bug#71073: Emacs segfaults if corfu is asked to autocomplete something while the LSP server providing completions is still starting/indexing

[Vladislav Yegorov]

Hello,

While I am not the original reporter I was able to reproduce this issue
using the config Alexis has provided.  I'm not able to reproduce it
consistently but it happens after some time, usually less then a hour.
The backtrace is not always exactly the same but the root-cause seems to
be related.  Sometimes it's the SREF macro, sometimes it's the SBYTES
macro which is causing the segmentation fault.

Here is my debugging session with gdb:

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
0x000000000057c314 in parse_modifiers_uncached (symbol=XIL(0x149fc50), 
modifier_end=<synthetic pointer>)
    at ../../src/keyboard.c:6707
6707          switch (SREF (name, i))

(gdb) p name
$1 = XIL(0x7fffe7362030)
(gdb) xtype name
Lisp_Symbol
(gdb) xsymbol name
$2 = (struct Lisp_Symbol *) 0x7fffe7f89470
"face-attribute-merged-with"
(gdb) bt
#0  0x000000000057c314 in parse_modifiers_uncached (symbol=XIL(0x149fc50), 
modifier_end=<synthetic pointer>)
    at ../../src/keyboard.c:6707
#1  parse_modifiers (symbol=XIL(0x149fc50)) at ../../src/keyboard.c:6903
#2  parse_modifiers (symbol=XIL(0x149fc50)) at ../../src/keyboard.c:6888
#3  0x00000000005930c8 in reorder_modifiers (symbol=<optimized out>) at 
../../src/keyboard.c:7028
#4  access_keymap_1 (map=XIL(0x7fffe854d20b), idx=<optimized out>, t_ok=false, 
noinherit=false, autoload=true)
    at ../../src/keymap.c:342
#5  0x0000000000581b7a in access_keymap (map=<optimized out>, idx=<optimized 
out>, t_ok=false, noinherit=false, 
    autoload=true) at ../../src/keymap.c:499
#6  read_char (commandflag=0, map=XIL(0), prev_event=XIL(0), 
used_mouse_menu=0x0, end_time=0x7fffffffb700)
    at ../../src/keyboard.c:3018
#7  0x000000000064d282 in read_filtered_event (no_switch_frame=false, 
ascii_required=false, error_nonascii=false, 
    input_method=<optimized out>, seconds=make_fixnum(30)) at 
../../src/lread.c:702
#8  0x00007fffe8b9b3af in F7369742d666f72_sit_for_0 ()
   from 
/usr/bin/../lib64/emacs/29.4/native-lisp/29.4-95d1479c/preloaded/subr-13adf6a6-bfb9f448.eln
#9  0x0000000000624ead in Ffuncall (nargs=2, args=0x7fffffffb858) at 
../../src/eval.c:2999
#10 0x00007fffd42972d4 in F6a736f6e7270632d72657175657374_jsonrpc_request_0 ()
   from 
/usr/lib64/emacs/29.4/native-lisp/29.4-95d1479c/jsonrpc-e62a9c36-62ae7160.eln
#11 0x0000000000624ead in Ffuncall (nargs=nargs@entry=8, args=0x7fffffffb930) 
at ../../src/eval.c:2999
#12 0x00000000006255c0 in Fapply (nargs=2, args=0x7fffd94002a8) at 
../../src/eval.c:2670
#13 0x00000000006701bc in exec_byte_code (fun=XIL(0xb785e102ffff), 
args_template=201785633603584, nargs=2, 
    args=0x7fffd94002a8) at ../../src/bytecode.c:809
#14 0x0000000000624ead in Ffuncall (nargs=4, args=0x7fffffffbb30) at 
../../src/eval.c:2999
#15 0x00000000005b8c42 in call3 (fn=XIL(0x3e25e35), arg1=XIL(0x7fffe855531c), 
arg2=XIL(0), arg3=XIL(0x30))
    at ../../src/lisp.h:3262
#16 Fall_completions (string=XIL(0x7fffe855531c), collection=XIL(0x3e25e35), 
predicate=XIL(0), hide_spaces=XIL(0))
    at ../../src/minibuf.c:1869
#17 0x00007fffe7bceaa7 in 
F636f6d706c6574696f6e2d70636d2d2d616c6c2d636f6d706c6574696f6e73_completion_pcm__all_completions_0
