bug#81568: 32.0.50; crash in Fnext_single_property_change

Salve Eli!

>> Date: Thu, 06 Aug 2026 19:09:52 +0300
>> From: Andrei Elkin via "Bug reports for GNU Emacs,
>>  the Swiss army knife of text editors" <[email protected]>
>> 
>> I got a crash when my last activity was selecting a piece of text with
>> mouse.
>> Emacs process is still alive in gdb for inspection by who volunteers.
>> The stacks - bt, xbacktrace, bt full - placed below.
>
> Please try to figure out which data caused the segfault.  The code
> where it happens is
>
>   next = next_interval (i);
>   while (next
> 	 && EQ (here_val, textget (next->plist, prop))
> 	 && (NILP (limit) || next->position < XFIXNUM (limit)))
>     next = next_interval (next);
>
> and according to the backtrace, the value of 'next' looks okay at
> first sight.

We have a cycle, that is

   next == i

   (gdb) p i
   $14 = (INTERVAL) 0x55557a555b40
   (gdb) p next
   $15 = (INTERVAL) 0x55557a555b40

Note `next= ...` initialization
   (gdb) p next_interval (i)
   $16 = (struct interval *) 0x55557a555b08

is not of `i` pointer.

Having gdb session I tried to reproduce the cycle, only to interrupt that in few
seconds when the loop count reached some large value

   (gdb) set $next=$16
   (gdb) while i != $next
   >set $next=next_interval ($next)
   >set $cnt=$cnt+1
   >end
   ^CQuit
   (gdb) p $cnt
   $18 = 46189


Here is `*i`

   $12 = {
   total_length = 92,
   position = 67,
   left = 0x55557a555e28,
   right = 0x55557a5557b0,
   up = {
   interval = 0x55557a5555f0,
   obj = XIL(0x55557a5555f0)
   },
   up_obj = false,
   gcmarkbit = false,
   write_protect = false,
   visible = false,
   front_sticky = false,
   rear_sticky = false,
   plist = XIL(0x55557bf43773)
   }

Sounds like broken interval tree to me.

Also here is possible useful print that AI suggested to me:

frame 0
info registers
x/20i $pc - 40

#0  0x0000555555938bac in Fnext_single_property_change (position=make_fixnum(0), prop=XIL(0x72f0), object=XIL(0x55557b3a14e4), limit=make_fixnum(206)) at textprop.c:1050
/usr/local/src/emacs/git/WTs/master_5/src/textprop.c:1050:31513:beg:0x555555938bac
rax            0x1                 1
rbx            0x55557a555b40      93825612995392
rcx            0x72f0              29424
rdx            0x0                 0
rsi            0x0                 0
rdi            0x0                 0
rbp            0x7fffffff3290      0x7fffffff3290
rsp            0x7fffffff3240      0x7fffffff3240
r8             0x7fffffff5ea0      140737488314016
r9             0x5555751ff628      93825525610024
r10            0x5555751ff628      93825525610024
r11            0x7fffffff66a8      140737488316072
r12            0x42                66
r13            0x0                 0
r14            0x555555aa2178      93824997794168
r15            0x7ffff7ffd000      140737354125312
rip            0x555555938bac      0x555555938bac <Fnext_single_property_change+429>
eflags         0x10246             [ PF ZF IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0
fs_base        0x7ffff27771c0      140737261302208
gs_base        0x0                 0
   0x555555938b84 <Fnext_single_property_change+389>:	(bad) 0x48(%rsp,%rdx,2)
   0x555555938b88 <Fnext_single_property_change+393>:	mov    -0x40(%rbp),%edx
   0x555555938b8b <Fnext_single_property_change+396>:	mov    0x30(%rbx),%rax
   0x555555938b8f <Fnext_single_property_change+400>:	mov    %rdx,%rsi
   0x555555938b92 <Fnext_single_property_change+403>:	mov    %rax,%rdi
   0x555555938b95 <Fnext_single_property_change+406>:	call   0x5555559329d3 <textget>
   0x555555938b9a <Fnext_single_property_change+411>:	mov    %rax,%rdx
   0x555555938b9d <Fnext_single_property_change+414>:	mov    -0x28(%rbp),%rax
   0x555555938ba1 <Fnext_single_property_change+418>:	mov    %rdx,%rsi
   0x555555938ba4 <Fnext_single_property_change+421>:	mov    %rax,%rdi
   0x555555938ba7 <Fnext_single_property_change+424>:	call   0x555555935622 <EQ>
=> 0x555555938bac <Fnext_single_property_change+429>:	test   %al,%al
   0x555555938bae <Fnext_single_property_change+431>:	je     0x555555938bdb <Fnext_single_property_change+476>
   0x555555938bb0 <Fnext_single_property_change+433>:	mov    -0x50(%rbp),%rax
   0x555555938bb4 <Fnext_single_property_change+437>:	mov    %rax,%r12
   0x555555938bb7 <Fnext_single_property_change+440>:	mov    $0x0,%edi
   0x555555938bbc <Fnext_single_property_change+445>:	call   0x5555559354eb <builtin_lisp_symbol>
   0x555555938bc1 <Fnext_single_property_change+450>:	cmp    %rax,%r12
   0x555555938bc4 <Fnext_single_property_change+453>:	je     0x555555938b77 <Fnext_single_property_change+376>
   0x555555938bc6 <Fnext_single_property_change+455>:	mov    0x8(%rbx),%r12


Cheers,

/ndrei