bug#56527: 28.1; Crash on macOS with magit

[Eli Zaretskii <eliz@gnu.org>]

> From: Jonathan Mitchell <mitchell.jkyle@gmail.com>
> Date: Wed, 13 Jul 2022 17:16:21 -0500
> Cc: 56527@debbugs.gnu.org
> 
> I built a debug version of emacs-28 with this configuration:
> `configure --enable-checking=all --enable-check-lisp-object-type
>  'CFLAGS=-O0 -g3' --without-png --without-rsvg`.
> 
> I was in magit repeatedly pressing the "l" key (bound to magit-log in
> magit-log-mode-map) when it crashed this time. The LLDB trace is
> below.
> 
> (lldb) target create "./emacs"
> Current executable set to '/Users/kyle/emacs/src/emacs' (arm64).
> (lldb) run
> Process 77095 launched: '/Users/kyle/emacs/src/emacs' (arm64)
> 
> alloc.c:3139: Emacs fatal error: assertion failed: ! PSEUDOVEC_STRUCT
> (vector, Lisp_Marker)->buffer
> Process 77095 stopped
> * thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
>     frame #0: 0x00000001bdae6d98 libsystem_kernel.dylib`__pthread_kill + 8
> libsystem_kernel.dylib`__pthread_kill:
> ->  0x1bdae6d98 <+8>:  b.lo   0x1bdae6db8               ; <+40>
>     0x1bdae6d9c <+12>: pacibsp
>     0x1bdae6da0 <+16>: stp    x29, x30, [sp, #-0x10]!
>     0x1bdae6da4 <+20>: mov    x29, sp
> Target 0: (emacs) stopped.
> (lldb) xbacktrace
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (unsigned char *) data = <parent failed to evaluate: parent failed to
> evaluate: parent is NULL>
> (lldb) bt
> * thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
>   * frame #0: 0x00000001bdae6d98 libsystem_kernel.dylib`__pthread_kill + 8
>     frame #1: 0x00000001bdb1bee0 libsystem_pthread.dylib`pthread_kill + 288
>     frame #2: 0x00000001bda1e680 libsystem_c.dylib`raise + 32
>     frame #3: 0x0000000100478d70 emacs`terminate_due_to_signal(sig=6,
> backtrace_limit=40) at emacs.c:437:3
>     frame #4: 0x00000001004791f4 emacs`emacs_abort at sysdep.c:2282:3
>     frame #5: 0x0000000100405488 emacs`ns_term_shutdown(sig=6) at
> nsterm.m:5367:7
>     frame #6: 0x00000001001a0788 emacs`shut_down_emacs(sig=6, stuff=->
> ) at emacs.c:2796:3
>     frame #7: 0x0000000100478cf8 emacs`terminate_due_to_signal(sig=6,
> backtrace_limit=2147483647) at emacs.c:420:11
>     frame #8: 0x00000001004796b8 emacs`die(msg="! PSEUDOVEC_STRUCT
> (vector, Lisp_Marker)->buffer", file="alloc.c", line=3139) at
> alloc.c:7481:3
>     frame #9: 0x0000000100289520
> emacs`cleanup_vector(vector=0x0000000102931240) at alloc.c:3139:7
>     frame #10: 0x0000000100288c50 emacs`sweep_vectors at alloc.c:3218:5
>     frame #11: 0x0000000100281278 emacs`gc_sweep at alloc.c:7245:3
>     frame #12: 0x000000010027f8c8 emacs`garbage_collect at alloc.c:6178:3
>     frame #13: 0x000000010027f170 emacs`maybe_garbage_collect at alloc.c:6045:5
>     frame #14: 0x00000001002d5c9c emacs`maybe_gc at lisp.h:5142:5

This is not a crash, it's an abort inside GC, so it seems like a
different problem.  Of course, it could be that this abort in a debug
build caught the reason for the crash in your original build.

Anyway, the next step is to establish what is this bad object that
causes the abort:

>     frame #8: 0x00000001004796b8 emacs`die(msg="! PSEUDOVEC_STRUCT
> (vector, Lisp_Marker)->buffer", file="alloc.c", line=3139) at
> alloc.c:7481:3
>     frame #9: 0x0000000100289520
> emacs`cleanup_vector(vector=0x0000000102931240) at alloc.c:3139:7

That 'vector' -- what is it and where did it come from?  Can you
examine its components and show their contents?

Thanks.