Subject: bug#76327: 29.4; random segfaults after switch to tree-sitter

From: Evgeniy Dushistov <[email-masked]>
Date: Thu, 20 Feb 2025 18:26:37 +0300

On Thu, Feb 20, 2025 at 08:12:20AM +0200, Eli Zaretskii wrote:
> > Try disassembling mark_threads, though I expect that to be okay now, to
> > be honest.  Something else must be the problem.
> 
> Based on previous similar problems, removing the -D_FORTIFY_SOURCE=3
> flag from the build will avoid the crashes with high probability.  I
> think it is worth our while to see if that's the case with this
> problem, even if eventually the root cause will be found elsewhere,
> and _FORTIFY_SOURCE just triggers it somehow.

I removed mention of _FORTIFY_SOURCE: 

CFLAGS="-march=nehalem -mtune=znver1 -O2 -pipe -fno-plt -fexceptions \
        -Wformat -Werror=format-security \
        -fstack-clash-protection -fcf-protection \
        -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -fno-optimize-sibling-calls"

but it still crashes.

Here is "bt full":

#0  SYMBOL_NAME (sym=0x4000000002002000) at /usr/src/debug/emacs/emacs-29.4/src/lisp.h:1152
#1  print_object (obj=obj@entry=0x4000000002002000, printcharfun=printcharfun@entry=0x30, escapeflag=escapeflag@entry=true) at print.c:2398
        len = 140737488343728
        i = <optimized out>
        name = <optimized out>
        size_byte = <optimized out>
        p = <optimized out>
        signedp = <optimized out>
        confusing = <optimized out>
        base_depth = <optimized out>
        base_sp = <optimized out>
        buf = "\320\322\377\377\377\177\000\000\370]xUUU\000\0000\342\210UUU\000\000 \001", '\000' <repeats 15 times>, "\217\2319\343\321\343\026@\323\377\377\377\177"
        print_obj = <optimized out>
#2  0x00005555557c70bf in print (obj=obj@entry=0x4000000002002000, printcharfun=0x30, escapeflag=escapeflag@entry=true) at print.c:1301
#3  0x00005555557c7210 in Fprin1 (object=0x4000000002002000, printcharfun=printcharfun@entry=0x30, overrides=overrides@entry=0x0) at print.c:776
        count = {
          bytes = <optimized out>
        }
        pc = {
          printcharfun = 0x30,
          old_printcharfun = 0x30,
          old_point = -1,
          start_point = -1,
          old_point_byte = -1,
          start_point_byte = -1,
          specpdl_count = {
            bytes = 224
          }
        }
#4  0x00005555557c7a39 in print_error_message (data=<optimized out>, data@entry=0x55555e5f33c3, stream=stream@entry=0x30, context=<optimized out>, caller=caller@entry=0x7fe0) at print.c:1134
        obj = <optimized out>
        li = {
          tortoise = <optimized out>,
          max = <optimized out>,
          n = <optimized out>,
          q = <optimized out>
        }
        sep = 0x55555587b951 ", "
        errname = 0x11f70
        errmsg = <optimized out>
        file_error = <optimized out>
        tail = 0x55555e5f3453
#5  0x0000555555704cab in Fcommand_error_default_function (data=0x55555e5f33c3, context=0x7ffff1880284, signal=0x7fe0) at /usr/src/debug/emacs/emacs-29.4/src/lisp.h:1679
        sf = 0x5555561aee10
        conditions = <optimized out>
        is_minibuffer_quit = <optimized out>
#6  0x000055555579d211 in funcall_subr (subr=<optimized out>, numargs=numargs@entry=3, args=args@entry=0x7ffff0fff050) at eval.c:3042
        argbuf = {0x555555ee96e3, 0x0, 0x1000101, 0x0, 0x0, 0x0, 0x1, 0x1f}
        a = <optimized out>
        fun = <optimized out>
#7  0x00005555557ecd0c in exec_byte_code (fun=<optimized out>, fun@entry=0x7ffff1ce5e3d, args_template=<optimized out>, args_template@entry=771, nargs=<optimized out>, args=<optimized out>) at bytecode.c:809
        call_nargs = 3
        call_fun = <optimized out>