 () from 
/usr/bin/../lib64/emacs/29.4/native-lisp/29.4-95d1479c/preloaded/minibuffer-1b0f548b-25462d74.eln
#18 0x0000000000624ead in Ffuncall (nargs=5, args=0x7fffffffbd00) at 
../../src/eval.c:2999
#19 0x00007fffe7bd1ff6 in 
F636f6d706c6574696f6e2d737562737472696e672d2d616c6c2d636f6d706c6574696f6e73_completion_substring__all_completions_0
 ()
   from 
/usr/bin/../lib64/emacs/29.4/native-lisp/29.4-95d1479c/preloaded/minibuffer-1b0f548b-25462d74.eln
#20 0x0000000000624ead in Ffuncall (nargs=6, args=0x7fffffffbe20) at 
../../src/eval.c:2999
#21 0x00007fffe7bd2a86 in 
F636f6d706c6574696f6e2d666c65782d616c6c2d636f6d706c6574696f6e73_completion_flex_all_completions_0
 () from 
/usr/bin/../lib64/emacs/29.4/native-lisp/29.4-95d1479c/preloaded/minibuffer-1b0f548b-25462d74.eln
#22 0x0000000000624ead in Ffuncall (nargs=nargs@entry=5, args=0x7fffffffbeb0) 
at ../../src/eval.c:2999
#23 0x00000000006255c0 in Fapply (nargs=2, args=0x7fffd9400190) at 
../../src/eval.c:2670
#24 0x00000000006701bc in exec_byte_code (fun=XIL(0xb785e102ffff), 
args_template=201785633603584, nargs=2, 
    args=0x7fffd9400190) at ../../src/bytecode.c:809
#25 0x0000000000624ead in Ffuncall (nargs=2, args=0x7fffffffc090) at 
../../src/eval.c:2999
--Type <RET> for more, q to quit, c to continue without paging--c
#26 0x00007fffe7bbb852 in F636f6d706c6574696f6e2d2d736f6d65_completion__some_0 
()
   from 
/usr/bin/../lib64/emacs/29.4/native-lisp/29.4-95d1479c/preloaded/minibuffer-1b0f548b-25462d74.eln
#27 0x0000000000624ead in Ffuncall (nargs=3, args=0x7fffffffc190) at 
../../src/eval.c:2999
#28 0x00007fffe7bc0914 in 
F636f6d706c6574696f6e2d2d6e74682d636f6d706c6574696f6e_completion__nth_completion_0
 ()
   from 
/usr/bin/../lib64/emacs/29.4/native-lisp/29.4-95d1479c/preloaded/minibuffer-1b0f548b-25462d74.eln
#29 0x0000000000624ead in Ffuncall (nargs=7, args=0x7fffffffc2b0) at 
../../src/eval.c:2999
#30 0x00007fffe7bc0cd0 in 
F636f6d706c6574696f6e2d616c6c2d636f6d706c6574696f6e73_completion_all_completions_0
 ()
   from 
/usr/bin/../lib64/emacs/29.4/native-lisp/29.4-95d1479c/preloaded/minibuffer-1b0f548b-25462d74.eln
#31 0x0000000000624ead in Ffuncall (nargs=nargs@entry=6, args=0x7fffffffc330) 
at ../../src/eval.c:2999
#32 0x00000000006255c0 in Fapply (nargs=2, args=0x7fffd94000f8) at 
../../src/eval.c:2670
#33 0x00000000006701bc in exec_byte_code (fun=XIL(0xb785e102ffff), 
args_template=201785633603584, nargs=2, 
    args=0x7fffd94000f8) at ../../src/bytecode.c:809
#34 0x0000000000624ead in Ffuncall (nargs=nargs@entry=6, args=0x7fffffffc4e0) 
at ../../src/eval.c:2999
#35 0x00000000006255c0 in Fapply (nargs=2, args=0x7fffffffc5d0) at 
../../src/eval.c:2670
#36 0x00007fffd4194be9 in 
F636f7266752d2d66696c7465722d636f6d706c6574696f6e73_corfu__filter_completions_0 
()
   from /home/user/.emacs.d/eln-cache/29.4-95d1479c/corfu-b328809c-d9314140.eln
#37 0x0000000000624ead in Ffuncall (nargs=6, args=0x7fffffffc6b8) at 
../../src/eval.c:2999
#38 0x00007fffd4195bae in F636f7266752d2d7265636f6d70757465_corfu__recompute_0 
()
   from /home/user/.emacs.d/eln-cache/29.4-95d1479c/corfu-b328809c-d9314140.eln
#39 0x0000000000624ead in Ffuncall (nargs=5, args=0x7fffffffc818) at 
../../src/eval.c:2999
#40 0x00007fffd4196e35 in F636f7266752d2d757064617465_corfu__update_0 ()
