f4b7b in mark_object (arg=XIL(0x23b5e81)) at 
../../src/alloc.c:6707
#18 0x00000000005f4c4e in mark_object (arg=XIL(0x232e893)) at 
../../src/alloc.c:6725
#19 0x00000000005f4c4e in mark_object (arg=XIL(0x232e813)) at 
../../src/alloc.c:6725
#20 0x00000000005f19d5 in mark_maybe_object (obj=XIL(0x232e813)) at 
../../src/alloc.c:4844
#21 0x00000000005f1bb3 in mark_memory (start=0x7fffffff2d90, 
end=0x7fffffffdc58) at ../../src/alloc.c:4988
#22 0x00000000005f1be8 in mark_stack (bottom=0x7fffffffdc58 "", 
end=0x7fffffff2d90 "\240-\377\377\377\177") at ../../src/alloc.c:5195
#23 0x00000000006a0eff in mark_one_thread (thread=0xcfbac0 
<main_thread>) at ../../src/thread.c:616
#24 0x00000000006a1000 in mark_threads_callback (ignore=0x0) at 
../../src/thread.c:649
#25 0x00000000005f1c3e in flush_stack_call_func (func=0x6a0fba 
<mark_threads_callback>, arg=0x0) at ../../src/alloc.c:5222
#26 0x00000000006a102c in mark_threads () at ../../src/thread.c:656
#27 0x00000000005f3670 in garbage_collect_1 (end=0x7fffffff2f90) at 
../../src/alloc.c:6000
#28 0x00000000005f3d73 in Fgarbage_collect () at ../../src/alloc.c:6171
#29 0x000000000056655d in maybe_gc () at ../../src/lisp.h:4838
#30 0x000000000061a3ee in Ffuncall (nargs=3, args=0x7fffffff3048) at 
../../src/eval.c:2803
#31 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x21552e4), 
vector=XIL(0x2157365), maxdepth=make_number(9), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632
#32 0x000000000061b2f1 in funcall_lambda (fun=XIL(0x21573d5), nargs=2, 
arg_vector=0x2157365) at ../../src/eval.c:3104
#33 0x000000000061a4f3 in Ffuncall (nargs=3, args=0x7fffffff3500) at 
../../src/eval.c:2823
#34 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x2157a54), 
vector=XIL(0x2157775), maxdepth=make_number(7), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632
#35 0x000000000061b2f1 in funcall_lambda (fun=XIL(0x215ac45), nargs=2, 
arg_vector=0x2157775) at ../../src/eval.c:3104
#36 0x000000000061a4f3 in Ffuncall (nargs=3, args=0x7fffffff39c8) at 
../../src/eval.c:2823
#37 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x2157ab4), 
vector=XIL(0x215ac75), maxdepth=make_number(7), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632
#38 0x000000000061b2f1 in funcall_lambda (fun=XIL(0x215ad55), nargs=2, 
arg_vector=0x215ac75) at ../../src/eval.c:3104
#39 0x000000000061a4f3 in Ffuncall (nargs=3, args=0x7fffffff3f38) at 
../../src/eval.c:2823
#40 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x21651b4), 
vector=XIL(0x2165fb5), maxdepth=make_number(3), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632
#41 0x000000000061b2f1 in funcall_lambda (fun=XIL(0x2165fd5), nargs=0, 
arg_vector=0x2165fb5) at ../../src/eval.c:3104
#42 0x000000000061a4f3 in Ffuncall (nargs=1, args=0x7fffffff43b0) at 
../../src/eval.c:2823
#43 0x0000000000618c3f in eval_sub (form=XIL(0x232e6c3)) at 
../../src/eval.c:2257
#44 0x0000000000614e4f in Fprogn (body=XIL(0)) at ../../src/eval.c:455
#45 0x00000000006160c2 in Flet (args=XIL(0x232e6a3)) at ../../src/eval.c:969
#46 0x0000000000618a08 in eval_sub (form=XIL(0x232e693)) at 
../../src/eval.c:2238
#47 0x0000000000618443 in Feval (form=XIL(0x232e693), lexical=XIL(0)) at 
../../src/eval.c:2106
#48 0x000000000061a8f4 in funcall_subr (subr=0xc63a20 <Seval>, 
numargs=1, args=0x7fffffff4860) at ../../src/eval.c:2898
#49 0x000000000061a4af in Ffuncall (nargs=2, args=0x7fffffff4858) at 
../../src/eval.c:2821
#50 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x2165114), 
vector=XIL(0x2166005), maxdepth=make_number(8), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632

Lisp backtrace:

"Automatic GC" (0x0)
"mapcar" (0xffff3050)
"yas-active-snippets" (0xffff3508)
"yas--place-overlays" (0xffff39d0)
"yas--move-to-field" (0xffff3f40)
0x2165fd0 PVEC_COMPILED
"funcall" (0xffff43b0)
"let" (0xffff4600)
"eval" (0xffff4860)
"yas-expand-snippet" (0xffff4f60)
"yas--expand-or-prompt-for-template" (0xffff5440)
"yas-expand" (0xffff58f0)
"save-restriction" (0xffff5b40)
"save-current-buffer" (0xffff5cc0)
"update-fn" (0xffff5f10)
"ivy--insert-minibuffer" (0xffff63d0)
"ivy--exhibit" (0xffff6980)
"ivy--queue-exhibit" (0xffff6e30)
"execute-kbd-macro" (0xffff7230)
"while" (0xffff7350)
"let" (0xffff7570)
0x1251040 Lisp type 3
"apply" (0xffff7958)
"timer-event-handler" (0xffff7ea8)
"input-pending-p" (0xffff81e8)
"sit-for" (0xffff86c0)
"yas-expand-snippet" (0xffff8dc0)
"yas--expand-or-prompt-for-template" (0xffff92a0)
"yas-expand" (0xffff9750)
"save-restriction" (0xffff99a0)
"save-current-buffer" (0xffff9b20)
"update-fn" (0xffff9d70)
"ivy--insert-minibuffer" (0xffffa230)
"ivy--exhibit" (0xffffa7e0)
"ivy--minibuffer-setup" (0xffffacd0)
0x21d5720 PVEC_COMPILED
"read-from-minibuffer" (0xffffb598)
"ivy-read" (0xffffbd10)
"catch" (0xffffbfc0)
"while" (0xffffc170)
"let" (0xffffc390)
"let" (0xffffc5b0)
"progn" (0xffffc700)
"eval" (0xffffc990)
"eval-expression" (0xffffcfb0)
"funcall-interactively" (0xffffcfa8)
"call-interactively" (0xffffd3e0)
"command-execute" (0xffffd928)

Emacs first crashed for me on 25.3, when I was calling 
`yas-expand-snippet` inside `save-restriction` form inside `ivy-read`. I 
wrote this form to try to reproduce this:

(progn
   (package-initialize)
   (require 'yasnippet)
   (require 'ivy)

   (yas-reload-all)

   (switch-to-buffer "*scratch*")
   (lisp-interaction-mode)
   (yas-minor-mode-on)

   (let ((templates (mapcar #'yas--template-key
                            (yas--all-templates 
(yas--get-snippet-tables)))))
     (defun update-fn ()
       (with-current-buffer "*scratch*"
         (save-restriction
           (narrow-to-region 3 3)
           (insert " " (ivy-state-current ivy-last))
           (yas-expand)
           (mapc #'yas-abort-snippet (yas-active-snippets)))
         (redisplay)))
     (let ((buffer-undo-list t))
       (while t
         (erase-buffer)
         (insert "aaaaaa")
         (redisplay)
         (sit-for 0.1)
         (run-with-timer
          0.01 nil (lambda ()
                     (dotimes (_ (% (random) 15))
                       (execute-kbd-macro "\C-n")
                       (sit-for 0.05)
                       (redisplay)
                       (when (zerop (% (random) 4))
                         (execute-kbd-macro "\C-p")
                         (sit-for 0.05)
                         (redisplay)))
                     (sit-for 0.1)
                     (redisplay)
                     (abort-recursive-edit)))
         (catch 'exit
           (condition-case err
               (ivy-read "foo: " templates
                         :update-fn #'update-fn)
             (quit)))))))

Steps to reproduce:

1. Install newest ivy, yasnippet and yasnippet-snippets

2. Run emacs -Q

3. Eval form above

4. Typically emacs crashes after about 1-2 minutes

In GNU Emacs 27.0.50 (build 13, x86_64-pc-linux-gnu, GTK+ Version 3.18.9)
  of 2018-03-24 built on mkc
Repository revision: 4cfd2a2a92e2890af76bcd8375f966ce67ef2482
Windowing system distributor 'The X.Org Foundation', version 11.0.11804000
System Description: Linux Mint 18.2

Configured using:
  'configure 'CFLAGS=-O0 -g2''

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GSETTINGS NOTIFY
LIBSELINUX GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS GTK3 X11 THREADS LIBSYSTEMD LCMS2

Important settings:
   value of $LC_CTYPE: en_US.UTF-8
   value of $LC_MONETARY: pl_PL.UTF-8
   value of $LC_NUMERIC: pl_PL.UTF-8
   value of $LANG: en_US.UTF-8
   locale-coding-system: utf-8-unix