bug#52141: 29.0.50; Crash during redisplay

[Eli Zaretskii]

> Date: Sat, 27 Nov 2021 19:03:06 +0800
> From:  Po Lu via "Bug reports for GNU Emacs,
>  the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
> 
> 
> I was typing a random document to test something, and I got the
> following crash out of the blue:
> 
> #0  0x00007f201abbc85c in __pthread_kill_implementation () at /lib64/libc.so.6
> #1  0x00007f201ab6f6b6 in raise () at /lib64/libc.so.6
> #2  0x000000000041b6aa in terminate_due_to_signal (sig=sig@entry=11, 
> backtrace_limit=backtrace_limit@entry=40) at emacs.c:443
> #3  0x000000000041bb29 in handle_fatal_signal (sig=sig@entry=11) at 
> sysdep.c:1780
> #4  0x000000000051b9d8 in deliver_thread_signal (sig=sig@entry=11, 
> handler=0x41bb1e <handle_fatal_signal>) at sysdep.c:1772
> #5  0x000000000051ba49 in deliver_fatal_thread_signal (sig=11) at 
> sysdep.c:1792
> #6  handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>) at 
> sysdep.c:1885
> #7  0x00007f201ab6f760 in <signal handler called> () at /lib64/libc.so.6
> #8  0x000000000055c6b1 in make_lisp_ptr (type=<optimized out>, ptr=<optimized 
> out>)
>     at /home/oldosfan/emacs-dev/emacs-gc/src/lisp.h:1269
> #9  set_next_vectorPython Exception <class 'gdb.MemoryError'>: Cannot access 
> memory at address 0xfe94cc8
>  (p=#10 setup_on_free_list (nbytes=<optimized out>, v=0x2ce6c10) at 
> alloc.c:2977
> #11 sweep_vectors () at alloc.c:3242
> #12 0x0000000000561328 in gc_sweep () at alloc.c:7255
> #13 garbage_collect () at alloc.c:6190
> #14 0x0000000000561811 in maybe_garbage_collect () at alloc.c:6053
> #15 0x00000000005804ad in maybe_gc () at 
> /home/oldosfan/emacs-dev/emacs-gc/src/lisp.h:5161
> #16 eval_sub (form=0x1e753d3) at eval.c:2449
> #17 0x0000000000582149 in Feval (form=0x1e753d3, lexical=<optimized out>) at 
> eval.c:2372
                                   ^^^^
What is this form we are evaluating here?  Can you show its contents?
(Not that I think it is related to the crash.)

Basically, GC was triggered by that evaluation, and it found some bad
memory in some vector that it wanted to put on the free list.  The
challenge is to determine which Lisp vector caused that bad memory.
Try looking at the data in frames 10 and 9 to figure out what was that
bad vector.