   from /home/user/.emacs.d/eln-cache/29.4-95d1479c/corfu-b328809c-d9314140.eln
#41 0x00000000006701bc in exec_byte_code (fun=XIL(0xb785e102ffff), 
args_template=201785633603584, nargs=1, 
    args=0x7fffd9400048) at ../../src/bytecode.c:809
#42 0x0000000000624ead in Ffuncall (nargs=2, args=0x7fffffffc9c0) at 
../../src/eval.c:2999
#43 0x00007fffd419a4d7 in 
F636f7266752d2d6175746f2d636f6d706c6574652d6465666572726564_corfu__auto_complete_deferred_0
 () from /home/user/.emacs.d/eln-cache/29.4-95d1479c/corfu-b328809c-d9314140.eln
#44 0x0000000000624ead in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffcb30) at ../../src/eval.c:2999
#45 0x00000000006258b2 in Fapply (nargs=2, args=0x7fffffffcb30) at 
../../src/eval.c:2627
#46 0x0000000000624ead in Ffuncall (nargs=3, args=0x7fffffffcb28) at 
../../src/eval.c:2999
#47 0x00007fffe78bff60 in 
F74696d65722d6576656e742d68616e646c6572_timer_event_handler_0 ()
   from 
/usr/bin/../lib64/emacs/29.4/native-lisp/29.4-95d1479c/preloaded/timer-3ee7cfd9-226b3dc9.eln
#48 0x0000000000624ead in Ffuncall (nargs=2, args=0x7fffffffcc40) at 
../../src/eval.c:2999
#49 0x0000000000579f85 in call1 (fn=XIL(0xf990), arg1=<optimized out>) at 
../../src/lisp.h:3248
#50 timer_check_2 (timers=<optimized out>, idle_timers=<optimized out>) at 
../../src/keyboard.c:4690
#51 timer_check () at ../../src/keyboard.c:4756
#52 0x000000000057a56d in readable_events (flags=1) at ../../src/keyboard.c:3533
#53 0x0000000000584ea0 in get_input_pending (flags=1) at 
../../src/keyboard.c:7377
#54 0x000000000068a50f in detect_input_pending_run_timers 
(do_display=<optimized out>)
    at ../../src/keyboard.c:10907
#55 wait_reading_process_output (time_limit=<optimized out>, nsecs=<optimized 
out>, read_kbd=<optimized out>, 
    do_display=<optimized out>, wait_for_cell=<optimized out>, 
wait_proc=<optimized out>, 
    just_wait_proc=<optimized out>) at ../../src/process.c:5786
#56 0x000000000048569e in sit_for (timeout=<optimized out>, reading=<optimized 
out>, display_option=1)
    at ../../src/dispnew.c:6264
#57 0x0000000000582913 in read_char (commandflag=1, map=XIL(0x3c18873), 
prev_event=XIL(0), 
    used_mouse_menu=0x7fffffffd8fb, end_time=0x0) at ../../src/keyboard.c:2881
#58 0x0000000000589c03 in read_key_sequence (keybuf=0x7fffffffda70, 
prompt=XIL(0), dont_downcase_last=false, 
    can_return_switch_frame=true, fix_current_buffer=true, 
prevent_redisplay=false) at ../../src/keyboard.c:10084
#59 0x0000000000576135 in command_loop_1 () at ../../src/keyboard.c:1384
#60 0x00000000006131ce in internal_condition_case (bfun=0x575f70 
<command_loop_1>, handlers=<optimized out>, 
    hfun=0x575420 <cmd_error>) at ../../src/eval.c:1474
#61 0x000000000057569e in command_loop_2 (handlers=handlers@entry=XIL(0x90)) at 
../../src/keyboard.c:1133
#62 0x0000000000613127 in internal_catch (tag=<optimized out>, func=0x575660 
<command_loop_2>, arg=XIL(0x90))
    at ../../src/eval.c:1197
#63 0x0000000000575af3 in command_loop () at ../../src/keyboard.c:1111
#64 0x0000000000575bef in recursive_edit_1 () at ../../src/keyboard.c:720
#65 0x0000000000575ddd in Frecursive_edit () at ../../src/keyboard.c:803
#66 0x00000000004795a9 in main (argc=<optimized out>, argv=0x7fffffffdf58) at 
../../src/emacs.c:2521