        count1 = {
          bytes = <optimized out>
        }
        template = <optimized out>
        val = <optimized out>
        call_args = 0x7ffff0fff050
        original_fun = 0x2aaa9bf19470
        bytecode = <optimized out>
        op = 3
        type = <optimized out>
        targets = {0x5555555b84c4 <exec_byte_code-2311164>, 0x5555557ed165 <exec_byte_code+2213>, 0x5555557ed15c <exec_byte_code+2204>, 0x5555557ed153 <exec_byte_code+2195>, 0x5555557ecad5 <exec_byte_code+533>, 0x5555557ecad9 <exec_byte_code+537>, 0x5555557ed117 <exec_byte_code+2135>, 0x5555557ed0db <exec_byte_code+2075>, 0x5555557ed9ce <exec_byte_code+4366>, 0x5555557ed9c5 <exec_byte_code+4357>, 0x5555557ed9bc <exec_byte_code+4348>, 0x5555557ed9b3 <exec_byte_code+4339>, 0x5555557ecb11 <exec_byte_code+593>, 0x5555557ecb20 <exec_byte_code+608>, 0x5555557ed9a3 <exec_byte_code+4323>, 0x5555557ed9d7 <exec_byte_code+4375>, 0x5555557eda89 <exec_byte_code+4553>, 0x5555557eda80 <exec_byte_code+4544>, 0x5555557eda77 <exec_byte_code+4535>, 0x5555557eda6e <exec_byte_code+4526>, 0x5555557eca4d <exec_byte_code+397>, 0x5555557eca60 <exec_byte_code+416>, 0x5555557eda4d <exec_byte_code+4493>, 0x5555557eda5d <exec_byte_code+4509>, 0x5555557ed9f1 <exec_byte_code+4401>, 0x5555557ed9e8 <exec_byte_code+4392>, 0x5555557edd3f <exec_byte_code+5247>, 0x5555557edd36 <exec_byte_code+5238>, 0x5555557ecd8c <exec_byte_code+1228>, 0x5555557ecd90 <exec_byte_code+1232>, 0x5555557eda0b <exec_byte_code+4427>, 0x5555557ed9fa <exec_byte_code+4410>, 0x5555557edd0c <exec_byte_code+5196>, 0x5555557edd03 <exec_byte_code+5187>, 0x5555557edcfa <exec_byte_code+5178>, 0x5555557edcf1 <exec_byte_code+5169>, 0x5555557ecb91 <exec_byte_code+721>, 0x5555557ecba0 <exec_byte_code+736>, 0x5555557edd26 <exec_byte_code+5222>, 0x5555557edd15 <exec_byte_code+5205>, 0x5555557edcc7 <exec_byte_code+5127>, 0x5555557edcbe <exec_byte_code+5118>, 0x5555557edcb5 <exec_byte_code+5109>, 0x5555557edcac <exec_byte_code+5100>, 0x5555557ecdd9 <exec_byte_code+1305>, 0x5555557ecde0 <exec_byte_code+1312>, 0x5555557edce1 <exec_byte_code+5153>, 0x5555557edcd0 <exec_byte_code+5136>, 0x5555557edbf8 <exec_byte_code+4920>, 0x5555557edc2b <exec_byte_code+4971>, 0x5555557edca0 <exec_byte_code+5088>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555557ef041 <exec_byte_code+10113>, 0x5555557eefcf <exec_byte_code+9999>, 0x5555557eef89 <exec_byte_code+9929>, 0x5555557eef43 <exec_byte_code+9859>, 0x5555557eeeff <exec_byte_code+9791>, 0x5555557edb0a <exec_byte_code+4682>, 0x5555557edaca <exec_byte_code+4618>, 0x5555557eeece <exec_byte_code+9742>, 0x5555557edbbe <exec_byte_code+4862>, 0x5555557eda92 <exec_byte_code+4562>, 0x5555557eee8e <exec_byte_code+9678>, 0x5555557eee5e <exec_byte_code+9630>, 0x5555557eee1e <exec_byte_code+9566>, 0x5555557eede1 <exec_byte_code+9505>, 0x5555557eeda0 <exec_byte_code+9440>, 0x5555557eed29 <exec_byte_code+9321>, 0x5555557eecb4 <exec_byte_code+9204>, 0x5555557eec38 <exec_byte_code+9080>, 0x5555557eec08 <exec_byte_code+9032>, 0x5555557eebd8 <exec_byte_code+8984>, 0x5555557eeb98 <exec_byte_code+8920>, 0x5555557eeb58 <exec_byte_code+8856>, 0x5555557eeb18 <exec_byte_code+8792>, 0x5555557eead4 <exec_byte_code+8724>, 0x5555557eea9a <exec_byte_code+8666>, 0x5555557eea60 <exec_byte_code+8608>, 0x5555557eea26 <exec_byte_code+8550>, 0x5555557ee984 <exec_byte_code+8388>, 0x5555557ee929 <exec_byte_code+8297>, 0x5555557ee8d8 <exec_byte_code+8216>, 0x5555557ee884 <exec_byte_code+8132>, 0x5555557ee830 <exec_byte_code+8048>, 0x5555557ee7dc <exec_byte_code+7964>, 0x5555557ee788 <exec_byte_code+7880>, 0x5555557ee730 <exec_byte_code+7792>, 0x5555557ee6d4 <exec_byte_code+7700>, 0x5555557ee67c <exec_byte_code+7612>, 0x5555557ee624 <exec_byte_code+7524>, 0x5555557ee5cc <exec_byte_code+7436>, 0x5555557ee573 <exec_byte_code+7347>, 0x5555557ee483 <exec_byte_code+7107>, 0x5555557ece28 <exec_byte_code+1384>, 0x5555557ee453 <exec_byte_code+7059>, 0x5555557ee41e <exec_byte_code+7006>, 0x5555557ee38e <exec_byte_code+6862>, 0x5555557ee345 <exec_byte_code+6789>, 0x5555557ee315 <exec_byte_code+6741>, 0x5555557ee2e3 <exec_byte_code+6691>, 0x5555557ee2b1 <exec_byte_code+6641>, 0x5555557ee277 <exec_byte_code+6583>, 0x5555557ee245 <exec_byte_code+6533>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555557ee213 <exec_byte_code+6483>, 0x5555557ee1e1 <exec_byte_code+6433>, 0x5555557ee1af <exec_byte_code+6383>, 0x5555557ee17d <exec_byte_code+6333>, 0x5555557ee14b <exec_byte_code+6283>, 0x5555557ee11b <exec_byte_code+6235>, 0x5555557ece2c <exec_byte_code+1388>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555557ee0d8 <exec_byte_code+6168>, 0x5555557ee0a8 <exec_byte_code+6120>, 0x5555557ee078 <exec_byte_code+6072>, 0x5555557ed88a <exec_byte_code+4042>, 0x5555557ed84a <exec_byte_code+3978>, 0x5555557ed81a <exec_byte_code+3930>, 0x5555557ed7ea <exec_byte_code+3882>, 0x5555557ed7aa <exec_byte_code+3818>, 0x5555557ed76a <exec_byte_code+3754>, 0x5555557ed72a <exec_byte_code+3690>, 0x5555557ed6f8 <exec_byte_code+3640>, 0x5555557ed6c8 <exec_byte_code+3592>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555557edd48 <exec_byte_code+5256>, 0x5555557edef9 <exec_byte_code+5689>, 0x5555557ed964 <exec_byte_code+4260>, 0x5555557edeba <exec_byte_code+5626>, 0x5555557ede7e <exec_byte_code+5566>, 0x5555557ede42 <exec_byte_code+5506>, 0x5555557edda5 <exec_byte_code+5349>, 0x5555557edd81 <exec_byte_code+5313>, 0x5555557eda1b <exec_byte_code+4443>, 0x5555557ee00c <exec_byte_code+5964>, 0x5555557edfa6 <exec_byte_code+5862>, 0x5555557edf70 <exec_byte_code+5808>, 0x5555557ee031 <exec_byte_code+6001>, 0x5555557ef17a <exec_byte_code+10426>, 0x5555557ef136 <exec_byte_code+10358>, 0x5555557ef0ec <exec_byte_code+10284>, 0x5555557ef08e <exec_byte_code+10190>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555557ed684 <exec_byte_code+3524>, 0x5555557ed654 <exec_byte_code+3476>, 0x5555557ed624 <exec_byte_code+3428>, 0x5555557ed5f4 <exec_byte_code+3380>, 0x5555557ed5c4 <exec_byte_code+3332>, 0x5555557ed584 <exec_byte_code+3268>, 0x5555557ed544 <exec_byte_code+3204>, 0x5555557ed504 <exec_byte_code+3140>, 0x5555557ed4c4 <exec_byte_code+3076>, 0x5555557ed470 <exec_byte_code+2992>, 0x5555557ed430 <exec_byte_code+2928>, 0x5555557ed3f0 <exec_byte_code+2864>, 0x5555557ed3c0 <exec_byte_code+2816>, 0x5555557ed35d <exec_byte_code+2717>, 0x5555557ed2fa <exec_byte_code+2618>, 0x5555557ed2be <exec_byte_code+2558>, 0x5555557ed282 <exec_byte_code+2498>, 0x5555557ed248 <exec_byte_code+2440>, 0x5555557ee51b <exec_byte_code+7259>, 0x5555557ee4cc <exec_byte_code+7180>, 0x5555557ed1da <exec_byte_code+2330>, 0x5555557ed16e <exec_byte_code+2222>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555557eed59 <exec_byte_code+9369>, 0x5555557ee9df <exec_byte_code+8479>, 0x5555557ee3d7 <exec_byte_code+6935>, 0x5555557ed097 <exec_byte_code+2007>, 0x5555557ed053 <exec_byte_code+1939>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555557ed01c <exec_byte_code+1884>, 0x5555557ed902 <exec_byte_code+4162>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555555b84c8 <exec_byte_code-2311160>, 0x5555557ed8ca <exec_byte_code+4106> <repeats 64 times>}
        quitcounter = <optimized out>
        bc = 0x555555d421b0 <main_thread+496>
        top = 0x7ffff0fff048
        pc = <optimized out>
        bytestr = <optimized out>
        vector = <optimized out>
        maxdepth = <optimized out>
        const_length = <optimized out>
