Hi Eli,

I succeeded in getting more details by gdb ‘pp’ command.
`format’ call, leads to lisp_string_width crash, seems `tramp-password-prompt-regexp'.

Please look at the attached log and screenshot:
  emacs_crash-lisp_string_width-gdb_bt_full-with-pp.txt.bz2
  emacs_crash-lisp_string_width-gdb_bt_full-with-pp.png

It seems that this segfault depends on some delicate matter of
startup initialization timing.

This crash couldn’t be reproduced with full ${top_builddir}/src/.gdbinit settings,
so I copied ‘pp’ command definition to ${top_builddir}/.gdbinit then invoked
'gdb ${top_builddir}/src/emacs' like this:

```
[naofumi@hyperion emacs (master)]% pwd
/Users/naofumi/_git/git.sv.gnu.org/emacs
[naofumi@hyperion emacs (master)]% 
[naofumi@hyperion emacs (master)]% cat ./.gdbinit
# Print out s-expressions
define pp
  set $tmp = $arg0
  set $output_debug = print_output_debug_flag
  set print_output_debug_flag = 0
  call safe_debug_print ($tmp)
  set print_output_debug_flag = $output_debug
end
document pp
Print the argument as an emacs s-expression
Works only when an inferior emacs is executing.
end
[naofumi@hyperion emacs (master)]% 
[naofumi@hyperion emacs (master)]% 
[naofumi@hyperion emacs (master)]% gdb ./src/emacs
GNU gdb (GDB) 10.2
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin20.3.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./src/emacs...
(gdb) r
Starting program: /Users/naofumi/_git/git.sv.gnu.org/emacs/src/emacs 
[New Thread 0x1a03 of process 82588]
[New Thread 0x2303 of process 82588]
warning: unhandled dyld version (17)
[New Thread 0x1c03 of process 82588]
[New Thread 0x2003 of process 82588]
[New Thread 0x2103 of process 82588]
[New Thread 0x2203 of process 82588]
[New Thread 0x2407 of process 82588]
[New Thread 0x1a17 of process 82588]
[New Thread 0x1d13 of process 82588]

Thread 2 received signal SIGSEGV, Segmentation fault.
0x000000010028e955 in SYMBOL_NAME (sym=0x1700000018) at ./lisp.h:2208
2208	  return XSYMBOL (sym)->u.s.name;
(gdb) bt full
#0  0x000000010028e955 in SYMBOL_NAME (sym=0x1700000018) at ./lisp.h:2208
No locals.
#1  0x000000010028e42d in font_style_to_value (prop=FONT_WEIGHT_INDEX, 
    val=0x1700000018, noerror=true) at font.c:366
        i = 10
        j = 4
        s = 0x50000000c <error: Cannot access memory at address 0x50000000c>
        elt = 0x10433298d
        table = 0x1056f8b5d
        len = 10
```