Lisp Backtrace:
"sit-for" (0xffffb860)
0x2aea4e8 PVEC_SUBR
"apply" (0xd94002a8)
"jsonrpc-request" (0xd9400240)
0x3e248a0 PVEC_COMPILED
0x3e25e30 PVEC_COMPILED
"completion-pcm--all-completions" (0xffffbd08)
"completion-substring--all-completions" (0xffffbe28)
0xe7f6ea60 PVEC_SUBR
"apply" (0xd9400190)
"completion-flex-all-completions" (0xd9400138)
0x3df14c8 PVEC_COMPILED
"completion--some" (0xffffc198)
"completion--nth-completion" (0xffffc2b8)
0xe80b4af8 PVEC_SUBR
"apply" (0xd94000f8)
"completion-all-completions" (0xffffc4e8)
"corfu--filter-completions" (0xffffc6c0)
"corfu--recompute" (0xffffc820)
"corfu--update" (0xd9400048)
"corfu--exhibit" (0xffffc9c8)
"corfu--auto-complete-deferred" (0xffffcb38)
"apply" (0xffffcb30)
"timer-event-handler" (0xffffcc48)

It looks like this `parse_modifiers_uncached' method gets a seemingly
random argument.  When trying to debug this issue I've noticed many
different arguments for the `name' variable, some include:

(gdb) p name
$1 = XIL(0)
(gdb) xtype name
Lisp_Symbol
(gdb) xsymbol name
$2 = (struct Lisp_Symbol *) 0xc27440 <lispsym>
"nil"

(gdb) p name
$1 = XIL(0x1e4c253)
(gdb) xtype
Lisp_Cons
(gdb) xcons
$3 = (struct Lisp_Cons *) 0x2a73690
{
  u = {
    s = {
      car = XIL(0),
      u = {
        cdr = XIL(0),
        chain = 0x0
      }
    },
    gcaligned = 0x0
  }
}

I also had a lisp float as the argument once but it appears that I've
lost this specific session.

I tried to compile my own version of Emacs and it /appears/ that this
one is fine despite using the same source as the fedora provided
version.  I also tried to package/compile my own version for fedora
using the rpm build system and surprisingly enough this one also
crashed.  The issue might be related to something fedora does but this
is just a guess.  Some user-submitted crash reports on fedora seem to
report a very similar issue[1].

If you have any pointers and or want me to test something please let me
know.

1: https://retrace.fedoraproject.org/faf/problems/675750/