Subject: bug#56369: closed (Re: bug#56369: 29.0.50; abort-redisplay: Crash after 'recenter')

From: [email-masked] (GNU bug Tracking System)
Date: Sun, 03 Jul 2022 16:12:02 +0000

Your bug report

#56369: 29.0.50; abort-redisplay: Crash after 'recenter'

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
56369: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=56369
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#56369: 29.0.50; abort-redisplay: Crash after 'recenter'
From: Eli Zaretskii <[email-masked]>
To: [email-masked]
Date: Sun, 03 Jul 2022 19:11:09 +0300
List-Id: <debbugs-submit.debbugs.gnu.org>

Closing.

Subject: 29.0.50; abort-redisplay: Crash after 'recenter'
From: Florian Rommel <[email-masked]>
To: [email-masked]
Date: Sun, 03 Jul 2022 17:55:50 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Tags: patch

I get a crash caused by a failed free() [see attached backtrace] when
running vterm [1] which calls 'recenter' from a loaded module.
With gdb, in 'safe_free' I see that the address of the to-be-freed
arguments array (allocated in 'module_funcall') is off by one word.

I don't know the details of the specpdl stack but I assume that there
is a missing 'ubind_to' in 'recenter' before an early return.  When I
add it (see the attached patch) the problem is gone.

[1] https://github.com/akermu/emacs-libvterm

From b09b6f96accf2212482eab6795ba6f74583a39e3 Mon Sep 17 00:00:00 2001
From: Florian Rommel <[email-masked]>
Date: Sun, 3 Jul 2022 17:04:32 +0200
Subject: [PATCH] abort-redisplay: Add missing unbind_to in 'recenter'

* src/window.c (recenter): Add ubind_to before early return.
---
 src/window.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/window.c b/src/window.c
index ad03a02758..af463b90ce 100644
--- a/src/window.c
+++ b/src/window.c
@@ -6667,6 +6667,7 @@ DEFUN ("recenter", Frecenter, Srecenter, 0, 2, "P\np",
 	  if (h <= 0)
 	    {
 	      bidi_unshelve_cache (itdata, false);
+	      unbind_to (count, Qnil);
 	      return Qnil;
 	    }
 
-- 
2.37.0