Nasty GC bug

[Dmitry Antipov]

It looks like live_cons_p (M, P) may be true if P is a cons cell from
the spare_memory[X], X = 1..4. So, mark_maybe_{object, pointer} may
call to mark_object for an uninitialized cons from spare blocks, with
random results (most probably a crash). This is very hard to reproduce
because it depends from the values found on a C stack.

The same looks to be true for live_string_p and spare_memory[5, 6].

Suggested fix is to use MEM_TYPE_NON_LISP for spare memory, e.g.:

=== modified file 'src/alloc.c'
--- src/alloc.c 2012-08-21 23:39:56 +0000
+++ src/alloc.c 2012-08-24 07:23:48 +0000
@@ -3816,22 +3816,22 @@
     spare_memory[0] = malloc (SPARE_MEMORY);
   if (spare_memory[1] == 0)
     spare_memory[1] = lisp_align_malloc (sizeof (struct cons_block),
-                                                 MEM_TYPE_CONS);
+                                                 MEM_TYPE_NON_LISP);
   if (spare_memory[2] == 0)
     spare_memory[2] = lisp_align_malloc (sizeof (struct cons_block),
-                                        MEM_TYPE_CONS);
+                                        MEM_TYPE_NON_LISP);
   if (spare_memory[3] == 0)
     spare_memory[3] = lisp_align_malloc (sizeof (struct cons_block),
-                                        MEM_TYPE_CONS);
+                                        MEM_TYPE_NON_LISP);
   if (spare_memory[4] == 0)
     spare_memory[4] = lisp_align_malloc (sizeof (struct cons_block),
-                                        MEM_TYPE_CONS);
+                                        MEM_TYPE_NON_LISP);
   if (spare_memory[5] == 0)
     spare_memory[5] = lisp_malloc (sizeof (struct string_block),
-                                  MEM_TYPE_STRING);
+                                  MEM_TYPE_NON_LISP);
   if (spare_memory[6] == 0)
     spare_memory[6] = lisp_malloc (sizeof (struct string_block),
-                                  MEM_TYPE_STRING);
+                                  MEM_TYPE_NON_LISP);
   if (spare_memory[0] && spare_memory[1] && spare_memory[5])
     Vmemory_full = Qnil;
 #endif

Comments?

Dmitry