🚀 go-pugleaf

GNU Emacs 18.57.3 of Sat Jun  8 1991 on lysator (berkeley-unix)

The function status_notify in process.c forgets to GCPRO the variable
"tail" when the process sentinel is called. Tail normally points to a
process on the Vprocess_alist, but not if the process is deleted.

Repeat by executing crash (enclosed below). My emacs, running on a
sun4, dumped core when the sentinel was called.

-----------> cut here <---------------
;;; Purpose: to trigger a bug in status_notify in process.c.

(defun crash ()
  "Crash emacs"
  (interactive)
  (let ((proc (start-process "kamikaze" (get-buffer-create "crash-buf")
			     "/bin/df")))
    (set-process-sentinel proc 'crash-sentinel)))

(defun crash-sentinel (proc msg)
  "Crash emacs. Reclaim all free cons-cells, and then reuse them."
  (let* ((free (cdr (car (garbage-collect)))))
    (make-list free '(current-buffer))))

-----------> cut here <---------------

Change "'(current-buffer)" to something else and emacs will behave
differently.

This patch seems to cure the problem. This is my first try to modify
emacs; please check it.



-----------> cut here <---------------
*** process.c.orig	Wed Jan 16 02:28:48 1991
--- process.c	Tue Aug 27 05:22:35 1991
***************
*** 2305,2319 ****
  
  status_notify ()
  {
!   register Lisp_Object tail, proc, buffer;
  
    for (tail = Vprocess_alist; !NULL (tail); tail = Fcdr (tail))
      {
        Lisp_Object symbol, msg;
        register struct Lisp_Process *p;
  
        proc = Fcdr (Fcar (tail));
        p = XPROCESS (proc);
  
        if (XINT (p->tick) != XINT (p->update_tick))
  	{
--- 2305,2326 ----
  
  status_notify ()
  {
!   register Lisp_Object proc, buffer;
!   Lisp_Object tail;  
  
    for (tail = Vprocess_alist; !NULL (tail); tail = Fcdr (tail))
      {
+       struct gcpro gcpro1;
        Lisp_Object symbol, msg;
        register struct Lisp_Process *p;
  
        proc = Fcdr (Fcar (tail));
        p = XPROCESS (proc);
+       /* If delete_exited_processes is true and the sentinel function
+ 	 garbage collects tail would be invalidated unless we protect
+ 	 it. proc will be invalid after the sentinel is called, but
+ 	 we don't use proc after that, so it doesn't matter. */
+       GCPRO1 (tail);
  
        if (XINT (p->tick) != XINT (p->update_tick))
  	{
***************
*** 2391,2396 ****
--- 2398,2404 ----
  	      set_buffer_internal (old);
  	    }
  	}
+       UNGCPRO;
      } /* end for */
  
    update_mode_lines++;  /* in case buffers use %s in mode-line-format */
-----------> cut here <---------------


---
Per Cederqvist, Lysator Computer Club, University of Linkoping, Sweden
Email: ceder@lysator.liu.se	
Phone: +46 13 26 09 17		 "CVS - Check It Out!"