Subject: bug#76327: 29.4; random segfaults after switch to tree-sitter

From: Evgeniy Dushistov <[email-masked]>
Date: Tue, 18 Feb 2025 12:55:12 +0300

On Mon, Feb 17, 2025 at 08:31:25PM +0000, Pip Cet wrote:
> Yes, it does trigger a lot.  You can restrict the breakpoint to trigger
> only when value is Qlistp by doing
> 
> b wrong_type_argument if value == Qlistp
> 

I build with enable-checking=all and use b wrong_type_argument if value == Qlistp.

lisp.h:1497: Emacs fatal error: assertion failed: CONSP (a)

Thread 1 "emacs-29.4" hit Breakpoint 2, terminate_due_to_signal (sig=sig@entry=6, backtrace_limit=backtrace_limit@entry=2147483647) at emacs.c:426
426	{
(gdb) bt
#0  terminate_due_to_signal (sig=sig@entry=6, backtrace_limit=backtrace_limit@entry=2147483647) at emacs.c:426
#1  0x00005555555d23df in die (msg=msg@entry=0x55555590e0f8 "CONSP (a)", file=file@entry=0x55555590e048 "lisp.h", line=line@entry=1497) at alloc.c:7707
#2  0x00005555555c5ded in XCONS (a=<optimized out>) at /usr/src/debug/emacs/emacs-29.4/src/lisp.h:1497
#3  0x00005555555c5df6 in XCONS (a=<optimized out>) at /usr/src/debug/emacs/emacs-29.4/src/lisp.h:1496
#4  0x000055555576c053 in XCAR (c=<optimized out>) at /usr/src/debug/emacs/emacs-29.4/src/lisp.h:1523
#5  make_lispy_event (event=0x555555f2f660 <kbd_buffer+9216>) at keyboard.c:6375
#6  0x000055555577278f in kbd_buffer_get_event (kbp=<synthetic pointer>, used_mouse_menu=<optimized out>, end_time=<optimized out>) at keyboard.c:4297
#7  read_event_from_main_queue (end_time=end_time@entry=0x0, local_getcjmp=local_getcjmp@entry=0x7fffffffd300, used_mouse_menu=used_mouse_menu@entry=0x7fffffffd64b) at keyboard.c:2279
#8  0x0000555555779293 in read_decoded_event_from_main_queue (end_time=<optimized out>, local_getcjmp=<optimized out>, prev_event=<optimized out>, used_mouse_menu=<optimized out>)
    at keyboard.c:2342
#9  read_char (commandflag=1, map=map@entry=0x555559490bc3, prev_event=0x0, used_mouse_menu=used_mouse_menu@entry=0x7fffffffd64b, end_time=end_time@entry=0x0) at keyboard.c:2973
#10 0x000055555577be75 in read_key_sequence
    (keybuf=keybuf@entry=0x7fffffffd790, prompt=prompt@entry=0x0, dont_downcase_last=dont_downcase_last@entry=false, can_return_switch_frame=can_return_switch_frame@entry=true, fix_current_buffer=fix_current_buffer@entry=true, prevent_redisplay=prevent_redisplay@entry=false) at keyboard.c:10084
#11 0x000055555577e45f in command_loop_1 () at /usr/src/debug/emacs/emacs-29.4/src/lisp.h:1172
#12 0x0000555555820e46 in internal_condition_case (bfun=bfun@entry=0x55555577e210 <command_loop_1>, handlers=handlers@entry=0x90, hfun=hfun@entry=0x55555576db70 <cmd_error>) at eval.c:1474
#13 0x000055555576222f in command_loop_2 (handlers=handlers@entry=0x90) at keyboard.c:1133
#14 0x0000555555820d78 in internal_catch (tag=<optimized out>, func=func@entry=0x5555557621f0 <command_loop_2>, arg=arg@entry=0x90) at eval.c:1197
#15 0x000055555576283e in command_loop () at keyboard.c:1111
#16 0x000055555576d165 in recursive_edit_1 () at keyboard.c:720
#17 0x000055555576d864 in Frecursive_edit () at keyboard.c:803
#18 0x00005555555c58f9 in main (argc=1, argv=0x7fffffffdc78) at emacs.c:2521

Full gdb log (with "bt full") see in attachment.

