bug#17496: frequent crashing on cygwin

[aidalgol]

With 24.3.1 on Cygwin x64 built with NT widgets, I am getting frequent 
crashes, at least once a day.  I get the "Emacs Abort Dialog" asking me 
whether I want to attach GDB.  I rebuilt Emacs from trunk, and the 
problem persisted.  Here is the stack trace after upon attaching (built 
from git commit 5289c43e35275b153cd8003f037e67f24bf22d38):

(gdb) where
#0  0x000007fefe193ca3 in KERNELBASE!DebugBreak () from 
/cygdrive/c/Windows/system32/KERNELBASE.dll
#1  0x000000010056ec14 in emacs_abort () at w32fns.c:8504
#2  0x0000000100502549 in do_symval_forwarding (valcontents=<optimized 
out>) at data.c:970
#3  0x0000000100502611 in swap_in_symval_forwarding (symbol=0x1009c3240 
<bss_sbrk_buffer+502944>, blv=blv@entry=0x600105540) at data.c:1102
#4  0x0000000100502c76 in find_symbol_value (symbol=<optimized out>) at 
data.c:1150
#5  0x0000000100502cbd in Fsymbol_value (symbol=4305203778) at 
data.c:1168
#6  0x00000001004c65b8 in set_buffer_internal_1 (b=b@entry=0x60075a800) 
at buffer.c:2153
#7  0x00000001004c6638 in set_buffer_internal (b=0x60075a800) at 
buffer.h:1102
#8  Fset_buffer (buffer_or_name=25777514501) at buffer.c:2199
#9  0x000000010054b1b0 in exec_byte_code (bytestr=6, vector=0, 
maxdepth=0, args_template=1028, nargs=33, args=0x71) at bytecode.c:1644
#10 0x0000000100514e38 in funcall_lambda (fun=25893691285, 
nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x227348) at 
eval.c:2983
#11 0x000000010051513b in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x227340) at eval.c:2876
#12 0x000000010051548d in call1 (fn=fn@entry=25893691285, 
arg1=<optimized out>) at eval.c:2614
#13 0x000000010051c26d in mapcar1 (leni=leni@entry=48, 
vals=vals@entry=0x2273f0, fn=fn@entry=25893691285, 
seq=seq@entry=25792947446) at fns.c:2333
#14 0x000000010051c74a in Fmapcar (function=25893691285, 
sequence=25792947446) at fns.c:2403
#15 0x000000010051532a in Ffuncall (nargs=<optimized out>, 
args=<optimized out>) at eval.c:2818
#16 0x000000010054936b in exec_byte_code (bytestr=6, vector=0, 
maxdepth=0, args_template=2052, nargs=2258560, args=0x3) at 
bytecode.c:916
#17 0x0000000100514e38 in funcall_lambda (fun=25786027141, 
nargs=nargs@entry=2, arg_vector=arg_vector@entry=0x227910) at 
eval.c:2983
#18 0x000000010051513b in Ffuncall (nargs=3, args=0x227908) at 
eval.c:2876
#19 0x000000010054936b in exec_byte_code (bytestr=6, vector=0, 
maxdepth=0, args_template=2048, nargs=2259200, args=0x3) at 
bytecode.c:916
#20 0x0000000100514e38 in funcall_lambda (fun=25786027261, 
nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x227b40) at 
eval.c:2983
#21 0x000000010051513b in Ffuncall (nargs=2, args=0x227b38) at 
eval.c:2876
#22 0x000000010054936b in exec_byte_code (bytestr=6, vector=0, 
maxdepth=0, args_template=4304949298, nargs=4304699432, args=0x2) at 
bytecode.c:916
#23 0x0000000100514da3 in funcall_lambda (fun=25786149861, 
nargs=nargs@entry=0, arg_vector=arg_vector@entry=0x227d70) at 
eval.c:3049
#24 0x000000010051513b in Ffuncall (nargs=1, args=0x227d68) at 
eval.c:2876
#25 0x000000010054936b in exec_byte_code (bytestr=6, vector=0, 
maxdepth=0, args_template=4304949298, nargs=45, args=0x1) at 
bytecode.c:916
#26 0x0000000100514da3 in funcall_lambda (fun=25786150045, 
nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x228118) at 
eval.c:3049
#27 0x000000010051513b in Ffuncall (nargs=2, args=0x228110) at 
eval.c:2876
#28 0x00000001005153d9 in funcall_nil (nargs=<optimized out>, 
args=<optimized out>) at eval.c:2366
#29 0x0000000100513c2b in run_hook_with_args (nargs=2, args=0x228110, 
funcall=0x1005153d0 <funcall_nil>) at eval.c:2551
#30 0x0000000100515215 in Ffuncall (nargs=<optimized out>, 
args=<optimized out>) at eval.c:2796
#31 0x000000010054936b in exec_byte_code (bytestr=6, vector=0, 
maxdepth=0, args_template=4304949298, nargs=49, args=0x3) at 
bytecode.c:916
#32 0x0000000100514da3 in funcall_lambda (fun=25785697053, 
