bug#47067: 28.0.50; [feature/native-comp] Crash while scrolling through dispnew.c

[Eli Zaretskii <eliz@gnu.org>]

> From: Andrea Corallo <akrl@sdf.org>
> Cc: 47067@debbugs.gnu.org
> Date: Fri, 12 Mar 2021 15:27:30 +0000
> 
> Generally speaking the first step is to identify the function that is
> responsible for the bug, this is often on the top of the back-trace but
> not necessarily.  In the unfortunate case I typically proceed by
> bisection.

In my case the top of the stack looks like this:

  #0  0x01236788 in arithcompare_driver (nargs=2, args=0x28,
      comparison=ARITH_LESS) at data.c:2673
  #1  0x01236860 in Flss (nargs=2, args=0x28) at data.c:2691
  #2  0x0a872285 in ?? ()
  #3  0x01261898 in funcall_lambda (fun=XIL(0xa00000000a0bf230), nargs=5,
      arg_vector=0x826a08) at eval.c:3292
  #4  0x012601ed in Ffuncall (nargs=6, args=0x826a00) at eval.c:3013
  #5  0x0a8e0dbf in ?? ()
  #6  0x012601ed in Ffuncall (nargs=1, args=0x826bd8) at eval.c:3013
  #7  0x0a8ce041 in ?? ()
  #8  0x01261898 in funcall_lambda (fun=XIL(0xa0000000069f2a50), nargs=1,
      arg_vector=0x826db8) at eval.c:3292
  #9  0x012601ed in Ffuncall (nargs=2, args=0x826db0) at eval.c:3013
  #10 0x70895b36 in F632d666f6e742d6c6f636b2d6375742d6f66662d6465636c617261746f7273_c_font_lock_cut_off_declarators_0 ()
     from d:\usr\eli\.emacs.d\eln-cache\28.0.50-7d88f6c1\cc-fonts-d7d8a7f5-b7c359cd.eln
  #11 0x01261898 in funcall_lambda (fun=XIL(0xa0000000079249a0), nargs=1,
      arg_vector=0x827050) at eval.c:3292
  #12 0x012601ed in Ffuncall (nargs=2, args=0x827048) at eval.c:3013

And the corresponding Lisp backtrace:

  "c-beginning-of-statement-1" (0x826a08)
  "c-just-after-func-arglist-p" (0x826be0)
  "c-back-over-member-initializers" (0x826db8)
  "c-font-lock-cut-off-declarators" (0x827050)
  "font-lock-fontify-keywords-region" (0x8273a8)
  "font-lock-default-fontify-region" (0x8276b8)

(Don't ask me why "<", i.e. Flss, doesn't appear in the Lisp
backtrace: something strange happens with backtraces here, as I will
describe in another message.  I think the "??" things in the backtrace
are related.)

How do I go about finding the function that's responsible for the
problem given the above?  The problem is 100% reproducible for me.

> Here the problem is that being not reproducible we are stuck in the
> first steps, reproducibility is tipically a pre for this kind of
> analysis.  But again if it's a miscompilation it *must* be reproducible
> because code is not morphing so probably we are not reproducing it
> precisely?

Here's another reproducer:

  emacs -Q
  C-x C-f src/dispnew.c
  C-s sleep-for

I usually get a SIGSEGV before I even type the whole of "sleep-for".

Do you have all of the cc-*.el files natively-compiled?  I do.