bug#39962: 27.0.90; Crash in Emacs 27.0.90

[Pip Cet <pipcet@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 305 bytes --]

> > Fine, so you are saying that stack marking should disregard whether a
> > buffer is "live"?  Then let's make such a change only for stack
> > marking, not in a function called from other places.
>
> I agree. I'll prepare a patch.

Here's the patch. Please let me know if anything else needs changing.

[-- Attachment #2: 0001-Don-t-collect-reachable-killed-buffers-during-GC.patch --]
[-- Type: text/x-patch, Size: 1888 bytes --]

From 70f756e08c003ed09fac18af9023c913f910b8e7 Mon Sep 17 00:00:00 2001
From: Pip Cet <pipcet@gmail.com>
Date: Sat, 14 Mar 2020 15:36:41 +0000
Subject: [PATCH] Don't collect reachable killed buffers during GC

* src/alloc.c (valid_buffer_holding): New function, returns true for
valid killed buffers.
(mark_maybe_object, mark_maybe_pointer): Use
`valid_buffer_holding' rather than `live_buffer_holding'.
---
 src/alloc.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/src/alloc.c b/src/alloc.c
index 1c6b664b22..eaf31fd19c 100644
--- a/src/alloc.c
+++ b/src/alloc.c
@@ -4511,6 +4511,30 @@ live_buffer_p (struct mem_node *m, void *p)
   return !NILP (live_buffer_holding (m, p));
 }
 
+/* If P is a pointer into a buffer, killed or live, return the buffer.
+   Otherwise, return nil.  M is a pointer to the mem_block for P.  */
+
+static Lisp_Object
+valid_buffer_holding (struct mem_node *m, void *p)
+{
+  /* P must point into the block, and the buffer
+     must not have been killed.  */
+  if (m->type == MEM_TYPE_BUFFER)
+    {
+      struct buffer *b = m->start;
+      char *cb = m->start;
+      char *cp = p;
+      ptrdiff_t offset = cp - cb;
+      if (0 <= offset && offset < sizeof *b)
+	{
+	  Lisp_Object obj;
+	  XSETBUFFER (obj, b);
+	  return obj;
+	}
+    }
+  return Qnil;
+}
+
 /* Mark OBJ if we can prove it's a Lisp_Object.  */
 
 static void
@@ -4566,7 +4590,7 @@ mark_maybe_object (Lisp_Object obj)
 
 	case Lisp_Vectorlike:
 	  mark_p = (EQ (obj, live_vector_holding (m, po))
-		    || EQ (obj, live_buffer_holding (m, po)));
+		    || EQ (obj, valid_buffer_holding (m, po)));
 	  break;
 
 	default:
@@ -4636,7 +4660,7 @@ mark_maybe_pointer (void *p)
 	  break;
 
 	case MEM_TYPE_BUFFER:
-	  obj = live_buffer_holding (m, p);
+	  obj = valid_buffer_holding (m, p);
 	  break;
 
 	case MEM_TYPE_CONS:
-- 
2.25.1