bug#61896: 30.0.50; Emacs crashes because of an invalid free

[Philip Kaludercic]

Rah Guzar <rahguzar@zohomail.eu> writes:

> I encountered something very similar today after updating emacs.
> In my case the crash was caused by trying to read an email from mu4e,
> which I have installed as a systems package.
>
> Like you I could everything worked fine with `emacs -Q`. After adding,
> mu4e to the load path, I could load it and read messages successfully.
> But with my own configuration it crashed even after removing all mu4e
> related settings from my config. Emacs crashed and I could see the
> following on the terminal I launched it from
>
> free(): invalid pointer
> Fatal error 6: Aborted
>
> along with a backtrace.

This was exactly the issue I had, though in my case the byte code was
not from a site directory.

Could you start Emacs using GDB print and run the xbacktrace command
that is defined in emacs.git's src/.gdbinit file (I believe this is best
done by starting GDB within the src directory)?

> After finding this thread, I copied the mu4e lisp files to a directory
> writable by me and byte compiled those. Adding this directory to load-path
> has fixed my problem.
>
> I think the distro provided elc files were compiled by Emacs 28
> and I am using a build of emacs 29 and some incompatible change
> recently caused this problem.
>
> For now, my fix works but is there a good way to deal with possibly
> incompatible bytecode in site-lisp directory?
>
> Rah Guzar
>
> Philip Kaludercic <philipk@posteo.net> writes:
>
>> Emacs just crashes out of nowhere, e.g. after I open a my init file.
>>
>> I have had this device for a while on a device of mine, that I couldn't
>> reproduce on my main workstation or using emacs -Q.  Apparently this
>> could be related to some faulty byte-code.
>>
>> The best I could do to detect this issue was to build Emacs using
>> -fsanitize=address and I managed to reprodce the issue reliably by
>> invoking package-recompile-all.  I collected the following log:
>>
>>
>>
>> I ran the same command in batch mode, and now the issue appears to be
>> fixed.  This gives me no reassurance, as a few days ago the I had
>> temporary managed to acchive the same state and then Emacs crashed again
>> after rebuilding again.
>>
>> In GNU Emacs 30.0.50 (build 4, x86_64-pc-linux-gnu, GTK+ Version
>>  3.24.36, cairo version 1.16.0) of 2023-03-01 built on quetzal
>> Repository revision: 4b99015e15a23bd5cbec021d53ef9fcca25b2441
>> Repository branch: master
>> System Description: Debian GNU/Linux bookworm/sid
>>
>> Configured using:
>>  'configure --with-pgtk 'CFLAGS=-O0 -ggdb3 -fsanitize=address''
>>
>> Configured features:
>> ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ JPEG
>> JSON LCMS2 LIBOTF LIBSELINUX LIBSYSTEMD LIBXML2 MODULES NOTIFY INOTIFY
>> PDUMPER PGTK PNG RSVG SECCOMP SOUND SQLITE3 THREADS TIFF
>> TOOLKIT_SCROLL_BARS TREE_SITTER WEBP XIM GTK3 ZLIB
>>
>> Important settings:
>>   value of $LC_MONETARY: en_US.UTF-8
>>   value of $LC_NUMERIC: en_US.UTF-8
>>   value of $LC_TIME: en_US.UTF-8
>>   value of $LANG: en_US.UTF-8
>>   value of $XMODIFIERS: @im=ibus
>>   locale-coding-system: utf-8-unix
>>
>> Major mode: ELisp/l
>>
>> Minor modes in effect:
>>   tooltip-mode: t
>>   global-eldoc-mode: t
>>   eldoc-mode: t
>>   show-paren-mode: t
>>   electric-indent-mode: t
>>   mouse-wheel-mode: t
>>   tool-bar-mode: t
>>   menu-bar-mode: t
>>   file-name-shadow-mode: t
>>   global-font-lock-mode: t
>>   font-lock-mode: t
>>   blink-cursor-mode: t
>>   line-number-mode: t
>>   transient-mark-mode: t
>>   auto-composition-mode: t
>>   auto-encryption-mode: t
>>   auto-compression-mode: t
>>
>> Load-path shadows:
>> None found.
>>
>> Features:
>> (shadow sort emacsbug mail-extr message mailcap yank-media puny dired
>> dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg rfc6068
>> epg-config gnus-util text-property-search time-date subr-x mm-decode
>> mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader
>> sendmail rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils
>> cus-edit pp cus-start cus-load icons wid-edit misearch multi-isearch
>> vc-git diff-mode easy-mmode vc-dispatcher cl-loaddefs cl-lib rmc
>> iso-transl tooltip cconv eldoc paren electric uniquify ediff-hook
>> vc-hooks lisp-float-type elisp-mode mwheel term/pgtk-win pgtk-win
>> term/common-win pgtk-dnd tool-bar dnd fontset image regexp-opt fringe
>> tabulated-list replace newcomment text-mode lisp-mode prog-mode register
>> page tab-bar menu-bar rfn-eshadow isearch easymenu timer select
>> scroll-bar mouse jit-lock font-lock syntax font-core term/tty-colors
>> frame minibuffer nadvice seq simple cl-generic indonesian philippine
>> cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
>> korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
>> european ethiopic indian cyrillic chinese composite emoji-zwj charscript
>> charprop case-table epa-hook jka-cmpr-hook help abbrev obarray oclosure
>> cl-preloaded button loaddefs theme-loaddefs faces cus-face macroexp
>> files window text-properties overlay sha1 md5 base64 format env
>> code-pages mule custom widget keymap hashtable-print-readable backquote
>> threads dbusbind inotify dynamic-setting system-font-setting
>> font-render-setting cairo gtk pgtk lcms2 multi-tty make-network-process
>> emacs)
>>
>> Memory information:
>> ((conses 16 65648 11383)
>>  (symbols 48 7380 0)
>>  (strings 32 19680 1617)
>>  (string-bytes 1 540967)
>>  (vectors 16 12795)
>>  (vector-slots 8 182734 13738)
>>  (floats 8 32 68)
>>  (intervals 56 625 8)
>>  (buffers 984 13))