Re: SIGSEGV while reading vm mail

[Richard Stallman]

It's clear from where this crashed that what happened
was something had clobbered the free list of conses.
It could have been clobbered way down the list.
If that happened, then later on after the previons
conses had been allocated, Emacs would crash
at the next call to Fcons.

The bug has nothing to do with the reasons why Fcons was called
this time.  We can't find it that way.

The following patch will cause the crash to occur sooner, at the next
time a built-in function called from Lisp is entered or exited.  With
luck, this will help us close in on what clobbers the list.


*** alloc.c     17 Jul 2004 08:00:13 -0400      1.347
--- alloc.c     24 Jul 2004 09:27:23 -0400      
***************
*** 2395,2400 ****
--- 2395,2409 ----
    return val;
  }
  
+ /* Get an error now if there's any junk in the cons free list.  */
+ void
+ check_cons_list ()
+ {
+   struct Lisp_Cons *tail = cons_free_list;
+ 
+   while (tail)
+     tail = *(struct Lisp_Cons **)&tail->cdr;
+ }
  
  /* Make a list of 2, 3, 4 or 5 specified objects.  */
  
*** eval.c      20 Jul 2004 16:52:30 -0400      1.220
--- eval.c      24 Jul 2004 09:39:19 -0400      
***************
*** 2021,2026 ****
--- 2021,2028 ----
          (XSUBR (fun)->max_args >= 0 && XSUBR (fun)->max_args < XINT 
(numargs)))
        return Fsignal (Qwrong_number_of_arguments, Fcons (fun, Fcons (numargs, 
Qnil)));
  
+       check_cons_list ();
+ 
        if (XSUBR (fun)->max_args == UNEVALLED)
        {
          backtrace.evalargs = 0;
***************
*** 2140,2145 ****
--- 2142,2149 ----
        return Fsignal (Qinvalid_function, Fcons (fun, Qnil));
      }
   done:
+   check_cons_list ();
+ 
    lisp_eval_depth--;
    if (backtrace.debug_on_exit)
      val = call_debugger (Fcons (Qexit, Fcons (val, Qnil)));
***************
*** 2701,2706 ****
--- 2705,2712 ----
        if (XSUBR (fun)->max_args == UNEVALLED)
        return Fsignal (Qinvalid_function, Fcons (fun, Qnil));
  
+       check_cons_list ();
+ 
        if (XSUBR (fun)->max_args == MANY)
        {
          val = (*XSUBR (fun)->function) (numargs, args + 1);
***************
*** 2789,2794 ****
--- 2795,2801 ----
        return Fsignal (Qinvalid_function, Fcons (fun, Qnil));
      }
   done:
+   check_cons_list ();
    lisp_eval_depth--;
    if (backtrace.debug_on_exit)
      val = call_debugger (Fcons (Qexit, Fcons (val, Qnil)));