GNU bug report logs - #58042
29.0.50; ASAN use-after-free in re_match_2_internal

Previous Next

Full log

Message #71 received at 58042 <at> debbugs.gnu.org (full text, mbox):

From: Gerd Möllmann <gerd.moellmann <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: Alan Third <alan <at> idiocy.org>, 58042 <at> debbugs.gnu.org
Subject: Re: bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal
Date: Wed, 05 Oct 2022 12:14:04 +0200

Eli Zaretskii <eliz <at> gnu.org> writes:

> So I guess we should do this dance around calls to maybe_quit in
> regex-emacs.c:
>
>   specpdl_ref gc_count = inhibit_garbage_collection ();
>   maybe_quit ();
>   unbind_to (gc_count, Qnil);
>
> Or maybe even better, do this inside probably_quit (because who knows
> how many other callers of maybe_quit could be hit by this unexpected
> GC)?
>
> Can you try this?

Isn't the -[EmacsView layoutSublayersOfLayer:] the problem?  AFAICT from
a web search, this is an event handler method that is also called from
by the framework?

In the olden days, it was a serious error to call into Lisp from an
event handler.  All bets were off when that happened, not only related
to GC.  I believe that hasn't changed much.

That code was introduced by Alan around this time.

1ba02d85a964e1b2c6a9735cd3decdc524e06dc1
Author:     Alan Third <alan <at> idiocy.org>
AuthorDate: Sat Jun 12 10:25:47 2021 +0100
Commit:     Alan Third <alan <at> idiocy.org>
CommitDate: Sat Jul 31 11:13:05 2021 +0100

Maybe Allen can say something, I've CC'd him.

Or maybe we should add your fix, too?

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.