bug#30931: 27.0.50; Crash in "Automatic GC"

[Michał Kondraciuk]

Newest Emacs (and 25.3) crashes for me. Unfortunately I can only 
reproduce this using newest versions of Ivy and yasnippet packages.

Backtrace (full backtrace in attachment):

#0  0x00007ffff1190269 in raise (sig=6) at 
../sysdeps/unix/sysv/linux/pt-raise.c:35
#1  0x0000000000568a3a in terminate_due_to_signal (sig=6, 
backtrace_limit=40) at ../../src/emacs.c:395
#2  0x000000000058fc5d in emacs_abort () at ../../src/sysdep.c:2426
#3  0x000000000061719a in signal_or_quit (error_symbol=XIL(0x7b60), 
data=XIL(0x232e613), keyboard_quit=false) at ../../src/eval.c:1595
#4  0x00000000006170f1 in Fsignal (error_symbol=XIL(0x7b60), 
data=XIL(0x232e613)) at ../../src/eval.c:1565
#5  0x00000000005663e3 in xsignal (error_symbol=XIL(0x7b60), 
data=XIL(0x232e613)) at ../../src/lisp.h:3944
#6  0x00000000006175d9 in xsignal1 (error_symbol=XIL(0x7b60), 
arg=XIL(0x2233484)) at ../../src/eval.c:1702
#7  0x00000000005cddda in compile_pattern_1 (cp=0xcc4440 
<searchbufs+6688>, pattern=XIL(0x1904bf4), translate=XIL(0), 
posix=false) at ../../src/search.c:165
#8  0x00000000005ce09a in compile_pattern (pattern=XIL(0x1904bf4), 
regp=0x0, translate=XIL(0), posix=false, multibyte=true) at 
../../src/search.c:248
#9  0x00000000005ceb94 in fast_string_match_internal 
(regexp=XIL(0x1904bf4), string=XIL(0x1c99f34), table=XIL(0)) at 
../../src/search.c:481
#10 0x0000000000566444 in fast_string_match (regexp=XIL(0x1904bf4), 
string=XIL(0x1c99f34)) at ../../src/lisp.h:4150
#11 0x00000000005b2ca9 in Ffind_file_name_handler 
(filename=XIL(0x1c99f34), operation=XIL(0x5580)) at ../../src/fileio.c:306
#12 0x00000000005b39f6 in Fexpand_file_name (name=XIL(0x1c99f34), 
default_directory=XIL(0)) at ../../src/fileio.c:783
#13 0x00000000005bf41f in Fdo_auto_save (no_message=XIL(0xc0f0), 
current_only=XIL(0)) at ../../src/fileio.c:5574
#14 0x000000000056b219 in shut_down_emacs (sig=6, stuff=XIL(0)) at 
../../src/emacs.c:2111
#15 0x00000000005689e1 in terminate_due_to_signal (sig=6, 
backtrace_limit=40) at ../../src/emacs.c:378
#16 0x000000000058fc5d in emacs_abort () at ../../src/sysdep.c:2426
#17 0x00000000005f4b7b in mark_object (arg=XIL(0x23b5e81)) at 
../../src/alloc.c:6707
#18 0x00000000005f4c4e in mark_object (arg=XIL(0x232e893)) at 
../../src/alloc.c:6725
#19 0x00000000005f4c4e in mark_object (arg=XIL(0x232e813)) at 
../../src/alloc.c:6725
#20 0x00000000005f19d5 in mark_maybe_object (obj=XIL(0x232e813)) at 
../../src/alloc.c:4844
#21 0x00000000005f1bb3 in mark_memory (start=0x7fffffff2d90, 
end=0x7fffffffdc58) at ../../src/alloc.c:4988
#22 0x00000000005f1be8 in mark_stack (bottom=0x7fffffffdc58 "", 
end=0x7fffffff2d90 "\240-\377\377\377\177") at ../../src/alloc.c:5195
#23 0x00000000006a0eff in mark_one_thread (thread=0xcfbac0 
<main_thread>) at ../../src/thread.c:616
#24 0x00000000006a1000 in mark_threads_callback (ignore=0x0) at 
