bug#20705: Emacs segfaults when typing "(yas-expand" after M-: in yas-minor-mode

[Clément Pit--Claudel]

Hi all,

I'm running 25.0. I've just run into a strange segfault which kicks in when I 
run M-x yas-minor-mode followed by M-: (yas-expand. The following is a recipe 
to reproduce it with the latest source:

rm -rf temp-emacs-profile
emacs -Q \
      --eval '(setq user-emacs-directory "temp-emacs-profile")' \
      -l package \
      --eval "(add-to-list 'package-archives '(\"melpa\" . 
\"http://melpa.org/packages/\";) t)" \
      --eval "(package-refresh-contents)" \
      --eval "(package-initialize)" \
      --eval "(package-install 'yasnippet)" \
      --eval "(yas-minor-mode)"

Then type `M-: (yas-expand'. Emacs segfaults after the last 'd' is typed. 
Surprisingly, the problem does not appear if one uses the yasnippet verson from 
ELPA, only the more recent one from MELPA.

GDB says

Program received signal SIGSEGV, Segmentation fault.
Fkey_binding (key=8568165, accept_default=43008, no_remap=0, position=0) at 
keymap.c:1662
1662          if (EVENT_HAS_PARAMETERS (event) && CONSP (XCDR (event)))

Here is a backtrace:

