bug#52141: 29.0.50; Crash during redisplay

[Po Lu via "Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>]

Eli Zaretskii <eliz@gnu.org> writes:

>> Date: Sat, 27 Nov 2021 19:03:06 +0800
>> From:  Po Lu via "Bug reports for GNU Emacs,
>>  the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
>> 
>> 
>> I was typing a random document to test something, and I got the
>> following crash out of the blue:
>> 
>> #0  0x00007f201abbc85c in __pthread_kill_implementation () at /lib64/libc.so.6
>> #1  0x00007f201ab6f6b6 in raise () at /lib64/libc.so.6
>> #2  0x000000000041b6aa in terminate_due_to_signal (sig=sig@entry=11, backtrace_limit=backtrace_limit@entry=40) at emacs.c:443
>> #3  0x000000000041bb29 in handle_fatal_signal (sig=sig@entry=11) at sysdep.c:1780
>> #4  0x000000000051b9d8 in deliver_thread_signal (sig=sig@entry=11, handler=0x41bb1e <handle_fatal_signal>) at sysdep.c:1772
>> #5  0x000000000051ba49 in deliver_fatal_thread_signal (sig=11) at sysdep.c:1792
>> #6  handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>) at sysdep.c:1885
>> #7  0x00007f201ab6f760 in <signal handler called> () at /lib64/libc.so.6
>> #8  0x000000000055c6b1 in make_lisp_ptr (type=<optimized out>, ptr=<optimized out>)
>>     at /home/oldosfan/emacs-dev/emacs-gc/src/lisp.h:1269
>> #9  set_next_vectorPython Exception <class 'gdb.MemoryError'>: Cannot access memory at address 0xfe94cc8
>>  (p=#10 setup_on_free_list (nbytes=<optimized out>, v=0x2ce6c10) at alloc.c:2977
>> #11 sweep_vectors () at alloc.c:3242
>> #12 0x0000000000561328 in gc_sweep () at alloc.c:7255
>> #13 garbage_collect () at alloc.c:6190
>> #14 0x0000000000561811 in maybe_garbage_collect () at alloc.c:6053
>> #15 0x00000000005804ad in maybe_gc () at /home/oldosfan/emacs-dev/emacs-gc/src/lisp.h:5161
>> #16 eval_sub (form=0x1e753d3) at eval.c:2449
>> #17 0x0000000000582149 in Feval (form=0x1e753d3, lexical=<optimized out>) at eval.c:2372
>                                    ^^^^
> What is this form we are evaluating here?  Can you show its contents?
> (Not that I think it is related to the crash.)

Its type is Lisp_Cons.  However, its address is invalid.  Running
`xcons' in gdb complains:

(gdb) xcons
$9 = (struct Lisp_Cons *) 0x1e753d0
Cannot access memory at address 0x1e753d0

Thanks.