bug#26932: 25.1; Crash triggered a few times a day with network process

[Vivek Dasmohapatra <vivek@etla.org>]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 6973 bytes --]

idx 7 is a cons, the car is integer 273081 (probably a buffer size
or char position), the cdr is a cons whose car is another instance of
DEAD

(gdb) p last_marked[7]
$285 = 48953395
(gdb) p XTYPE(last_marked[7])
$286 = Lisp_Cons
(gdb) p *XTYPE(last_marked[7])
Attempt to take contents of a non-pointer value.
(gdb) p *XCONS(last_marked[7])
$287 = {car = 1092326, u = {cdr = 48953379, chain = 0x2eaf823}}
(gdb) p XTYPE(1092326)
$288 = Lisp_Int1
(gdb) p XTYPE(48953379)
$289 = Lisp_Cons
(gdb) p XINT(1092326)
$290 = 273081
(gdb) p *XCONS(48953379)
$291 = {car = 8760836, u = {cdr = 48953363, chain = 0x2eaf813}}
(gdb) p XTYPE(8760836)
$292 = Lisp_String
(gdb) p *XSTRING(8760836)
$293 = {size = 4, size_byte = -1, intervals = 0x0,
   data = 0xb374bb <pure+2999995> "DEAD"}

idx 6 seems to be a marker (I guess?) inside a cons:

(gdb) p *XCONS(last_marked[6])
$226 = {car = 21742881, u = {cdr = -30, chain = 0xffffffffffffffe2}}
(gdb) p XTYPE(21742881)
$227 = Lisp_Misc
(gdb) p XTYPE(-30)
$228 = Lisp_Int0
(gdb) p XINT(-30)
$229 = -8
(gdb) p XTYPE(21742881)
$230 = Lisp_Misc
(gdb) p *XMISC(21742881)
$231 = {u_any = {type = Lisp_Misc_Marker, gcmarkbit = true, spacer = 1128},
   u_free = {type = Lisp_Misc_Marker, gcmarkbit = true, spacer = 1128,
     chain = 0x1e1d370}, u_marker = {type = Lisp_Misc_Marker, gcmarkbit = true,
     spacer = 1128, need_adjustment = false, insertion_type = false,
     buffer = 0x1e1d370, next = 0x14bc548, charpos = 275053, bytepos = 275063},
   u_overlay = {type = Lisp_Misc_Marker, gcmarkbit = true, spacer = 1128,
     next = 0x1e1d370, start = 21742920, end = 275053, plist = 275063},
   u_save_value = {type = Lisp_Misc_Marker, gcmarkbit = true, spacer = 0,
     save_type = SAVE_TYPE_FUNCPTR_PTR_OBJ, data = {{pointer = 0x1e1d370,
         funcpointer = 0x1e1d370, integer = 31576944, object = 31576944}, {
         pointer = 0x14bc548, funcpointer = 0x14bc548, integer = 21742920,
         object = 21742920}, {pointer = 0x4326d, funcpointer = 0x4326d,
         integer = 275053, object = 275053}, {pointer = 0x43277,
         funcpointer = 0x43277, integer = 275063, object = 275063}}},
   u_finalizer = {base = {type = Lisp_Misc_Marker, gcmarkbit = true,
       spacer = 1128}, prev = 0x1e1d370, next = 0x14bc548, function = 275053}}

From here on things don't look interesting (to me) but included for 
completemess: just character positions, cons cells, small chunks of text 
and the symbol nil.

Would recompiling the the GC sanity checking turned on be useful here?

How hard would it be to make emacs log the pointer or pseudopointer and
context when creating an object to stderr so we could figure out which 
object got corrupted? I guess we'd be swamped by output, especially as
it can take a long time to trigger the bug.
=======================================================================================

idx 5 looks like a cons cell whose first element is the cons containing the idx 6 entry:

