bug#29066: 26.0.90; crash in gc involving buffer local symbols

[Andreas Schwab]

On Okt 31 2017, Eli Zaretskii <eliz@gnu.org> wrote:

>> I also checked the following works, and seems better to me (stop having 
>> dangling pointers, instead of being
>> careful with them):
>> 
>> diff --git a/src/alloc.c b/src/alloc.c
>> index da0c3ad4b3..44dfa95cf5 100644
>> --- a/src/alloc.c
>> +++ b/src/alloc.c
>> @@ -7030,8 +7030,10 @@ sweep_symbols (void)
>>          {
>>            if (!sym->s.gcmarkbit)
>>              {
>> -              if (sym->s.redirect == SYMBOL_LOCALIZED)
>> +              if (sym->s.redirect == SYMBOL_LOCALIZED) {
>>                  xfree (SYMBOL_BLV (&sym->s));
>> +                sym->s.val.blv = NULL;
>> +              }
>
> That was my first attempt, but various macros like SYMBOL_BLV and
> SET_SYMBOL_BLV insist on val.blv being non-NULL.

SET_SYMBOL_BLV doesn't.  And calling SYMBOL_BLV with a freed symbol is a
bug anyway.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."