bug#37575: 27.0.50; Segfault on redisplay

[Eli Zaretskii]

> From: Richard Copley <rcopley@gmail.com>
> Date: Tue, 1 Oct 2019 20:17:16 +0100
> 
> I typed C-w. Emacs crashed.
> This was in "emacs -Q" (master), in a message-mode buffer.
> 
> Backtraces:
> 
> (gdb) bt
> #0  0x00007ff9ab4cc803 in KERNELBASE!DebugBreak () from 
> C:\WINDOWS\System32\KernelBase.dll
> #1  0x00000004003862d9 in emacs_abort () at w32fns.c:10802
> #2  0x000000040014afee in terminate_due_to_signal (sig=11, 
> backtrace_limit=40) at emacs.c:401
> #3  0x0000000400182aed in handle_fatal_signal (sig=11) at sysdep.c:1790
> #4  0x0000000400182ac0 in deliver_thread_signal (sig=11, handler=0x400182ad5 
> <handle_fatal_signal>) at
> sysdep.c:1764
> #5  0x0000000400182b29 in deliver_fatal_thread_signal (sig=11) at 
> sysdep.c:1802
> #6  0x000000040043e766 in _gnu_exception_handler (exception_data=0xbf2d40)
>     at 
> E:/mingwbuild/mingw-w64-crt-git/src/mingw-w64/mingw-w64-crt/crt/crt_handler.c:223
> #7  0x00007ff9abb58048 in msvcrt!__C_specific_handler () from 
> C:\WINDOWS\System32\msvcrt.dll
> #8  0x00007ff9adb735df in ntdll!.chkstk () from C:\WINDOWS\SYSTEM32\ntdll.dll
> #9  0x00007ff9adb220a9 in ntdll!RtlRaiseException () from 
> C:\WINDOWS\SYSTEM32\ntdll.dll
> #10 0x00007ff9adb7224e in ntdll!KiUserExceptionDispatcher () from 
> C:\WINDOWS\SYSTEM32\ntdll.dll
> #11 0x0000000400217205 in re_match_2_internal (bufp=0x4008fdef0 
> <searchbufs+752>, string1=0x1600000
> "MZ\220",
>     size1=179, string2=0x1601569 "", size2=3470, pos=1589, regs=0x400790778 
> <main_thread+152>,
> stop=1931)
>     at regex-emacs.c:4940

Hmm... I don't see how re_match_2_internal on line 4940 could possibly
cause a fatal signal, and that .chkstk in the backtrace is a hint of
some stack-related problem.  Could it be that the thread that actually
crashed was not the Lisp thread?  If you still have this crashed
sesion inside GDB, please show the result of

  (gdb) thread apply all bt

> #12 0x000000040021108a in rpl_re_search_2 (bufp=0x4008fdef0 <searchbufs+752>, 
> str1=0x1600000
> "MZ\220", size1=179,
>     str2=0x1601569 "", size2=3470, startpos=1589, range=342, regs=0x400790778 
> <main_thread+152>,
> stop=1931)
>     at regex-emacs.c:3373
> #13 0x00000004001fb4b4 in search_buffer_re (string=XIL(0xe420e4), pos=1426, 
> pos_byte=1426, lim=1932,
> lim_byte=1932,
>     n=1, trt=XIL(0), inverse_trt=XIL(0), posix=false) at search.c:1244
> #14 0x00000004001fc373 in search_buffer (string=XIL(0xe420e4), pos=1426, 
> pos_byte=1426, lim=1932,
> lim_byte=1932, n=1,
>     RE=1, trt=XIL(0), inverse_trt=XIL(0), posix=false) at search.c:1506
> #15 0x00000004001facb7 in search_command (string=XIL(0xe420e4), 
> bound=make_fixnum(1932),
> noerror=XIL(0x30),
>     count=XIL(0), direction=1, RE=1, posix=false) at search.c:1048

It would be also good to know what was that STRING argument to
search_command.  It should be a regular expression.

Do you have any unusual customizations related to message-mode?