Subject: bug#76327: 29.4; random segfaults after switch to tree-sitter

From: Evgeniy Dushistov <[email-masked]>
Date: Thu, 20 Feb 2025 18:24:34 +0300

On Wed, Feb 19, 2025 at 08:14:53PM +0000, Pip Cet wrote:
> Hmm.  And those crashes still aren't reproducible, and quite rare?

Yes, just random editing and crash.
But not "quite rare", now it is one in hour or two.

> They
> all look different, but they all look like GC hapened while unwinding
> through the specpdl or otherwise calling longjmp.  And you say they
> happen with Emacs-30, too?
> 

Yes one crash of "/usr/bin/emacs-31.0.50" after ~ 2 days of work.

> Try disassembling mark_threads, though I expect that to be okay now, to
> be honest.  Something else must be the problem.
> 
(gdb) disassemble mark_threads
Dump of assembler code for function mark_threads:
   0x0000555555827470 <+0>:	endbr64
   0x0000555555827474 <+4>:	push   %rbp
   0x0000555555827475 <+5>:	mov    %rsp,%rbp
   0x0000555555827478 <+8>:	push   %r15
   0x000055555582747a <+10>:	push   %r14
   0x000055555582747c <+12>:	push   %r13
   0x000055555582747e <+14>:	push   %r12
   0x0000555555827480 <+16>:	push   %rbx
   0x0000555555827481 <+17>:	sub    $0x18,%rsp
   0x0000555555827485 <+21>:	movb   $0x1,-0x31(%rbp)
   0x0000555555827489 <+25>:	movzbl -0x31(%rbp),%eax
   0x000055555582748d <+29>:	test   %al,%al
   0x000055555582748f <+31>:	je     0x5555558274b7 <mark_threads+71>
   0x0000555555827491 <+33>:	lea    -0x1328(%rip),%rbx        # 0x555555826170 <mark_threads_callback>
   0x0000555555827498 <+40>:	nopl   0x0(%rax,%rax,1)
   0x00005555558274a0 <+48>:	xor    %esi,%esi
   0x00005555558274a2 <+50>:	mov    %rbx,%rdi
   0x00005555558274a5 <+53>:	addr32 call 0x555555770a10 <flush_stack_call_func1>
   0x00005555558274ab <+59>:	movb   $0x0,-0x31(%rbp)
   0x00005555558274af <+63>:	movzbl -0x31(%rbp),%eax
   0x00005555558274b3 <+67>:	test   %al,%al
   0x00005555558274b5 <+69>:	jne    0x5555558274a0 <mark_threads+48>
   0x00005555558274b7 <+71>:	add    $0x18,%rsp
   0x00005555558274bb <+75>:	pop    %rbx
   0x00005555558274bc <+76>:	pop    %r12
   0x00005555558274be <+78>:	pop    %r13
   0x00005555558274c0 <+80>:	pop    %r14
   0x00005555558274c2 <+82>:	pop    %r15
   0x00005555558274c4 <+84>:	pop    %rbp
   0x00005555558274c5 <+85>:	ret
End of assembler dump.

-- 
/Evgeniy