Fix undefined behavior in mapbacktrace

* src/eval.c (Fmapbacktrace): Don't assume that PDL is still valid.

diff --git a/src/eval.c b/src/eval.c
index ef961046bcfac22735323809ded07f541118c80c..8f293c9d3002aa5f62aa70c4af4072a2ef20ddb9 100644 (file)
--- a/src/eval.c
+++ b/src/eval.c
@@ -3613,8 +3613,12 @@ returns nil.  */)
 
   while (backtrace_p (pdl))
     {
+      ptrdiff_t i = pdl - specpdl;
       backtrace_frame_apply (function, pdl);
-      pdl = backtrace_next (pdl);
+      /* Beware! PDL is no longer valid here because FUNCTION might
+         have caused grow_specpdl to reallocate pdlvec.  We must use
+         the saved index, cf. Bug#27258.  */
+      pdl = backtrace_next (&specpdl[i]);
     }
 
   return Qnil;