[Emacs-diffs] emacs-25 10835b1: Avoid crashes due to objects read with the #n=object form

[Eli Zaretskii]

branch: emacs-25
commit 10835b18cdfd93442e6fae093ffd130587006fcf
Author: Eli Zaretskii <address@hidden>
Commit: Eli Zaretskii <address@hidden>

    Avoid crashes due to objects read with the #n=object form
    
    * src/lread.c (read1): Use Fcons for 'placeholder', not AUTO_CONS,
    because elements of the list in 'read_objects' cannot be allocated
    off the stack.  (Bug#24640)
---
 src/lread.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/lread.c b/src/lread.c
index ef58b20..8a36880 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -2845,7 +2845,18 @@ read1 (Lisp_Object readcharfun, int *pch, bool 
first_in_list)
                  if (c == '=')
                    {
                      /* Make a placeholder for #n# to use temporarily.  */
-                     AUTO_CONS (placeholder, Qnil, Qnil);
+                     /* Note: We used to use AUTO_CONS to allocate
+                        placeholder, but that is a bad idea, since it
+                        will place a stack-allocated cons cell into
+                        the list in read_objects, which is a
+                        staticpro'd global variable, and thus each of
+                        its elements is marked during each GC.  A
+                        stack-allocated object will become garbled
+                        when its stack slot goes out of scope, and
+                        some other function reuses it for entirely
+                        different purposes, which will cause crashes
+                        in GC.  */
+                     Lisp_Object placeholder = Fcons (Qnil, Qnil);
                      Lisp_Object cell = Fcons (make_number (n), placeholder);
                      read_objects = Fcons (cell, read_objects);