../../src/thread.c:649
#25 0x00000000005f1c3e in flush_stack_call_func (func=0x6a0fba 
<mark_threads_callback>, arg=0x0) at ../../src/alloc.c:5222
#26 0x00000000006a102c in mark_threads () at ../../src/thread.c:656
#27 0x00000000005f3670 in garbage_collect_1 (end=0x7fffffff2f90) at 
../../src/alloc.c:6000
#28 0x00000000005f3d73 in Fgarbage_collect () at ../../src/alloc.c:6171
#29 0x000000000056655d in maybe_gc () at ../../src/lisp.h:4838
#30 0x000000000061a3ee in Ffuncall (nargs=3, args=0x7fffffff3048) at 
../../src/eval.c:2803
#31 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x21552e4), 
vector=XIL(0x2157365), maxdepth=make_number(9), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632
#32 0x000000000061b2f1 in funcall_lambda (fun=XIL(0x21573d5), nargs=2, 
arg_vector=0x2157365) at ../../src/eval.c:3104
#33 0x000000000061a4f3 in Ffuncall (nargs=3, args=0x7fffffff3500) at 
../../src/eval.c:2823
#34 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x2157a54), 
vector=XIL(0x2157775), maxdepth=make_number(7), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632
#35 0x000000000061b2f1 in funcall_lambda (fun=XIL(0x215ac45), nargs=2, 
arg_vector=0x2157775) at ../../src/eval.c:3104
#36 0x000000000061a4f3 in Ffuncall (nargs=3, args=0x7fffffff39c8) at 
../../src/eval.c:2823
#37 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x2157ab4), 
vector=XIL(0x215ac75), maxdepth=make_number(7), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632
#38 0x000000000061b2f1 in funcall_lambda (fun=XIL(0x215ad55), nargs=2, 
arg_vector=0x215ac75) at ../../src/eval.c:3104
#39 0x000000000061a4f3 in Ffuncall (nargs=3, args=0x7fffffff3f38) at 
../../src/eval.c:2823
#40 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x21651b4), 
vector=XIL(0x2165fb5), maxdepth=make_number(3), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632
#41 0x000000000061b2f1 in funcall_lambda (fun=XIL(0x2165fd5), nargs=0, 
arg_vector=0x2165fb5) at ../../src/eval.c:3104
#42 0x000000000061a4f3 in Ffuncall (nargs=1, args=0x7fffffff43b0) at 
../../src/eval.c:2823
#43 0x0000000000618c3f in eval_sub (form=XIL(0x232e6c3)) at 
../../src/eval.c:2257
#44 0x0000000000614e4f in Fprogn (body=XIL(0)) at ../../src/eval.c:455
#45 0x00000000006160c2 in Flet (args=XIL(0x232e6a3)) at ../../src/eval.c:969
#46 0x0000000000618a08 in eval_sub (form=XIL(0x232e693)) at 
../../src/eval.c:2238
#47 0x0000000000618443 in Feval (form=XIL(0x232e693), lexical=XIL(0)) at 
../../src/eval.c:2106
#48 0x000000000061a8f4 in funcall_subr (subr=0xc63a20 <Seval>, 
numargs=1, args=0x7fffffff4860) at ../../src/eval.c:2898
#49 0x000000000061a4af in Ffuncall (nargs=2, args=0x7fffffff4858) at 
../../src/eval.c:2821
#50 0x0000000000666193 in exec_byte_code (bytestr=XIL(0x2165114), 
vector=XIL(0x2166005), maxdepth=make_number(8), args_template=XIL(0), 
nargs=0, args=0x0) at ../../src/bytecode.c:632

