bug#36740: 27.0.50; apparently buggy code in ccl.c (lookup-integer-constant)

[Eli Zaretskii]

> Date: Sat, 20 Jul 2019 16:15:52 +0300
> From: Eli Zaretskii <eliz@gnu.org>
> Cc: 36740@debbugs.gnu.org
> 
> > From: Pip Cet <pipcet@gmail.com>
> > Date: Sat, 20 Jul 2019 12:29:57 +0000
> > 
> > This code in ccl.c
> > 
> >         eop = hash_lookup (h, make_fixnum (reg[RRR]), NULL);
> >         if (eop >= 0)
> >           {
> >             Lisp_Object opl;
> >             opl = HASH_VALUE (h, eop);
> >             if (! (IN_INT_RANGE (eop) && CHARACTERP (opl)))
> >               CCL_INVALID_CMD;
> >             reg[RRR] = charset_unicode;
> >             reg[rrr] = eop;
> >             reg[7] = 1; /* r7 true for success */
> >           }
> >         else
> >           reg[7] = 0;
> > 
> > seems wrong to me. We look up the hash value for reg[RRR], but then we
> > store the hash _index_ into reg[rrr], and throw away the actual value.
> 
> The comment for the op-code says:
> 
>   #define CCL_LookupIntConstTbl 0x13 /* Lookup multibyte character by
>                                       integer key.  Afterwards R7 set
>                                       to 1 if lookup succeeded.
>                                       1:ExtendedCOMMNDRrrRRRXXXXXXXX
>                                       2:ARGUMENT(Hash table ID) */
> 
> so there appears to be no significance to r7's value?

Actually, I think you are right.  In Emacs 22.1 we had this:

            case CCL_LookupIntConstTbl:
              op = XINT (ccl_prog[ic]); /* table */
              ic++;
              {
                struct Lisp_Hash_Table *h = GET_HASH_TABLE (op);

                op = hash_lookup (h, make_number (reg[RRR]), NULL);
                if (op >= 0)
                  {
                    Lisp_Object opl;
                    opl = HASH_VALUE (h, op);
                    if (!CHAR_VALID_P (XINT (opl), 0))
                      CCL_INVALID_CMD;
                    SPLIT_CHAR (XINT (opl), reg[RRR], i, j);
                    if (j != -1)
                      i = (i << 7) | j;
                    reg[rrr] = i;
                    reg[7] = 1; /* r7 true for success */
                  }
                else
                  reg[7] = 0;
              }

So this was fixed at some point, but for some reason the fix didn't
make it into Emacs 23.

So yes, I think we should use the value of XINT(opl) here.