bug#65726: 29.1.50; Crash in regexp engine

[Eli Zaretskii]

> Cc: martin rudalics <rudalics@gmx.at>
> From: Mattias Engdegård <mattias.engdegard@gmail.com>
> Date: Mon, 4 Sep 2023 10:44:06 +0200
> 
> Can't reproduce here (macOS). Can you give us a deeper backtrace?

I can reproduce on MS-Windows.  It's an infinite recursion.

> Try finding out the Lisp context: what function is called and with what 
> arguments? What is the regexp, exactly? What text does it attempt to match 
> against?

Here's the end of the call stack:

  #104528 0x0120bbc4 in search_buffer_re (string=XIL(0x8000000007e5e308),
      pos=62669, pos_byte=62669, lim=300101, lim_byte=300103, n=1,
      trt=XIL(0xa00000000631c92c), inverse_trt=XIL(0xa000000006231ed4),
      posix=false) at search.c:1265
  #104529 0x0120cae5 in search_buffer (string=XIL(0x8000000007e5e308),
      pos=62669, pos_byte=62669, lim=300101, lim_byte=300103, n=1, RE=1,
      trt=XIL(0xa00000000631c92c), inverse_trt=XIL(0xa000000006231ed4),
      posix=false) at search.c:1527
  #104530 0x0120b404 in search_command (string=XIL(0x8000000007e5e308),
      bound=XIL(0), noerror=XIL(0x30), count=XIL(0), direction=1, RE=1,
      posix=false) at search.c:1069
  #104531 0x0120e35a in Fre_search_forward (regexp=XIL(0x8000000007e5e308),
      bound=XIL(0), noerror=XIL(0x30), count=XIL(0)) at search.c:2294
  #104532 0x0127860e in eval_sub (form=XIL(0xc000000007dbef40)) at eval.c:2508
  #104533 0x0126f601 in Fand (args=XIL(0xc000000007dbe810)) at eval.c:370
  #104534 0x012780e0 in eval_sub (form=XIL(0xc000000007dbef30)) at eval.c:2449
  #104535 0x0126f847 in Fcond (args=XIL(0xc000000007e16d00)) at eval.c:412
  #104536 0x012780e0 in eval_sub (form=XIL(0xc000000007e16d70)) at eval.c:2449
  #104537 0x0126fa9d in Fprogn (body=XIL(0)) at eval.c:436
  #104538 0x01272b16 in Flet (args=XIL(0xc000000007e16d90)) at eval.c:1026
  #104539 0x012780e0 in eval_sub (form=XIL(0xc000000007e16da0)) at eval.c:2449
  #104540 0x0126fa9d in Fprogn (body=XIL(0)) at eval.c:436
  #104541 0x012780e0 in eval_sub (form=XIL(0xc000000007e17740)) at eval.c:2449
  #104542 0x0126f74a in Fif (args=XIL(0xc000000007e16dd0)) at eval.c:391
  #104543 0x012780e0 in eval_sub (form=XIL(0xc000000007e16dc0)) at eval.c:2449
  #104544 0x0126fa9d in Fprogn (body=XIL(0)) at eval.c:436
  #104545 0x01272b16 in Flet (args=XIL(0xc000000007e16e00)) at eval.c:1026
  #104546 0x012780e0 in eval_sub (form=XIL(0xc000000007e16e10)) at eval.c:2449
  #104547 0x0126fa9d in Fprogn (body=XIL(0)) at eval.c:436
  #104548 0x0126f7ae in Fif (args=XIL(0xc000000007e16e30)) at eval.c:392
  #104549 0x012780e0 in eval_sub (form=XIL(0xc000000007e16e20)) at eval.c:2449
  #104550 0x0126fa9d in Fprogn (body=XIL(0xc000000007dbeb50)) at eval.c:436
  #104551 0x0127247c in FletX (args=XIL(0xc000000007e16fc0)) at eval.c:958
  #104552 0x012780e0 in eval_sub (form=XIL(0xc000000007e16fd0)) at eval.c:2449
  #104553 0x0126fa9d in Fprogn (body=XIL(0)) at eval.c:436
  #104554 0x0127b95e in funcall_lambda (fun=XIL(0xc000000007dbe750), nargs=0,
      arg_vector=0x82ecb0) at eval.c:3233
  #104555 0x0127a4c9 in funcall_general (fun=XIL(0xc000000007dbe750),
      numargs=0, args=0x82ecb0) at eval.c:2957
  #104556 0x0127a6b7 in Ffuncall (nargs=1, args=0x82eca8) at eval.c:2995
  #104557 0x012693e3 in Ffuncall_interactively (nargs=1, args=0x82eca8)
      at callint.c:250
  #104558 0x0127ad17 in funcall_subr (subr=0x1881580 <Sfuncall_interactively>,
      numargs=1, args=0x82eca8) at eval.c:3059
  #104559 0x0127a2cb in funcall_general (fun=XIL(0xa000000001881580),
      numargs=1, args=0x82eca8) at eval.c:2941
  #104560 0x0127a6b7 in Ffuncall (nargs=2, args=0x82eca0) at eval.c:2995
  #104561 0x012790cb in Fapply (nargs=3, args=0x82eca0) at eval.c:2619
  #104562 0x01269ae9 in Fcall_interactively (function=XIL(0x60de7c0),
      record_flag=XIL(0), keys=XIL(0xa000000007970198)) at callint.c:342
  #104563 0x0127a915 in funcall_subr (subr=0x18815c0 <Scall_interactively>,
      numargs=3, args=0x6c50078) at eval.c:3038
  #104564 0x012ed316 in exec_byte_code (fun=XIL(0xa00000000615797c),
      args_template=1025, nargs=1, args=0x82f590) at bytecode.c:809
  #104565 0x0127ae66 in fetch_and_exec_byte_code (fun=XIL(0xa00000000615797c),
      args_template=1025, nargs=1, args=0x82f588) at eval.c:3081
  #104566 0x0127b3c5 in funcall_lambda (fun=XIL(0xa00000000615797c), nargs=1,
      arg_vector=0x82f588) at eval.c:3153
  #104567 0x0127a332 in funcall_general (fun=XIL(0xa00000000615797c),
      numargs=1, args=0x82f588) at eval.c:2945
  #104568 0x0127a6b7 in Ffuncall (nargs=2, args=0x82f580) at eval.c:2995
  #104569 0x0116d992 in call1 (fn=XIL(0x4590), arg1=XIL(0x60de7c0))
      at lisp.h:3248
  #104570 0x01171cb7 in command_loop_1 () at keyboard.c:1503
  #104571 0x01274470 in internal_condition_case (
      bfun=0x11710ec <command_loop_1>, handlers=XIL(0x90),
      hfun=0x11700ba <cmd_error>) at eval.c:1474
  #104572 0x01170b59 in command_loop_2 (handlers=XIL(0x90)) at keyboard.c:1133
  #104573 0x012732f7 in internal_catch (tag=XIL(0x103b0),
      func=0x1170b22 <command_loop_2>, arg=XIL(0x90)) at eval.c:1197
  #104574 0x01170ac4 in command_loop () at keyboard.c:1111
  #104575 0x0116fb1a in recursive_edit_1 () at keyboard.c:720
  #104576 0x0116fdb8 in Frecursive_edit () at keyboard.c:803
  #104577 0x0116ab60 in main (argc=2, argv=0xa428e0) at emacs.c:2521

