bug#74747: 30.0.92; scratch/igc: crashes when executing M-x list-packages

[Pip Cet via "Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>]

"Gregor Zattler via \"Bug reports for GNU Emacs, the Swiss army knife of text editors\"" <bug-gnu-emacs@gnu.org> writes:

> Dear Emacs-developers, Gerd,
>
> Emacs from scratch/igc started with -Q
> crashes when I do M-X list-packages.  I
> produced some gdb output, see below.

> I wondered, if such random bug reports
> are of interest for scratch/igc at all
> (if not, please drop this bug report,
> it's in no way crucial to me) and if it
> is appropriate to post them to the bug
> tracker.  I think it would be helpful if
> README-IGC would answer this two
> questions.

That's an excellent suggestion, I think we'll update it to make clearer
that bug reports such as this one are appreciated and that they should
go to the ordinary Emacs bug list.

> I'm happy to answer very specifically
> specified questions.

Is this reproducible, or did it just happen once?

> Regards, gregor
>
>
> Starting program: /home/grfz/src/emacs-igc/src/emacs --debug-init -Q -xrm --init-directory="${USER_EMACS_DIRECTORY}" --fg-daemon="${EMACS_SERVER_NAME}"
> [Thread debugging using libthread_db enabled]
> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
> [Detaching after vfork from child process 823489]
> [Detaching after vfork from child process 823490]
> [Detaching after vfork from child process 823491]
>
> Breakpoint 1, terminate_due_to_signal (sig=sig@entry=6, backtrace_limit=backtrace_limit@entry=2147483647) at ./src/emacs.c:432
> 432	{
> #0  terminate_due_to_signal (sig=sig@entry=6, backtrace_limit=backtrace_limit@entry=2147483647) at ./src/emacs.c:432
> #1  0x00005555557d7c44 in set_state (state=state@entry=IGC_STATE_DEAD) at ./src/igc.c:858
> #2  0x00005555557d7c78 in igc_assert_fail (file=file@entry=0x555555902930 "igc.c", line=line@entry=586, msg=msg@entry=0x5555559022d0 "header_type (h) == IGC_OBJ_PAD || nbytes >= sizeof (struct igc_fwd)") at ./src/igc.c:209
> #3  0x00005555557d8413 in obj_size (h=h@entry=0x555555f991a0 <main_thread>) at ./src/igc.c:586
> #4  0x00005555557d843d in igc_check_fwd (client=client@entry=0x555555f991a0 <main_thread>, is_vector=is_vector@entry=true) at ./src/igc.c:729

So we're crashing in obj_size on the main_thread object's MPS header,
which should have been set by the gc_init_header call in
syms_of_threads, but I suspect it was zeroed out at the time the dump
was produced.

If you still have the gdb session, can you "p main_thread" and reproduce
the output here?  I suspect that something has overwritten the
main_thread MPS header, but I don't understand how that could have
happened.

Thanks!

Pip