bug#39962: 27.0.90; Crash in Emacs 27.0.90

[Pieter van Oostrum <pieter-l@vanoostrum.org>]

Eli Zaretskii <eliz@gnu.org> writes:

>
> Thanks.  Since xbacktrace doesn't work in your case for some reason
> (which is troublesome on its own), I will have to ask you to go to
> every frame that calls Ffuncall, and do this:
>
>   (gdb) p args[0]
>   (gdb) xtype
>
> If "xtype" says it's a symbol, then additionally do this immediately
> after "xtype":
>
>   (gdb) xsymbol
>
> This will tell us which Lisp function was called in each such frame: a
> poor man's Lisp backtrace.
>
> Are these problems something you can trigger at will?

Yes. Load a few quite big mailboxes in VM, and do some manipulation on them (like sorting).

Here is the info:

#9  0x0000000100314bfe in Ffuncall (nargs=2, args=0x7ffeefbf6e78)
    at eval.c:2796
2796	    val = funcall_lambda (fun, numargs, args + 1);
(gdb) p args[0]
$8 = XIL(0xcfeb420)
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$9 = (struct Lisp_Symbol *) 0xcfeb5b8
Cannot access memory at address 0xcfeb5c0
(gdb)

#15 0x0000000100314bfe in Ffuncall (nargs=2, args=0x7ffeefbf8e48)
    at eval.c:2796
2796	    val = funcall_lambda (fun, numargs, args + 1);
(gdb) p args[0]
$10 = XIL(0x105c5b465)
(gdb) xtype
Lisp_Vectorlike
PVEC_COMPILED
(gdb)

#21 0x0000000100314bae in Ffuncall (nargs=3, args=0x7ffeefbf9198)
    at eval.c:2794
2794	    val = funcall_subr (XSUBR (fun), numargs, args + 1);
(gdb) p args[0]
$11 = XIL(0x5fb6d60)
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$12 = (struct Lisp_Symbol *) 0x5fb6ef8
Cannot access memory at address 0x5fb6f00
(gdb)

#24 0x0000000100314bfe in Ffuncall (nargs=1, args=0x7ffeefbfa1b8)
    at eval.c:2796
2796	    val = funcall_lambda (fun, numargs, args + 1);
(gdb) p args[0]
$13 = XIL(0x3e34910)
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$14 = (struct Lisp_Symbol *) 0x3e34aa8
Cannot access memory at address 0x3e34ab0
(gdb)

#27 0x0000000100314bfe in Ffuncall (nargs=10, args=0x7ffeefbfb608)
    at eval.c:2796
2796	    val = funcall_lambda (fun, numargs, args + 1);
(gdb) p args[0]
$15 = XIL(0x56c6a00)
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$16 = (struct Lisp_Symbol *) 0x56c6b98
Cannot access memory at address 0x56c6ba0
(gdb)

#30 0x0000000100314bfe in Ffuncall (nargs=3, args=0x7ffeefbfc958)
    at eval.c:2796
2796	    val = funcall_lambda (fun, numargs, args + 1);
(gdb) p args[0]
$17 = XIL(0x4a62fc0)
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$18 = (struct Lisp_Symbol *) 0x4a63158
Cannot access memory at address 0x4a63160
(gdb)

#31 0x00000001002fd9ca in Ffuncall_interactively (nargs=3, args=0x7ffeefbfc958)
    at callint.c:254
254	  return unbind_to (speccount, Ffuncall (nargs, args));
(gdb) p args[0]
$19 = XIL(0x4a62fc0)
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$20 = (struct Lisp_Symbol *) 0x4a63158
Cannot access memory at address 0x4a63160
(gdb)

#33 0x0000000100314bae in Ffuncall (nargs=4, args=0x7ffeefbfc950)
    at eval.c:2794
2794	    val = funcall_subr (XSUBR (fun), numargs, args + 1);
(gdb) p args[0]
$21 = XIL(0x62a0)
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$22 = (struct Lisp_Symbol *) 0x6438
Cannot access memory at address 0x6440
(gdb)

#37 0x0000000100314bae in Ffuncall (nargs=4, args=0x7ffeefbfd9b8)
    at eval.c:2794
2794	    val = funcall_subr (XSUBR (fun), numargs, args + 1);
(gdb) p args[0]
$23 = XIL(0x5f592d0)
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$24 = (struct Lisp_Symbol *) 0x5f59468
Cannot access memory at address 0x5f59470
(gdb)

#40 0x0000000100314bfe in Ffuncall (nargs=2, args=0x7ffeefbfea18)
    at eval.c:2796
2796	    val = funcall_lambda (fun, numargs, args + 1);
(gdb) p args[0]
$25 = XIL(0x3960)
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$26 = (struct Lisp_Symbol *) 0x3af8
Cannot access memory at address 0x3b00
(gdb) 

There seems to be something fishy with the Lisp memory.
-- 
Pieter van Oostrum
www: http://pieter.vanoostrum.org/
PGP key: [8DAE142BE17999C4]