(gdb) backtrace
#0  XTYPE (a=<error reading variable: Cannot access memory at address 0x8>) at 
lisp.h:843
#1  CONSP (x=<error reading variable: Cannot access memory at address 0x8>) at 
lisp.h:2486
#2  Fkey_binding (key=8568165, accept_default=43008, no_remap=0, position=0) at 
keymap.c:1662
#3  0x00000000005438a5 in Ffuncall (nargs=nargs@entry=3, 
args=args@entry=0x7fffffffaee8) at eval.c:2729
#4  0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=39171933, maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#5  0x00000000005435fd in funcall_lambda (fun=39172005, nargs=nargs@entry=0, 
arg_vector=arg_vector@entry=0x7fffffffb0d0) at eval.c:2951
#6  0x0000000000543980 in Ffuncall (nargs=nargs@entry=1, 
args=args@entry=0x7fffffffb0c8) at eval.c:2767
#7  0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=39542813, maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#8  0x00000000005435fd in funcall_lambda (fun=fun@entry=39542941, 
nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x7fffffffb200) at eval.c:2951
#9  0x0000000000542b83 in apply_lambda (fun=fun@entry=39542941, args=<optimized 
out>, count=count@entry=49) at eval.c:2826
#10 0x00000000005430fc in eval_sub (form=form@entry=39526547) at eval.c:2226
#11 0x0000000000545b73 in Feval (form=form@entry=39526547, 
lexical=lexical@entry=0) at eval.c:1996
#12 0x0000000000536872 in Fdocumentation_property 
(symbol=symbol@entry=18887328, prop=prop@entry=23616, raw=raw@entry=43008) at 
doc.c:467
#13 0x00000000005368f9 in Fdocumentation (function=18887328, raw=43008) at 
doc.c:329
#14 0x0000000000543871 in Ffuncall (nargs=nargs@entry=3, 
args=args@entry=0x7fffffffb4f8) at eval.c:2721
#15 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=10126773, maxdepth=<optimized out>, 
args_template=args_template@entry=3078, nargs=nargs@entry=2, 
    args=<optimized out>, args@entry=0x7fffffffb6e8) at bytecode.c:919
#16 0x0000000000543413 in funcall_lambda (fun=10126693, nargs=nargs@entry=2, 
arg_vector=arg_vector@entry=0x7fffffffb6e8) at eval.c:2885
#17 0x0000000000543980 in Ffuncall (nargs=nargs@entry=3, 
args=args@entry=0x7fffffffb6e0) at eval.c:2767
#18 0x0000000000544874 in Fapply (nargs=<optimized out>, args=0x7fffffffb840) 
at eval.c:2337
#19 0x00000000005437da in Ffuncall (nargs=nargs@entry=3, 
args=args@entry=0x7fffffffb838) at eval.c:2698
#20 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=10126541, maxdepth=<optimized out>, args_template=args_template@entry=2, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x7fffffffbb30) at bytecode.c:919
#21 0x0000000000543413 in funcall_lambda (fun=10126461, nargs=nargs@entry=0, 
arg_vector=arg_vector@entry=0x7fffffffbb30) at eval.c:2885
#22 0x0000000000543980 in Ffuncall (nargs=nargs@entry=1, 
args=args@entry=0x7fffffffbb28) at eval.c:2767
#23 0x000000000054466d in Fapply (nargs=2, args=0x7fffffffbb28) at eval.c:2289
#24 0x00000000005437da in Ffuncall (nargs=nargs@entry=3, 
args=args@entry=0x7fffffffbb20) at eval.c:2698
#25 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=19839389, maxdepth=<optimized out>, 
args_template=args_template@entry=514, nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x7fffffffbd08) at bytecode.c:919
#26 0x0000000000543413 in funcall_lambda (fun=31570517, nargs=nargs@entry=0, 
arg_vector=arg_vector@entry=0x7fffffffbd08) at eval.c:2885
#27 0x0000000000543980 in Ffuncall (nargs=nargs@entry=1, 
args=args@entry=0x7fffffffbd00) at eval.c:2767
#28 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=10373125, maxdepth=<optimized out>, args_template=args_template@entry=2, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x7fffffffbee0) at bytecode.c:919
#29 0x0000000000543413 in funcall_lambda (fun=10373053, nargs=nargs@entry=0, 
arg_vector=arg_vector@entry=0x7fffffffbee0) at eval.c:2885
#30 0x0000000000543980 in Ffuncall (nargs=nargs@entry=1, 
args=args@entry=0x7fffffffbed8) at eval.c:2767
