[luatex] segfault lualatx in math_fraction (), texlive 2016, lualatex 0.95

[Kazuki Maeda]

Hello.

> Here is what I found: I delete the .aux and .toc files, then
> compile using
>          lualatex KERNEL.tex
> first time, ok, next time
>          lualatex KERNEL.tex
> gives seg fault:

I tried on my Gentoo Linux (x86_64) machine with TeX Live 2016,
then the SEGV was reproduced.
The latest LuaTeX 1.0.1 (rev 6160 built with --debug) also caused the SEGV.


(... first time compile ...)
Output written on KERNEL.pdf (915 pages, 4605143 bytes).
Transcript written on KERNEL.log.
[Inferior 1 (process 4713) exited normally]
(gdb) r KERNEL.tex
Starting program: /usr/local/texlive/2016/bin/x86_64-linux/lualatex KERNEL.tex
This is LuaTeX, Version 1.0.1 (TeX Live 2017/dev)
 restricted system commands enabled.
(./KERNEL.tex
...
[372]
Underfull \hbox (badness 10000) in paragraph at lines 25143--25144


Underfull \hbox (badness 10000) in paragraph at lines 25148--25150


Underfull \hbox (badness 10000) in paragraph at lines 25151--25152


Underfull \hbox (badness 10000) in paragraph at lines 25157--25158


Program received signal SIGSEGV, Segmentation fault.
0x000000000050001e in math_fraction () at ../../../source/texk/web2c/luatexdir/tex/texmath.w:1798
1798	        numerator(incompleat_noad_par) = new_node(sub_mlist_node, 0);
(gdb) l
1793	        if ((c % delimited_code) == above_code)
1794	            scan_normal_dimen();
1795	        tex_error("Ambiguous; you need another { and }", hlp);
1796	    } else {
1797	        incompleat_noad_par = new_node(fraction_noad, 0);
1798	        numerator(incompleat_noad_par) = new_node(sub_mlist_node, 0);
1799	        math_list(numerator(incompleat_noad_par)) = vlink(head);
1800	        vlink(head) = null;
1801	        tail = head;
1802	        m_style = cramped_style(m_style);


I could not understand why the code above caused SEGV.


Best regards
Kazuki Maeda