Sorry for the spamming of the logs, this time collected with debugging
information and the trace of gdb commands so you can see what's going on.
Basically the for (; 0 < num; num--, tail = XCDR (tail)) ends with a NULL
value.

On Tue, 11 May 2021 at 09:23, Alex Bennée <alex.bennee@linaro.org> wrote:

> I tried noodling around in rr to get some more details but I'm a bit lost
> with how the C code iterates through the objects. It certainly looks like
> Fnthcdr just ends up with an empty value.
>
> Log attached:
>
>
>
> On Tue, 11 May 2021 at 07:51, Alex Bennée <alex.bennee@linaro.org> wrote:
>
>> I can now recreate at will with a magit sequence (l o hackbox/ TAB) which
>> triggers a minibuffer re-size to accommodate the list of git branches:
>>
>> (gdb) info frame 0
>> Stack frame at 0x7fffffffb2e0:
>>  rip = 0x5555556a80ef in Factive_minibuffer_window (minibuf.c:230); saved
>> rip = 0x5555556f52ab
>>  called by frame at 0x7fffffffb340
>>  source language c.
>>  Arglist at 0x7fffffffb2c8, args:
>>  Locals at 0x7fffffffb2c8, Previous frame's sp is 0x7fffffffb2e0
>>  Saved registers:
>>   rip at 0x7fffffffb2d8
>> (gdb) x/5i $pc
>> => 0x5555556a80ef <Factive_minibuffer_window+79>:       mov
>>  -0x3(%rax),%r10
>>    0x5555556a80f3 <Factive_minibuffer_window+83>:       lea
>>  -0x3(%rdx),%eax
>>    0x5555556a80f6 <Factive_minibuffer_window+86>:       test   $0x7,%al
>>    0x5555556a80f8 <Factive_minibuffer_window+88>:       jne
>>  0x5555556a8153 <Factive_minibuffer_window+179>
>>    0x5555556a80fa <Factive_minibuffer_window+90>:       nopw
>> 0x0(%rax,%rax,1)
>> (gdb) p/x $rax
>> $4 = 0x0
>> (gdb) p/x $r10
>> $5 = 0x7fffeece9c6d
>> (gdb) l
>> 225       Lisp_Object innermost_MB;
>> 226
>> 227       if (!minibuf_level)
>> 228         return Qnil;
>> 229
>> 230       innermost_MB = nth_minibuffer (minibuf_level);
>> 231       FOR_EACH_FRAME (frames, frame)
>> 232         {
>> 233           f = XFRAME (frame);
>> 234           if (FRAME_LIVE_P (f)
>> (gdb) p minibuf_level
>> $6 = 2
>> (gdb) p Vminibuffer_list
>> $7 = (Lisp_Object) 0x555555c9aca3
>> (gdb) p $*
>> A syntax error in expression, near `'.
>> (gdb) p *$
>> $8 = <incomplete type>
>> (gdb)
>>
>> Let me know if you want something else.
>>
>> On Tue, 11 May 2021 at 03:24, Eli Zaretskii <eliz@gnu.org> wrote:
>>
>>> > From: Alex Bennée <alex.bennee@linaro.org>
>>> > Date: Mon, 10 May 2021 20:30:58 +0100
>>> > Cc: Alan Mackenzie <acm@muc.de>
>>> >
>>> > It seems my mail client left this in the sent folder but never
>>> actually sent it:
>>> >
>>> >   I haven't been able to find a reproduction as the bug hits fairly
>>> >   randomly hence I'm running in my normal init.el heavy environment.
>>> >   That said there shouldn't be anything in lisp that could cause a
>>> >   segfault in the core C code.
>>> >
>>> >   This only started happening this week after a recent update from
>>> >   master (I update every Monday). The only change I could see that
>>> might
>>> >   be related was f608b4b93 (Prevent the selected window being a dead
>>> >   mini-window when switching frames).
>>> >
>>> >   Unfortunately no symbols. However both core dumps so far have seen
>>> the
>>> >   same null XCAR being called from nth_minibuffer:
>>> >
>>> >   #0  0x00007f4384f585cb in raise (sig=sig@entry=11) at
>>> ../sysdeps/unix/sysv/linux/raise.c:50
>>> >           set = {__val = {18446744067266837247, 0 <repeats 15 times>}}
>>> >           pid = <optimized out>
>>> >           tid = <optimized out>
>>> >   #1  0x000055b6738bf530 in terminate_due_to_signal (sig=sig@entry=11,
>>> > backtrace_limit=backtrace_limit@entry=40) at emacs.c:437
>>> >   #2  0x000055b6738bf97d in handle_fatal_signal (sig=sig@entry=11) at
>>> sysdep.c:1762
>>> >   #3  0x000055b6739b8ca8 in deliver_thread_signal (sig=sig@entry=11,
>>> handler=0x55b6738bf972
>>> > <handle_fatal_signal>) at sysdep.c:1754
>>> >   #4  0x000055b6739b8d29 in deliver_fatal_thread_signal (sig=11) at
>>> sysdep.c:1867
>>> >           fatal = <optimized out>
>>> >   #5  0x000055b6739b8d29 in handle_sigsegv (sig=11, siginfo=<optimized
>>> out>, arg=<optimized out>) at
>>> > sysdep.c:1867
>>> >           fatal = <optimized out>
>>> >   #6  0x00007f4384f58730 in <signal handler called> () at
>>> /lib/x86_64-linux-gnu/libpthread.so.0
>>> >   #7  0x000055b6739ce0ef in XCAR (c=0x0) at lisp.h:1420
>>> >           tail = 0x0
>>> >           frames = <optimized out>
>>> >           frame = <optimized out>
>>> >           f = <optimized out>
>>> >           innermost_MB = <optimized out>
>>> >   #8  0x000055b6739ce0ef in nth_minibuffer (depth=<optimized out>) at
>>> minibuf.c:972
>>> >           tail = 0x0
>>> >           frames = <optimized out>
>>> >           frame = <optimized out>
>>> >           f = <optimized out>
>>> >           innermost_MB = <optimized out>
>>>
>>> Please show the Lisp value of Vminibuffer_list.
>>>
>>
>>
>> --
>> Alex Bennée
>> KVM/QEMU Hacker for Linaro
>>
>
>
> --
> Alex Bennée
> KVM/QEMU Hacker for Linaro
>


-- 
Alex Bennée
KVM/QEMU Hacker for Linaro