#31 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=10371773, maxdepth=<optimized out>, args_template=args_template@entry=2, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x7fffffffc1c8) at bytecode.c:919
#32 0x0000000000543413 in funcall_lambda (fun=10371701, nargs=nargs@entry=0, 
arg_vector=arg_vector@entry=0x7fffffffc1c8) at eval.c:2885
#33 0x0000000000543980 in Ffuncall (nargs=nargs@entry=1, 
args=args@entry=0x7fffffffc1c0) at eval.c:2767
#34 0x000000000054466d in Fapply (nargs=2, args=0x7fffffffc1c0) at eval.c:2289
#35 0x00000000005437da in Ffuncall (nargs=nargs@entry=3, 
args=args@entry=0x7fffffffc1b8) at eval.c:2698
#36 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=9940461, maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#37 0x00000000005435fd in funcall_lambda (fun=9940381, nargs=nargs@entry=1, 
arg_vector=arg_vector@entry=0x7fffffffc3a8) at eval.c:2951
#38 0x0000000000543980 in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffc3a0) at eval.c:2767
#39 0x0000000000543aed in call1 (fn=fn@entry=43776, arg1=arg1@entry=36969941) 
at eval.c:2573
#40 0x00000000004df92d in timer_check_2 (timers=<optimized out>, 
timers@entry=34816051, idle_timers=<optimized out>, idle_timers@entry=34815939) 
at keyboard.c:4533
#41 0x00000000004e1bcc in timer_check () at keyboard.c:4600
#42 0x00000000004e1be9 in readable_events (flags=flags@entry=1) at 
keyboard.c:3434
#43 0x00000000004e4ae8 in get_input_pending (flags=flags@entry=1) at 
keyboard.c:6818
#44 0x00000000004e4b97 in swallow_events (do_display=do_display@entry=true) at 
keyboard.c:4330
#45 0x000000000041f3cd in sit_for (timeout=timeout@entry=122, 
reading=reading@entry=true, display_option=display_option@entry=1) at 
dispnew.c:5707
#46 0x00000000004e6ccb in read_char (commandflag=1, map=map@entry=34816259, 
prev_event=0, used_mouse_menu=used_mouse_menu@entry=0x7fffffffc82b, 
end_time=end_time@entry=0x0)
    at keyboard.c:2781
#47 0x00000000004e7d4d in read_key_sequence 
(keybuf=keybuf@entry=0x7fffffffc8e0, bufsize=bufsize@entry=30, 
prompt=prompt@entry=0, 
    dont_downcase_last=dont_downcase_last@entry=false, 
can_return_switch_frame=can_return_switch_frame@entry=true, 
fix_current_buffer=fix_current_buffer@entry=true, 
    prevent_redisplay=prevent_redisplay@entry=false) at keyboard.c:9156
#48 0x00000000004e9289 in command_loop_1 () at keyboard.c:1407
#49 0x0000000000542136 in internal_condition_case (bfun=bfun@entry=0x4e8fb4 
<command_loop_1>, handlers=handlers@entry=18624, hfun=hfun@entry=0x4e0885 
<cmd_error>) at eval.c:1348
#50 0x00000000004dc6f8 in command_loop_2 (ignore=ignore@entry=0) at 
keyboard.c:1139
#51 0x000000000054201a in internal_catch (tag=tag@entry=19296, 
func=func@entry=0x4dc6e0 <command_loop_2>, arg=arg@entry=0) at eval.c:1108
#52 0x00000000004dc6d0 in command_loop () at keyboard.c:1110
#53 0x00000000004e0513 in recursive_edit_1 () at keyboard.c:728
#54 0x00000000005055db in read_minibuf (map=map@entry=16141203, 
initial=initial@entry=0, prompt=<optimized out>, prompt@entry=9448044, 
expflag=expflag@entry=true, 
    histvar=histvar@entry=271760, histpos=<optimized out>, 
defalt=defalt@entry=0, allow_props=false, 
inherit_input_method=inherit_input_method@entry=false) at minibuf.c:680
#55 0x00000000005058b6 in Fread_from_minibuffer (prompt=9448044, 
initial_contents=0, keymap=16141203, read=43008, hist=<optimized out>, 
default_value=0, inherit_input_method=0)
    at minibuf.c:963
#56 0x0000000000543917 in Ffuncall (nargs=nargs@entry=6, 
args=args@entry=0x7fffffffcc48) at eval.c:2744
#57 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=9447149, maxdepth=<optimized out>, 
args_template=args_template@entry=2054, nargs=nargs@entry=1, 
    args=<optimized out>, args@entry=0x7fffffffce50) at bytecode.c:919
#58 0x0000000000543413 in funcall_lambda (fun=9447069, nargs=nargs@entry=1, 
arg_vector=arg_vector@entry=0x7fffffffce50) at eval.c:2885
