Re: Fix to long-standing crashes in GC

[Kim F. Storm]

Stefan Monnier <address@hidden> writes:

> > I have now found two different cases where a pointer on the stack
> > points to GC-managed memory (mem_find finds it), to a cons cell with a
> > Lisp_Misc_Free in the car and a bogus list in the cdr.  I suspect there
> > are many more such cases.
> 
> Right.  And it should never happen.
> 
> > I included one such list in my previous mail.
> 
> Yes, I've seen it.  Thank you.
> 
> >> So I think w need to look further.
> > Looking for what?
> 
> For what causes Lisp_Misc_Free cells to appear in the car of cons cells that
> are apparently live.  I'm not sure how best to do that.  Maybe we should
> write a GC-sanity-check routine (scan all cons blocks looking for live cells
> with misc free objects in them) that we could call at GC-entry and GC-exit,
> this way we could at least see whether the problem happens during GC or
> between GC.

Yesterday, I did a partial test where I wrote a fun to check all
Lisp_Misc blocks for invalid misc types (except Lisp_Misc_Free) for
every call to Fcons -- and no such problems occurred, i.e. the bad
misc cells pointed to from some cons cells were NOT in the marker
block chain...

I will make another test to check the cons blocks in a similar way.

-- 
Kim F. Storm <address@hidden> http://www.cua.dk