bug#24764: 25.1.50; Another crash in automatic gc

[Andreas Schwab]

On Okt 22 2016, Eli Zaretskii <eliz@gnu.org> wrote:

>> I think this could be provoked by some lisp stuff I currently develop
>> that does a lot of consing, dunno (but of cause I don't funcall `crash'
>> anywhere, at least not willingly :-) ).  Crashs happen every ten minutes or
>> so, and at totally random points.
>> 
>> Here is the gdb output.  Session still open.
>> [...]
>> 
>> (gdb) bt full
>> #0  0x000000000058aae0 in unchain_marker (marker=0x88e9968) at marker.c:605
>>         tail = 0x2020200020202020 <<<<<<<<<<<<<<<<<<<<<<<<
>>         prev = 0x2020200020202030 <<<<<<<<<<<<<<<<<<<<<<<<
>
> Your marker pointers are actually full of blank (and other ASCII)
> characters.  So some code somewhere either writes past the end of some
> stack-based array or otherwise overwrites the stack.

More likely, BUF_MARKERS is already overwritten.  (The "other ASCII
character" comes from the offset of ->next).  What do the other contents
of b->text look like?  Finding the place where a member of a struct
buffer is overwritten can be done with a watchpoint.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."