#59 0x0000000000543980 in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffce48) at eval.c:2767
#60 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=9448013, maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#61 0x00000000005745d0 in Fbyte_code (bytestr=<optimized out>, 
vector=<optimized out>, maxdepth=<optimized out>) at bytecode.c:485
#62 0x0000000000542ff7 in eval_sub (form=form@entry=9447931) at eval.c:2187
#63 0x0000000000545b73 in Feval (form=form@entry=9447931, lexical=<optimized 
out>) at eval.c:1996
#64 0x000000000053fe03 in Fcall_interactively (function=3467936, record_flag=0, 
keys=<optimized out>) at callint.c:361
#65 0x0000000000543889 in Ffuncall (nargs=nargs@entry=4, 
args=args@entry=0x7fffffffd1b8) at eval.c:2725
#66 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=36694549, maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#67 0x00000000005435fd in funcall_lambda (fun=36694661, nargs=nargs@entry=4, 
arg_vector=arg_vector@entry=0x7fffffffd398) at eval.c:2951
#68 0x0000000000543980 in Ffuncall (nargs=nargs@entry=5, 
args=args@entry=0x7fffffffd390) at eval.c:2767
#69 0x0000000000544874 in Fapply (nargs=<optimized out>, args=0x7fffffffd4f8) 
at eval.c:2337
#70 0x00000000005437da in Ffuncall (nargs=nargs@entry=4, 
args=args@entry=0x7fffffffd4f0) at eval.c:2698
#71 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=36693741, maxdepth=<optimized out>, 
args_template=args_template@entry=514, nargs=nargs@entry=3, 
    args=<optimized out>, args@entry=0x7fffffffd700) at bytecode.c:919
#72 0x0000000000543413 in funcall_lambda (fun=36693781, nargs=nargs@entry=3, 
arg_vector=arg_vector@entry=0x7fffffffd700) at eval.c:2885
#73 0x0000000000543980 in Ffuncall (nargs=nargs@entry=4, 
args=args@entry=0x7fffffffd6f8) at eval.c:2767
#74 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, 
vector=9451933, maxdepth=<optimized out>, 
args_template=args_template@entry=4102, nargs=nargs@entry=1, 
---Type <return> to continue, or q <return> to quit---
    args=<optimized out>, args@entry=0x7fffffffd8e8) at bytecode.c:919
#75 0x0000000000543413 in funcall_lambda (fun=9451853, nargs=nargs@entry=1, 
arg_vector=arg_vector@entry=0x7fffffffd8e8) at eval.c:2885
#76 0x0000000000543980 in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffd8e0) at eval.c:2767
#77 0x0000000000543aed in call1 (fn=fn@entry=14592, arg1=<optimized out>) at 
eval.c:2573
#78 0x00000000004e94e9 in command_loop_1 () at keyboard.c:1521
#79 0x0000000000542136 in internal_condition_case (bfun=bfun@entry=0x4e8fb4 
<command_loop_1>, handlers=handlers@entry=18624, hfun=hfun@entry=0x4e0885 
<cmd_error>) at eval.c:1348
#80 0x00000000004dc6f8 in command_loop_2 (ignore=ignore@entry=0) at 
keyboard.c:1139
#81 0x000000000054201a in internal_catch (tag=tag@entry=44352, 
func=func@entry=0x4dc6e0 <command_loop_2>, arg=arg@entry=0) at eval.c:1108
#82 0x00000000004dc69e in command_loop () at keyboard.c:1118
#83 0x00000000004e0513 in recursive_edit_1 () at keyboard.c:728
#84 0x00000000004e07d5 in Frecursive_edit () at keyboard.c:799
#85 0x00000000004dc0e9 in main (argc=1, argv=0x7fffffffdc28) at emacs.c:1626

Lisp Backtrace:
"key-binding" (0xffffaef0)
"yas--keybinding-beyond-yasnippet" (0xffffb0d0)
"yas--expand-from-trigger-key-doc" (0xffffb200)
"documentation" (0xffffb500)
"elisp-get-fnsym-args-string" (0xffffb6e8)
"apply" (0xffffb840)
"elisp-eldoc-documentation-function" (0xffffbb30)
"apply" (0xffffbb28)
0x1e1ba50 PVEC_COMPILED
"eldoc-print-current-symbol-info" (0xffffbee0)
0x9e4270 PVEC_COMPILED
"apply" (0xffffc1c0)
"timer-event-handler" (0xffffc3a8)
"read-from-minibuffer" (0xffffcc50)
"read--expression" (0xffffce50)
"byte-code" (0xffffcf50)
0xb0a6a8 PVEC_SUBR
"ad-Advice-call-interactively" (0xffffd398)
"apply" (0xffffd4f8)
"call-interactively" (0xffffd700)
"command-execute" (0xffffd8e8)

What extra information should I provide to help track this bug?

Clément.