nargs=nargs@entry=2, arg_vector=arg_vector@entry=0x228350) at 
eval.c:3049
#33 0x000000010051513b in Ffuncall (nargs=3, args=0x228348) at 
eval.c:2876
#34 0x000000010054936b in exec_byte_code (bytestr=6, vector=0, 
maxdepth=0, args_template=4304949298, nargs=2261824, args=0x3) at 
bytecode.c:916
#35 0x0000000100514da3 in funcall_lambda (fun=25785705525, 
nargs=nargs@entry=2, arg_vector=arg_vector@entry=0x228590) at 
eval.c:3049
#36 0x000000010051513b in Ffuncall (nargs=3, args=0x228588) at 
eval.c:2876
#37 0x000000010054936b in exec_byte_code (bytestr=6, vector=0, 
maxdepth=0, args_template=4304949298, nargs=2262408, args=0x3) at 
bytecode.c:916
#38 0x0000000100514da3 in funcall_lambda (fun=25785763853, 
nargs=nargs@entry=2, arg_vector=arg_vector@entry=0x2287f0) at 
eval.c:3049
#39 0x000000010051513b in Ffuncall (nargs=3, args=0x2287e8) at 
eval.c:2876
#40 0x000000010054936b in exec_byte_code (bytestr=6, vector=0, 
maxdepth=0, args_template=4304949298, nargs=74, args=0x3) at 
bytecode.c:916
#41 0x0000000100514da3 in funcall_lambda (fun=25786079517, 
nargs=nargs@entry=2, arg_vector=arg_vector@entry=0x228a18) at 
eval.c:3049
#42 0x000000010051513b in Ffuncall (nargs=nargs@entry=3, 
args=args@entry=0x228a10) at eval.c:2876
#43 0x00000001005165e0 in Fapply (nargs=nargs@entry=2, 
args=args@entry=0x228ad0) at eval.c:2354
#44 0x00000001005167e3 in apply1 (fn=25786223762, arg=<optimized out>) 
at eval.c:2588
#45 0x00000001005138a7 in internal_condition_case_1 
(bfun=bfun@entry=0x10054d150 <read_process_output_call>, 
arg=25793585046, handlers=handlers@entry=4305007218, 
hfun=hfun@entry=0x10054d0b0 <read_process_output_error_handler>)
    at eval.c:1378
#46 0x000000010054cc81 in read_and_dispose_of_process_output 
(coding=<optimized out>, nbytes=61, chars=<optimized out>, 
p=0xfffffffffffffffe) at process.c:5178
#47 read_process_output (proc=proc@entry=25785763581, 
channel=channel@entry=9) at process.c:5087
#48 0x000000010055309c in wait_reading_process_output 
(time_limit=time_limit@entry=0, nsecs=nsecs@entry=0, 
read_kbd=read_kbd@entry=-1, do_display=true, 
wait_for_cell=wait_for_cell@entry=4304949298, 
wait_proc=wait_proc@entry=0x0,
    just_wait_proc=just_wait_proc@entry=0) at process.c:4809
#49 0x00000001004ac00a in kbd_buffer_get_event (end_time=0x0, 
used_mouse_menu=<optimized out>, kbp=<synthetic pointer>) at 
keyboard.c:3907
#50 read_event_from_main_queue (used_mouse_menu=<optimized out>, 
local_getcjmp=<optimized out>, end_time=0x0) at keyboard.c:2246
#51 read_decoded_event_from_main_queue (end_time=end_time@entry=0x0, 
local_getcjmp=local_getcjmp@entry=0x22a290, 
prev_event=prev_event@entry=4304949298, 
used_mouse_menu=used_mouse_menu@entry=0x22a5cb) at keyboard.c:2311
#52 0x00000001004b031f in read_char (commandflag=1, 
map=map@entry=25788761718, prev_event=4304949298, 
used_mouse_menu=used_mouse_menu@entry=0x22a5cb, 
end_time=end_time@entry=0x0) at keyboard.c:2897
#53 0x00000001004b126a in read_key_sequence 
(keybuf=keybuf@entry=0x22a710, prompt=<optimized out>, 
dont_downcase_last=dont_downcase_last@entry=false, 
can_return_switch_frame=can_return_switch_frame@entry=true,
    fix_current_buffer=fix_current_buffer@entry=true, 
prevent_redisplay=prevent_redisplay@entry=false, bufsize=30) at 
keyboard.c:9084
#54 0x00000001004b2ff4 in command_loop_1 () at keyboard.c:1452
#55 0x000000010051376d in internal_condition_case 
(bfun=bfun@entry=0x1004b2dd0 <command_loop_1>, handlers=<optimized out>, 
hfun=hfun@entry=0x1004a98e0 <cmd_error>) at eval.c:1354
#56 0x00000001004a4d6a in command_loop_2 
(ignore=ignore@entry=4304949298) at keyboard.c:1177
#57 0x000000010051366c in internal_catch (tag=4305003410, 
func=func@entry=0x1004a4d40 <command_loop_2>, arg=4304949298) at 
eval.c:1118
#58 0x00000001004a94d4 in command_loop () at keyboard.c:1156
#59 recursive_edit_1 () at keyboard.c:777
#60 0x00000001004a97f6 in Frecursive_edit () at keyboard.c:848
#61 0x00000001005a819e in main (argc=<optimized out>, argv=<optimized 
out>) at emacs.c:1654