> then whenever it stops, get a "bt full" and "c" if it doesn't look like
> the right one.  The last bt full before the crash will be the
> interesting one.
> 
> > I will try to rebuild emacs with sanitizer.
> 
> --enable-checking=all might help.  The sanitizer might, too, I guess :-)
> 

Sanitizer catch segfault during build of emacs.
May be I need some special configure flags?
I just specify "-fsanitize=address" in CFLAGS and "-lasan" in LDFLAGS,
and also "--with-pdumper=no --with-unexec=no --with-dumping=none" just in case.

Loading loadup.el (source)...
Dump mode: nil
Using load-path (/home/evgeniy/bigdisk1/linux-infra/arch_build/modified-packages/emacs/src/emacs-29.4/lisp /home/evgeniy/bigdisk1/linux-infra/arch_build/modified-packages/emacs/src/emacs-29.4/lisp/emacs-lisp /home/evgeniy/bigdisk1/linux-infra/arch_build/modified-packages/emacs/src/emacs-29.4/lisp/progmodes /home/evgeniy/bigdisk1/linux-infra/arch_build/modified-packages/emacs/src/emacs-29.4/lisp/language /home/evgeniy/bigdisk1/linux-infra/arch_build/modified-packages/emacs/src/emacs-29.4/lisp/international /home/evgeniy/bigdisk1/linux-infra/arch_build/modified-packages/emacs/src/emacs-29.4/lisp/textmodes /home/evgeniy/bigdisk1/linux-infra/arch_build/modified-packages/emacs/src/emacs-29.4/lisp/vc)
Loading emacs-lisp/debug-early...
Loading emacs-lisp/byte-run...
Loading emacs-lisp/backquote...
Loading subr...
Loading keymap...
Fatal error 11: Segmentation fault
Backtrace:
/usr/lib/libasan.so.8(___interceptor_backtrace+0xa4) [0x7e41a82a8834]
../src/emacs(emacs_backtrace+0x10b) [0x57f4196198ad]
../src/emacs(terminate_due_to_signal+0x13d) [0x57f4195c3603]
../src/emacs(+0x401d9e) [0x57f419613d9e]
../src/emacs(+0x401e16) [0x57f419613e16]
../src/emacs(+0x401e6e) [0x57f419613e6e]
/usr/lib/libc.so.6(+0x3dcd0) [0x7e41a5debcd0]
../src/emacs(mark_memory+0x2c) [0x57f4196d2285]
../src/emacs(mark_c_stack+0xd) [0x57f4196d22c3]
../src/emacs(+0x62ed3f) [0x57f419840d3f]
../src/emacs(flush_stack_call_func1+0x47) [0x57f4196cf591]
../src/emacs(mark_threads+0x27) [0x57f419842b93]
../src/emacs(garbage_collect+0x533) [0x57f4196d2820]
../src/emacs(maybe_garbage_collect+0x27) [0x57f4196d36c4]
../src/emacs(eval_sub+0x242) [0x57f419718002]
../src/emacs(+0x576efd) [0x57f419788efd]
../src/emacs(Fload+0x1c16) [0x57f41978acb1]
../src/emacs(eval_sub+0x10f6) [0x57f419718eb6]
../src/emacs(+0x576efd) [0x57f419788efd]
../src/emacs(Fload+0x1c16) [0x57f41978acb1]
../src/emacs(eval_sub+0x10f6) [0x57f419718eb6]
../src/emacs(Feval+0x80) [0x57f41971f2c4]
../src/emacs(+0x3b5d8b) [0x57f4195c7d8b]
../src/emacs(internal_condition_case+0xce) [0x57f41970be4b]
../src/emacs(+0x3b5c56) [0x57f4195c7c56]
../src/emacs(internal_catch+0x3e) [0x57f41970bc8f]
../src/emacs(+0x3b5b72) [0x57f4195c7b72]
../src/emacs(recursive_edit_1+0x144) [0x57f4195d3668]
../src/emacs(Frecursive_edit+0x202) [0x57f4195d3e75]
../src/emacs(main+0x37f7) [0x57f4195c6e91]

-- 
/Evgeniy