        bytestr_length = <optimized out>
        vectorp = 0x7ffff1ce5e80
        max_stack = <optimized out>
        frame_base = <optimized out>
        fp = <optimized out>
        bytestr_data = <optimized out>
        rest = <optimized out>
        mandatory = <optimized out>
        nonrest = <optimized out>
        pushedargs = <optimized out>
        result = <optimized out>
#8  0x000055555579ee77 in fetch_and_exec_byte_code (fun=0x7ffff1ce5e3d, args_template=771, nargs=93824994062694, args=0x7fffffffd848) at eval.c:3085
#9  funcall_lambda (fun=0x7ffff1ce5e3d, nargs=nargs@entry=3, arg_vector=arg_vector@entry=0x7fffffffd848) at eval.c:3157
        val = <optimized out>
        syms_left = <optimized out>
        next = <optimized out>
        lexenv = <optimized out>
        count = {
          bytes = <optimized out>
        }
        i = <optimized out>
        optional = <optimized out>
        rest = <optimized out>
        previous_rest = <optimized out>
#10 0x000055555579f07c in funcall_general (fun=<optimized out>, numargs=numargs@entry=3, args=args@entry=0x7fffffffd848) at eval.c:2961
        funcar = <optimized out>
        original_fun = 0x2aaa9bf18fa8
#11 0x000055555579f2b5 in Ffuncall (nargs=nargs@entry=4, args=args@entry=0x7fffffffd840) at eval.c:2999
        count = {
          bytes = <optimized out>
        }
        val = <optimized out>
#12 0x000055555570557e in call3 (fn=<optimized out>, arg1=0x55555e5f33c3, arg2=<optimized out>, arg3=0x7fe0) at /usr/src/debug/emacs/emacs-29.4/src/lisp.h:3262
#13 cmd_error_internal (data=data@entry=0x55555e5f33c3, context=context@entry=0x7fffffffd8b0 "") at keyboard.c:1013
#14 0x00005555557056f8 in cmd_error (data=0x55555e5f33c3) at keyboard.c:981
        old_level = <optimized out>
        old_length = <optimized out>
        count = {
          bytes = <optimized out>
        }
        conditions = <optimized out>
        macroerror = "\000\000\000\000\000\000\000\000\240\230", '\000' <repeats 14 times>, "\rׇ\361\377\177\000\000\000\331\377\377\377\177\000\000\000\217\2319\343\321\343\026\023d"
#15 0x0000555555799931 in internal_condition_case (bfun=bfun@entry=0x555555712fa0 <command_loop_1>, handlers=handlers@entry=0x90, hfun=hfun@entry=0x5555557055b0 <cmd_error>) at eval.c:1470
        val = <optimized out>
        c = 0x555555ec4c60
#16 0x00005555556fd5bf in command_loop_2 (handlers=handlers@entry=0x90) at keyboard.c:1133
        val = <optimized out>
#17 0x0000555555799898 in internal_catch (tag=tag@entry=0x10080, func=func@entry=0x5555556fd580 <command_loop_2>, arg=arg@entry=0x90) at eval.c:1197
        val = <optimized out>
        c = 0x555555ec4b20
#18 0x00005555556fd545 in command_loop () at keyboard.c:1111
#19 0x00005555557050ce in recursive_edit_1 () at keyboard.c:720
        count = {
          bytes = <optimized out>
        }
        val = <optimized out>
#20 0x000055555570549d in Frecursive_edit () at keyboard.c:803
        count = {
          bytes = <optimized out>
        }
        buffer = <optimized out>
#21 0x00005555555be210 in main (argc=1, argv=0x7fffffffdcc8) at emacs.c:2521
        stack_bottom_variable = 0x12f
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>
        dump_mode = <optimized out>
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {
          rlim_cur = 10022912,
          rlim_max = 18446744073709551615
        }
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>

Lisp Backtrace:
"command-error-default-function" (0xf0fff050)
"help-command-error-confusable-suggestions" (0xffffd848)
Warning: 'set logging off', an alias for the command 'set logging enabled', is deprecated.
Use 'set logging enabled off'.

-- 
/Evgeniy