Lisp Backtrace:
0x7625f90 PVEC_COMPILED
"mapcar" (0x2276a0)
"erc-buffer-filter" (0x227910)
"erc-buffer-list" (0x227b40)
"erc-autoaway-some-open-server-buffer" (0x227d70)
"erc-autoaway-possibly-set-away" (0x228118)
"run-hook-with-args" (0x228110)
"erc-call-hooks" (0x228350)
"erc-handle-parsed-server-response" (0x228590)
"erc-parse-server-response" (0x2287f0)
"erc-server-filter-function" (0x228a18)


And the symbol in frame 5:

(gdb) print 4305203778
$4 = 4305203778
(gdb) xsymbol
$5 = (struct Lisp_Symbol *) 0x1009c3240 <bss_sbrk_buffer+502944>
"change-major-mode-hook"
(gdb) print *$5
$6 = {
  gcmarkbit = false,
  redirect = SYMBOL_LOCALIZED,
  constant = 0,
  interned = 2,
  declared_special = true,
  pinned = true,
  name = 4300989913,
  val = {
    value = 25770874176,
    alias = 0x600105540,
    blv = 0x600105540,
    fwd = 0x600105540
  },
  function = 4304949298,
  plist = 4312576086,
  next = 0x100999550 <bss_sbrk_buffer+331696>
}


And 0x600105540 in frame 2:

(gdb) print (struct Lisp_Buffer_Local_Value*) 0x600105540
$11 = (struct Lisp_Buffer_Local_Value *) 0x600105540
(gdb) print *$11
$12 = {
  local_if_set = false,
  frame_local = false,
  found = true,
  fwd = 0x10092b8d0 <o_fwd.75565>,
  where = 25785328645,
  defcell = 4312854374,
  valcell = 25787765030
}
(gdb) print $12->fwd
$14 = (union Lisp_Fwd *) 0x10092b8d0 <o_fwd.75565>
(gdb) print *$14
$15 = {
  u_intfwd = {
    type = Lisp_Fwd_Obj,
    intvar = 0x1009471d8 <globals+184>
  },
  u_boolfwd = {
    type = Lisp_Fwd_Obj,
    boolvar = 0x1009471d8 <globals+184>
  },
  u_objfwd = {
    type = Lisp_Fwd_Obj,
    objvar = 0x1009471d8 <globals+184>
  },
  u_buffer_objfwd = {
    type = Lisp_Fwd_Obj,
    offset = 0,
    predicate = 4304695768
  },
  u_kboard_objfwd = {
    type = Lisp_Fwd_Obj,
    offset = 0
  }
}

At Daniel Colascione's suggestion, I will rebuild with optimisations 
turned off and try to get more information out of the next crash.