Re: SEGV in x_catch_errors_unwind (x86_64-unknown-linux-gnu)

[Chong Yidong]

Chong Yidong <address@hidden> writes:

>> However, as I was looking at the following loop unbind_to in eval.c,
>> it occurred to me that one way the x_catch_errors_unwind function
>> could be called twice in succession would be if specpdl_ptr is
>> incremented by the addition of additional bindings while the loop is
>> running (by some other code that is misbehaving while manipulating the
>> specpdl array).

There isn't any misbehaving code, btw.  Since unbind_to is currently
run without BLOCK_INPUT, it can be interrupted by a signal handler.
The signal handler can call the x error handler, which calls
record_unwind_protect, which screws things up.

One solution is to somehow re-engineer the x error handler not to use
record_unwind_protect.  The other is to block inputs at the point in
unbind_to where specpdl_ptr is being modified, like this:

*** emacs/src/eval.c.~1.261.~   2006-02-09 23:33:56.000000000 -0500
--- emacs/src/eval.c    2006-02-25 10:26:26.000000000 -0500
***************
*** 3214,3233 ****
  {
    Lisp_Object quitf = Vquit_flag;
    struct gcpro gcpro1, gcpro2;
  
    GCPRO2 (value, quitf);
    Vquit_flag = Qnil;
  
!   while (specpdl_ptr != specpdl + count)
      {
        /* Copy the binding, and decrement specpdl_ptr, before we do
         the work to unbind it.  We decrement first
         so that an error in unbinding won't try to unbind
         the same entry again, and we copy the binding first
         in case more bindings are made during some of the code we run.  */
  
-       struct specbinding this_binding;
        this_binding = *--specpdl_ptr;
  
        if (this_binding.func != 0)
        (*this_binding.func) (this_binding.old_value);
--- 3214,3238 ----
  {
    Lisp_Object quitf = Vquit_flag;
    struct gcpro gcpro1, gcpro2;
+   struct specbinding this_binding;
  
    GCPRO2 (value, quitf);
    Vquit_flag = Qnil;
  
!   while (1)
      {
+       BLOCK_INPUT;
+       if (specpdl_ptr == specpdl + count)
+       break;
+ 
        /* Copy the binding, and decrement specpdl_ptr, before we do
         the work to unbind it.  We decrement first
         so that an error in unbinding won't try to unbind
         the same entry again, and we copy the binding first
         in case more bindings are made during some of the code we run.  */
  
        this_binding = *--specpdl_ptr;
+       UNBLOCK_INPUT;
  
        if (this_binding.func != 0)
        (*this_binding.func) (this_binding.old_value);
***************
*** 3263,3268 ****
--- 3268,3274 ----
            set_internal (this_binding.symbol, this_binding.old_value, 0, 1);
        }
      }
+   UNBLOCK_INPUT;
  
    if (NILP (Vquit_flag) && !NILP (quitf))
      Vquit_flag = quitf;