Subject: 29.0.50; abort-redisplay: Crash after 'recenter'

From: Florian Rommel <[email-masked]>
Date: Sun, 03 Jul 2022 17:55:50 +0200

Tags: patch

I get a crash caused by a failed free() [see attached backtrace] when
running vterm [1] which calls 'recenter' from a loaded module.
With gdb, in 'safe_free' I see that the address of the to-be-freed
arguments array (allocated in 'module_funcall') is off by one word.

I don't know the details of the specpdl stack but I assume that there
is a missing 'ubind_to' in 'recenter' before an early return.  When I
add it (see the attached patch) the problem is gone.

[1] https://github.com/akermu/emacs-libvterm

From b09b6f96accf2212482eab6795ba6f74583a39e3 Mon Sep 17 00:00:00 2001
From: Florian Rommel <[email-masked]>
Date: Sun, 3 Jul 2022 17:04:32 +0200
Subject: [PATCH] abort-redisplay: Add missing unbind_to in 'recenter'

* src/window.c (recenter): Add ubind_to before early return.
---
 src/window.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/window.c b/src/window.c
index ad03a02758..af463b90ce 100644
--- a/src/window.c
+++ b/src/window.c
@@ -6667,6 +6667,7 @@ DEFUN ("recenter", Frecenter, Srecenter, 0, 2, "P\np",
 	  if (h <= 0)
 	    {
 	      bidi_unshelve_cache (itdata, false);
+	      unbind_to (count, Qnil);
 	      return Qnil;
 	    }
 
-- 
2.37.0