bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal

[Gerd Möllmann]

Po Lu <luangruo@yahoo.com> writes:

> I'm going to guess that window_sub_list is returning a window that was
> not marked during GC.  It's a problem that also exists with my
> incremental garbage collector.  Does this help?
>
> diff --git a/src/alloc.c b/src/alloc.c
> index 419c5e558b..522925d248 100644
> --- a/src/alloc.c
> +++ b/src/alloc.c
> @@ -6634,6 +6634,9 @@ mark_window (struct Lisp_Vector *ptr)
>        mark_glyph_matrix (w->desired_matrix);
>      }
>  
> +  if (w->next)
> +    mark_window (w->next);
> +
>    /* Filter out killed buffers from both buffer lists
>       in attempt to help GC to reclaim killed buffers faster.
>       We can do it elsewhere for live windows, but this is the

Indeed, that seems to work!