bug#71012: 30.0.50; tree-sitter crash

[Yuan Fu]

> On May 29, 2024, at 5:28 AM, Eli Zaretskii <eliz@gnu.org> wrote:
> 
>> From: Yuan Fu <casouri@gmail.com>
>> Date: Tue, 28 May 2024 22:15:05 -0700
>> Cc: Helmut Eller <eller.helmut@gmail.com>,
>> 71012@debbugs.gnu.org
>> 
>> From what I can gather, the crash seems to be because the temp buffer is 
>> garbage collected—the inserted lisp.h is a large file, so the temp buffer is 
>> probably immediately collected, before Emacs tries to print the node in the 
>> next line. I replaced the insert-file-content with some smaller file and it 
>> didn’t crash.
> 
> It is unthinkable that a buffer is GC'ed while it is being used.
> 
>> But that theory has critical flaws: a) Emacs certainly doesn't collect the 
>> temp buffer before the with-temp-buffer form returns; b) I can’t crash Emacs 
>> in my non-debug build by inserting (garbage-collect) in front of the message 
>> line in the example; c) debug build Emacs still crashes even if I enlarge 
>> gc-cons-threshold.
>> 
>> Eli, is there anything different regarding temp buffers in debug builds?
> 
> No.
> 
> But note that there are _two_ temporary buffers involved here: one is
> created in ts-bug.el, and it remains intact and valid; the other is
> the temporary buffer created by treesit-parse-string.  That one is
> killed by the time treesit-parse-string returns, so treesit-node-start
> attempts to access positions of a killed buffer!
> 
> So I think this is a bug in treesit-parse-string: it cannot use
> with-temp-buffer; instead, it should make the buffer into which it
> inserts the string part of the parser, so that the buffer is killed
> and GC'ed only when the parser is no longer referenced.  Otherwise the
> syntax tree returned by treesit-parse-string is unsafe to use.

I see, you’re absolutely right, thanks for the analysis! On top of that I need 
to make sure all the treesit function checks for buffer liveness before 
accessing the buffer. I was under the impression that a killed buffer would 
keep its content around until it’s collected. Turns out that wasn’t the case.

Yuan