Lisp backtrace:

"Automatic GC" (0x0)
"mapcar" (0xffff3050)
"yas-active-snippets" (0xffff3508)
"yas--place-overlays" (0xffff39d0)
"yas--move-to-field" (0xffff3f40)
0x2165fd0 PVEC_COMPILED
"funcall" (0xffff43b0)
"let" (0xffff4600)
"eval" (0xffff4860)
"yas-expand-snippet" (0xffff4f60)
"yas--expand-or-prompt-for-template" (0xffff5440)
"yas-expand" (0xffff58f0)
"save-restriction" (0xffff5b40)
"save-current-buffer" (0xffff5cc0)
"update-fn" (0xffff5f10)
"ivy--insert-minibuffer" (0xffff63d0)
"ivy--exhibit" (0xffff6980)
"ivy--queue-exhibit" (0xffff6e30)
"execute-kbd-macro" (0xffff7230)
"while" (0xffff7350)
"let" (0xffff7570)
0x1251040 Lisp type 3
"apply" (0xffff7958)
"timer-event-handler" (0xffff7ea8)
"input-pending-p" (0xffff81e8)
"sit-for" (0xffff86c0)
"yas-expand-snippet" (0xffff8dc0)
"yas--expand-or-prompt-for-template" (0xffff92a0)
"yas-expand" (0xffff9750)
"save-restriction" (0xffff99a0)
"save-current-buffer" (0xffff9b20)
"update-fn" (0xffff9d70)
"ivy--insert-minibuffer" (0xffffa230)
"ivy--exhibit" (0xffffa7e0)
"ivy--minibuffer-setup" (0xffffacd0)
0x21d5720 PVEC_COMPILED
"read-from-minibuffer" (0xffffb598)
"ivy-read" (0xffffbd10)
"catch" (0xffffbfc0)
"while" (0xffffc170)
"let" (0xffffc390)
"let" (0xffffc5b0)
"progn" (0xffffc700)
"eval" (0xffffc990)
"eval-expression" (0xffffcfb0)
"funcall-interactively" (0xffffcfa8)
"call-interactively" (0xffffd3e0)
"command-execute" (0xffffd928)

Emacs first crashed for me on 25.3, when I was calling 
`yas-expand-snippet` inside `save-restriction` form inside `ivy-read`. I 
wrote this form to try to reproduce this:

(progn
  (package-initialize)
  (require 'yasnippet)
  (require 'ivy)

  (yas-reload-all)

  (switch-to-buffer "*scratch*")
  (lisp-interaction-mode)
  (yas-minor-mode-on)

  (let ((templates (mapcar #'yas--template-key
                           (yas--all-templates 
(yas--get-snippet-tables)))))
    (defun update-fn ()
      (with-current-buffer "*scratch*"
        (save-restriction
          (narrow-to-region 3 3)
          (insert " " (ivy-state-current ivy-last))
          (yas-expand)
          (mapc #'yas-abort-snippet (yas-active-snippets)))
        (redisplay)))
    (let ((buffer-undo-list t))
      (while t
        (erase-buffer)
        (insert "aaaaaa")
        (redisplay)
        (sit-for 0.1)
        (run-with-timer
         0.01 nil (lambda ()
                    (dotimes (_ (% (random) 15))
                      (execute-kbd-macro "\C-n")
                      (sit-for 0.05)
                      (redisplay)
                      (when (zerop (% (random) 4))
                        (execute-kbd-macro "\C-p")
                        (sit-for 0.05)
                        (redisplay)))
                    (sit-for 0.1)
                    (redisplay)
                    (abort-recursive-edit)))
        (catch 'exit
          (condition-case err
              (ivy-read "foo: " templates
                        :update-fn #'update-fn)
            (quit)))))))


Steps to reproduce:

1. Install newest ivy, yasnippet and yasnippet-snippets

2. Run emacs -Q

3. Eval form above

4. Typically emacs crashes after about 1-2 minutes


In GNU Emacs 27.0.50 (build 13, x86_64-pc-linux-gnu, GTK+ Version 3.18.9)
 of 2018-03-24 built on mkc
Repository revision: 4cfd2a2a92e2890af76bcd8375f966ce67ef2482
Windowing system distributor 'The X.Org Foundation', version 11.0.11804000
System Description: Linux Mint 18.2

Configured using:
 'configure 'CFLAGS=-O0 -g2''

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GSETTINGS NOTIFY
LIBSELINUX GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS GTK3 X11 THREADS LIBSYSTEMD LCMS2

Important settings:
  value of $LC_CTYPE: en_US.UTF-8
  value of $LC_MONETARY: pl_PL.UTF-8
  value of $LC_NUMERIC: pl_PL.UTF-8
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

gdb.txt
Description: Text document