I can now recreate at will with a magit sequence (l o hackbox/ TAB) which
triggers a minibuffer re-size to accommodate the list of git branches:

(gdb) info frame 0
Stack frame at 0x7fffffffb2e0:
 rip = 0x5555556a80ef in Factive_minibuffer_window (minibuf.c:230); saved
rip = 0x5555556f52ab
 called by frame at 0x7fffffffb340
 source language c.
 Arglist at 0x7fffffffb2c8, args:
 Locals at 0x7fffffffb2c8, Previous frame's sp is 0x7fffffffb2e0
 Saved registers:
  rip at 0x7fffffffb2d8
(gdb) x/5i $pc
=> 0x5555556a80ef <Factive_minibuffer_window+79>:       mov
 -0x3(%rax),%r10
   0x5555556a80f3 <Factive_minibuffer_window+83>:       lea
 -0x3(%rdx),%eax
   0x5555556a80f6 <Factive_minibuffer_window+86>:       test   $0x7,%al
   0x5555556a80f8 <Factive_minibuffer_window+88>:       jne
 0x5555556a8153 <Factive_minibuffer_window+179>
   0x5555556a80fa <Factive_minibuffer_window+90>:       nopw
0x0(%rax,%rax,1)
(gdb) p/x $rax
$4 = 0x0
(gdb) p/x $r10
$5 = 0x7fffeece9c6d
(gdb) l
225       Lisp_Object innermost_MB;
226
227       if (!minibuf_level)
228         return Qnil;
229
230       innermost_MB = nth_minibuffer (minibuf_level);
231       FOR_EACH_FRAME (frames, frame)
232         {
233           f = XFRAME (frame);
234           if (FRAME_LIVE_P (f)
(gdb) p minibuf_level
$6 = 2
(gdb) p Vminibuffer_list
$7 = (Lisp_Object) 0x555555c9aca3
(gdb) p $*
A syntax error in expression, near `'.
(gdb) p *$
$8 = <incomplete type>
(gdb)

Let me know if you want something else.

On Tue, 11 May 2021 at 03:24, Eli Zaretskii <eliz@gnu.org> wrote:

> > From: Alex Bennée <alex.bennee@linaro.org>
> > Date: Mon, 10 May 2021 20:30:58 +0100
> > Cc: Alan Mackenzie <acm@muc.de>
> >
> > It seems my mail client left this in the sent folder but never actually
> sent it:
> >
> >   I haven't been able to find a reproduction as the bug hits fairly
> >   randomly hence I'm running in my normal init.el heavy environment.
> >   That said there shouldn't be anything in lisp that could cause a
> >   segfault in the core C code.
> >
> >   This only started happening this week after a recent update from
> >   master (I update every Monday). The only change I could see that might
> >   be related was f608b4b93 (Prevent the selected window being a dead
> >   mini-window when switching frames).
> >
> >   Unfortunately no symbols. However both core dumps so far have seen the
> >   same null XCAR being called from nth_minibuffer:
> >
> >   #0  0x00007f4384f585cb in raise (sig=sig@entry=11) at
> ../sysdeps/unix/sysv/linux/raise.c:50
> >           set = {__val = {18446744067266837247, 0 <repeats 15 times>}}
> >           pid = <optimized out>
> >           tid = <optimized out>
> >   #1  0x000055b6738bf530 in terminate_due_to_signal (sig=sig@entry=11,
> > backtrace_limit=backtrace_limit@entry=40) at emacs.c:437
> >   #2  0x000055b6738bf97d in handle_fatal_signal (sig=sig@entry=11) at
> sysdep.c:1762
> >   #3  0x000055b6739b8ca8 in deliver_thread_signal (sig=sig@entry=11,
> handler=0x55b6738bf972
> > <handle_fatal_signal>) at sysdep.c:1754
> >   #4  0x000055b6739b8d29 in deliver_fatal_thread_signal (sig=11) at
> sysdep.c:1867
> >           fatal = <optimized out>
> >   #5  0x000055b6739b8d29 in handle_sigsegv (sig=11, siginfo=<optimized
> out>, arg=<optimized out>) at
> > sysdep.c:1867
> >           fatal = <optimized out>
> >   #6  0x00007f4384f58730 in <signal handler called> () at
> /lib/x86_64-linux-gnu/libpthread.so.0
> >   #7  0x000055b6739ce0ef in XCAR (c=0x0) at lisp.h:1420
> >           tail = 0x0
> >           frames = <optimized out>
> >           frame = <optimized out>
> >           f = <optimized out>
> >           innermost_MB = <optimized out>
> >   #8  0x000055b6739ce0ef in nth_minibuffer (depth=<optimized out>) at
> minibuf.c:972
> >           tail = 0x0
> >           frames = <optimized out>
> >           frame = <optimized out>
> >           f = <optimized out>
> >           innermost_MB = <optimized out>
>
> Please show the Lisp value of Vminibuffer_list.
>


-- 
Alex Bennée
KVM/QEMU Hacker for Linaro