  Lisp Backtrace:
  "re-search-forward" (0x82d6a0)
  "and" (0x82d8a0)
  "cond" (0x82da60)
  "let" (0x82dcf0)
  "progn" (0x82deb0)
  "if" (0x82e070)
  "let" (0x82e300)
  "if" (0x82e500)
  "let*" (0x82e770)
  "elinfo-goto-texi" (0x82ecb0)
  "funcall-interactively" (0x82eca8)
  "call-interactively" (0x6c50078)
  "command-execute" (0x82f588)
(gdb)

In frame #104531, we have:

  #104531 0x0120e35a in Fre_search_forward (regexp=XIL(0x8000000007e5e308),
      bound=XIL(0), noerror=XIL(0x30), count=XIL(0)) at search.c:2294

and regexp is this monstrocity:

    "\\(split\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ 
\t\n]*\\)-\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ 
\t\n]*\\)window\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ \t\n]*\\)[ 
\t\n]+\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ 
\t\n]*\\)&optional\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ \t\n]*\\)[ 
\t\n]+\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ 
\t\n]*\\)window\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ \t\n]*\\)[ 
\t\n]+\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ 
\t\n]*\\)size\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ \t\n]*\\)[ 
\t\n]+\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ 
\t\n]*\\)side\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ \t\n]*\\)[ 
\t\n]+\\(?:\\(?:@[a-z]+{\\|[}`'\"_:]*\\)*[ \t\n]*\\)pixelwise\\)\\|^node"

Feel free to ask more questions, as I can reproduce this at will.