bug#74966: 31.0.50; Crash report (using igc on macOS)

[Pip Cet]

Pip Cet <pipcet@protonmail.com> writes:

> "Stefan Monnier" <monnier@iro.umontreal.ca> writes:
>
>>>> Maybe the problem is in store_doc_string (doc.c:469 here), not sure.
>>>> That function does
>>>>
>>>>   if (SUBRP (fun))
>>>>     XSUBR (fun)->doc = offset;
>>
>> Sounds right.
>>
>>> That seems to be the cause, indeed. When I
>>>
>>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>> src/doc.c | 5 ++++-
>>>
>>> modified   src/doc.c
>>> @@ -479,7 +479,10 @@ store_function_docstring (Lisp_Object obj, EMACS_INT 
>>> offset)
>>>      fun = XCDR (fun);
>>>    /* Lisp_Subrs have a slot for it.  */
>>>    if (SUBRP (fun))
>>> -    XSUBR (fun)->doc = offset;
>>> +    {
>>> +      if (!NATIVE_COMP_FUNCTIONP (fun))
>>> +   XSUBR (fun)->doc = offset;
>>> +    }
>>>    else if (CLOSUREP (fun))
>>>      {
>>>        /* This bytecode object must have a slot for the docstring, since
>>>
>>> I don't get the assert anymore.
>>
>> `offset` here should be fixnum that gives the position of this docstring
>> in the DOC file.  And FUN should be a function for which we found
>
> Yes, but the nativecomp code assumes ->doc is an index into a
> nativecomp'd subr's constant vector.  So we overwrite it with a docfile
> index, access an out-of-bounds index and crash.
>
> I think the best thing to do is to use separate fields for the "offset"
> doc and the "index" doc; or at least, the second best thing, after
> removing the entire docfile hack.
>
> I've got a patch to do that, but I'm still testing...

I meant this patch, which splits "doc" into "doc_index" and
"doc_offset".  It'd probably be better to use a Lisp_Object here, which
can be either a fixnum (index into etc/DOC) or a string (the doc string
specified in some other manner).  And maybe we can drop the docfile
index thing entirely at some point soon?

Pip

diff --git a/src/comp.c b/src/comp.c
index 8b38adec252..0b378463c16 100644
--- a/src/comp.c
+++ b/src/comp.c
@@ -5352,7 +5352,7 @@ native_function_doc (Lisp_Object function)
   if (!VECTORP (cu->data_fdoc_v))
     xsignal2 (Qnative_lisp_file_inconsistent, cu->file,
              build_string ("missing documentation vector"));
-  return AREF (cu->data_fdoc_v, XSUBR (function)->doc);
+  return AREF (cu->data_fdoc_v, XSUBR (function)->doc_index);
 }
 
 static Lisp_Object
@@ -5393,8 +5393,9 @@ make_subr (Lisp_Object symbol_name, Lisp_Object minarg, 
Lisp_Object maxarg,
   x->s.symbol_name = xstrdup (SSDATA (symbol_name));
   x->s.intspec.native = intspec;
   x->s.command_modes = command_modes;
-  x->s.doc = XFIXNUM (doc_idx);
+  x->s.doc_offset = 0;
 #ifdef HAVE_NATIVE_COMP
+  x->s.doc_index = XFIXNUM (doc_idx);
   x->s.native_comp_u = comp_u;
   x->s.native_c_name = xstrdup (SSDATA (c_name));
   x->s.type = type;
diff --git a/src/doc.c b/src/doc.c
index 6f74a999366..510034c225d 100644
--- a/src/doc.c
+++ b/src/doc.c
@@ -391,13 +391,15 @@ DEFUN ("internal-subr-documentation", 
Fsubr_documentation, Ssubr_documentation,
        doc: /* Return the raw documentation info of a C primitive.  */)
   (Lisp_Object function)
 {
+  if (SUBRP (function) && XSUBR (function)->doc_offset)
+    return make_fixnum (XSUBR (function)->doc_offset);
 #ifdef HAVE_NATIVE_COMP
   if (!NILP (Fnative_comp_function_p (function)))
     return native_function_doc (function);
   else
 #endif
   if (SUBRP (function))
-    return make_fixnum (XSUBR (function)->doc);
+    return make_fixnum (XSUBR (function)->doc_offset);
 #ifdef HAVE_MODULES
   else if (MODULE_FUNCTIONP (function))
     return module_function_documentation (XMODULE_FUNCTION (function));
@@ -479,7 +481,7 @@ store_function_docstring (Lisp_Object obj, EMACS_INT offset)
     fun = XCDR (fun);
   /* Lisp_Subrs have a slot for it.  */
   if (SUBRP (fun))
-    XSUBR (fun)->doc = offset;
+    XSUBR (fun)->doc_offset = offset;
   else if (CLOSUREP (fun))
     {
       /* This bytecode object must have a slot for the docstring, since
diff --git a/src/lisp.h b/src/lisp.h
index 33a9269b305..aa7d9c4edac 100644
--- a/src/lisp.h
+++ b/src/lisp.h
@@ -2184,8 +2184,9 @@ CHAR_TABLE_SET (Lisp_Object ct, int idx, Lisp_Object val)
       Lisp_Object native;
     } intspec;
     Lisp_Object command_modes;
-    EMACS_INT doc;
+    EMACS_INT doc_offset;
 #ifdef HAVE_NATIVE_COMP
+    EMACS_INT doc_index;
     Lisp_Object native_comp_u;
     char *native_c_name;
     Lisp_Object lambda_list;
diff --git a/src/pdumper.c b/src/pdumper.c
index d45bbc84bba..51a926591d3 100644
--- a/src/pdumper.c
+++ b/src/pdumper.c
@@ -2964,7 +2964,7 @@ dump_bool_vector (struct dump_context *ctx, const struct 
Lisp_Vector *v)
 static dump_off
 dump_subr (struct dump_context *ctx, const struct Lisp_Subr *subr)
 {
-#if CHECK_STRUCTS && !defined (HASH_Lisp_Subr_20B7443AD7)
+#if CHECK_STRUCTS && !defined (HASH_Lisp_Subr_B6C57C930B)
 # error "Lisp_Subr changed. See CHECK_STRUCTS comment in config.h."
 #endif
   struct Lisp_Subr out;
@@ -2996,8 +2996,9 @@ dump_subr (struct dump_context *ctx, const struct 
Lisp_Subr *subr)
       dump_field_emacs_ptr (ctx, &out, subr, &subr->intspec.string);
       dump_field_emacs_ptr (ctx, &out, subr, &subr->command_modes);
     }
-  DUMP_FIELD_COPY (&out, subr, doc);
+  DUMP_FIELD_COPY (&out, subr, doc_offset);
 #ifdef HAVE_NATIVE_COMP
+  DUMP_FIELD_COPY (&out, subr, doc_index);
   dump_field_lv (ctx, &out, subr, &subr->native_comp_u, WEIGHT_NORMAL);
   if (!NILP (subr->native_comp_u))
     dump_field_fixup_later (ctx, &out, subr, &subr->native_c_name);