bug#48843: pos_visible_p segfault

[Christopher Howard]

Hello, I am able to consistently reproduce a segfault under rather
precise conditions, when I am doing a search while comparing two files
using emacs-vdiff. The segfault seems to be happening in pos_visible_p.

GNU Emacs 27.2 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.24.24,
cairo version 1.16.0)

christopher@nightshade ~$ guix describe
Generation 7    Jun 04 2021 15:20:58    (current)
  guix 7382aa0
    repository URL: https://git.savannah.gnu.org/git/guix.git
    branch: master
    commit: 7382aa00b82860762bc326dec6b45f8cd2161327

christopher@nightshade ~$ guix show emacs-vdiff | grep version
version: 0.2.4

christopher@nightshade ~$ neofetch --stdout | grep CPU
CPU: AMD Athlon II X3 455 (3) @ 3.300GHz

Steps to reproduce:

- Starts Emacs (in Gnome or in virtual console)
- M-x vdiff-file
- for file 1: my.dump (attached)
- for file 2: upstream.dump (attached)
- while in file 1 buffer: C-s 1 e 2 d

I figured out how to get a backtrace in gdb:

Thread 1 ".emacs-27.2-rea" received signal SIGSEGV, Segmentation fault.
0x000000000045c447 in pos_visible_p ()
(gdb) bt
#0  0x000000000045c447 in pos_visible_p ()
#1  0x000000000047ddab in Fpos_visible_in_window_p ()
#2  0x000000000056d225 in Ffuncall ()
#3  0x00000000005a0550 in exec_byte_code ()
#4  0x000000000056d17f in Ffuncall ()
#5  0x00000000005a0550 in exec_byte_code ()
#6  0x000000000056d17f in Ffuncall ()
#7  0x00000000005a0550 in exec_byte_code ()
#8  0x000000000056d17f in Ffuncall ()
#9  0x00000000005a0550 in exec_byte_code ()
#10 0x000000000056d17f in Ffuncall ()
#11 0x00000000005a0550 in exec_byte_code ()
#12 0x000000000056d17f in Ffuncall ()
#13 0x00000000005a0550 in exec_byte_code ()
#14 0x000000000056d17f in Ffuncall ()
#15 0x0000000000569be0 in Ffuncall_interactively ()
#16 0x000000000056d225 in Ffuncall ()
#17 0x000000000056d444 in Fapply ()
#18 0x000000000056b21a in Fcall_interactively ()
#19 0x000000000056d225 in Ffuncall ()
#20 0x00000000005a0550 in exec_byte_code ()
#21 0x000000000056d17f in Ffuncall ()
#22 0x000000000056d2da in call1 ()
#23 0x00000000005076f0 in command_loop_1 ()
#24 0x000000000056c53e in internal_condition_case ()
#25 0x00000000004f937c in command_loop_2 ()
#26 0x000000000056c4ad in internal_catch ()
#27 0x00000000004f9324 in command_loop ()
#28 0x00000000004fe2b6 in recursive_edit_1 ()
#29 0x00000000004fe5c4 in Frecursive_edit ()
#30 0x00000000004227e5 in main ()

I looked briefly at vdiff source code, and it only lisp code. I don't
think it proper to consider this a vdiff bug, though it seems like
something about how vdiff is handling manipulating or setting up the
windows allows the segfault situation in pos_visible_p() to occur.
-- 
Christopher Howard
blog: https://librehacker.com
social: https://gnusocial.club/librehacker

upstream.dump
Description: Text document

my.dump
Description: Text document