GNU bug report logs - #58042
29.0.50; ASAN use-after-free in re_match_2_internal

Previous Next

Full log

View this message in rfc822 format

From: Eli Zaretskii <eliz <at> gnu.org>
To: Gerd Möllmann <gerd.moellmann <at> gmail.com>
Cc: alan <at> idiocy.org, 58042 <at> debbugs.gnu.org
Subject: bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal
Date: Wed, 05 Oct 2022 15:59:33 +0300

> From: Gerd Möllmann <gerd.moellmann <at> gmail.com>
> Cc: 58042 <at> debbugs.gnu.org, Alan Third <alan <at> idiocy.org>
> Date: Wed, 05 Oct 2022 12:14:04 +0200
> 
> Eli Zaretskii <eliz <at> gnu.org> writes:
> 
> > So I guess we should do this dance around calls to maybe_quit in
> > regex-emacs.c:
> >
> >   specpdl_ref gc_count = inhibit_garbage_collection ();
> >   maybe_quit ();
> >   unbind_to (gc_count, Qnil);
> >
> > Or maybe even better, do this inside probably_quit (because who knows
> > how many other callers of maybe_quit could be hit by this unexpected
> > GC)?
> >
> > Can you try this?
> 
> Isn't the -[EmacsView layoutSublayersOfLayer:] the problem?  AFAICT from
> a web search, this is an event handler method that is also called from
> by the framework?
> 
> In the olden days, it was a serious error to call into Lisp from an
> event handler.  All bets were off when that happened, not only related
> to GC.  I believe that hasn't changed much.
> 
> That code was introduced by Alan around this time.
> 
> 1ba02d85a964e1b2c6a9735cd3decdc524e06dc1
> Author:     Alan Third <alan <at> idiocy.org>
> AuthorDate: Sat Jun 12 10:25:47 2021 +0100
> Commit:     Alan Third <alan <at> idiocy.org>
> CommitDate: Sat Jul 31 11:13:05 2021 +0100
> 
> Maybe Allen can say something, I've CC'd him.

AFAIR, this was the best way Alan could fix display problems on
macOS.  He tried several other approaches, and all of them were worse.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.