(gdb) p XTYPE(last_marked[5])
$242 = Lisp_Cons
(gdb) p *XCONS(last_marked[5])
$243 = {car = 44165379, u = {cdr = 48953395, chain = 0x2eaf833}}
(gdb) p XTYPE(44165379)
$244 = Lisp_Cons
(gdb) p XTYPE(48953395)
$245 = Lisp_Cons
(gdb) p *XCONS(44165379)
$246 = {car = 21742881, u = {cdr = -30, chain = 0xffffffffffffffe2}}
(gdb) p XTYPE(21742881)
$247 = Lisp_Misc
(gdb) p *XMISC(21742881)
$248 = {u_any = {type = Lisp_Misc_Marker, gcmarkbit = true, spacer = 1128},
   u_free = {type = Lisp_Misc_Marker, gcmarkbit = true, spacer = 1128,
     chain = 0x1e1d370}, u_marker = {type = Lisp_Misc_Marker, gcmarkbit = true,
     spacer = 1128, need_adjustment = false, insertion_type = false,
     buffer = 0x1e1d370, next = 0x14bc548, charpos = 275053, bytepos = 275063},
   u_overlay = {type = Lisp_Misc_Marker, gcmarkbit = true, spacer = 1128,
     next = 0x1e1d370, start = 21742920, end = 275053, plist = 275063},
   u_save_value = {type = Lisp_Misc_Marker, gcmarkbit = true, spacer = 0,
     save_type = SAVE_TYPE_FUNCPTR_PTR_OBJ, data = {{pointer = 0x1e1d370,
         funcpointer = 0x1e1d370, integer = 31576944, object = 31576944}, {
         pointer = 0x14bc548, funcpointer = 0x14bc548, integer = 21742920,
         object = 21742920}, {pointer = 0x4326d, funcpointer = 0x4326d,
         integer = 275053, object = 275053}, {pointer = 0x43277,
         funcpointer = 0x43277, integer = 275063, object = 275063}}},
   u_finalizer = {base = {type = Lisp_Misc_Marker, gcmarkbit = true,
       spacer = 1128}, prev = 0x1e1d370, next = 0x14bc548, function = 275053}}

The cdr is a cons whose car is another "DEAD" string.

(gdb) p XTYPE(last_marked[5])
$249 = Lisp_Cons
(gdb) p *XCONS(last_marked[5])
$250 = {car = 44165379, u = {cdr = 48953395, chain = 0x2eaf833}}
(gdb) p XTYPE(48953395)
$251 = Lisp_Cons
(gdb) p *XCONS(48953395)
$252 = {car = 1092326, u = {cdr = 48953379, chain = 0x2eaf823}}
(gdb) p XTYPE(1092326)
$253 = Lisp_Int1
(gdb) p XINT(1092326)
$254 = 273081
(gdb) p XTYPE(48953379)
$255 = Lisp_Cons
(gdb) p *XCONS(48953379)
$256 = {car = 8760836, u = {cdr = 48953363, chain = 0x2eaf813}}

(gdb) p XINT(last_marked[4])
$260 = -273073 ← char position? seems close to the number above.

(gdb) p *XSTRING(last_marked[3])
$264 = {size = -9223372036854775800, size_byte = 8, intervals = 0x0,
   data = 0x2ab9f28 "l corpse"}

That's an outgoing string sent by the mud client over the newtwork.

last_marked[2] contains a cons of( last_marked[3] . last_marked[4] )

last_marked[1] containing structure for the last_marked[2]

last_marked[0]

(gdb) p XTYPE(last_marked[0])
$310 = Lisp_Symbol
(gdb) p *XSYMBOL(last_marked[0])
$311 = {gcmarkbit = true, redirect = SYMBOL_PLAINVAL, constant = 1,
   interned = 2, declared_special = true, pinned = false, name = 8760940,
   val = {value = 0, alias = 0x0, blv = 0x0, fwd = 0x0}, function = 0,
   plist = 33306355, next = 0x0}
(gdb) p XTYPE(8760940)
$312 = Lisp_String
(gdb) p *XSTRING(8760940)
$313 = {size = 3, size_byte = -1, intervals = 0x0, data = 0x5f3eec "nil"}

last_marked[499] - container of previous

last_marked[498]
(gdb) p last_marked[498]
$326 = 1092298
(gdb) p XTYPE(1092298)
$327 = Lisp_Int0
(gdb) p XINT(1092298)
$328 = 273074

last_marked[497] - XINT 273073

last_marked[496] (273073 . 273074)

last_marked[495] ((273073 . 273074) ...)

last_marked[494] 'nil

(gdb) p XTYPE(last_marked[494])
$350 = Lisp_Symbol
(gdb) p *XSYMBOL(last_marked[494])
$351 = {gcmarkbit = true, redirect = SYMBOL_PLAINVAL, constant = 1,
   interned = 2, declared_special = true, pinned = false, name = 8760940,
   val = {value = 0, alias = 0x0, blv = 0x0, fwd = 0x0}, function = 0,
   plist = 33306355, next = 0x0}
(gdb) p XTYPE(8760940)
$352 = Lisp_String
(gdb) p *XSTRING(8760940)
$353 = {size = 3, size_byte = -1, intervals = 0x0, data = 0x5f3eec "nil"}

last_marked[493] container
last_marked[492] 273074
last_marked[491] ibid
last_marked[490] -1
last_marked[489] container
last_marked[488] -273073
last_marked[487] "e"
last_marked[486] ("e" . -273073)
last_marked[485] container