bug#30931: 27.0.50; Crash in "Automatic GC"

[Noam Postavsky <npostavs@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 682 bytes --]

found 30931 25.3
found 30931 26.0.91
tags 30931 + confirmed
retitle 30931 abort() due to CHECK_ALLOCATED_AND_LIVE failure during GC
quit

Michał Kondraciuk <k.michal@zoho.com> writes:
>
> 1. emacs -Q
> 2. M-x package-initialize
> 3. Evaluate: |(add-to-list 'package-archives '("melpa"
> . "https://melpa.org/packages/")) 4. M-x package-refresh-contents
> 5. M-x 
> package-install RET ivy RET |6||. M-x package-install RET yasnippet
> RET |||7. M-x package-install RET yasnippet-snippets RET|
> 8. Evaluate form below.
> 9. Wait 1-10 minutes.

I'm able to reproduce this in a fresh HOME (I've tried with versions
25.3 and 26.0.91), with the attached init.el.


[-- Attachment #2: init.el to reproduce crash --]
[-- Type: text/plain, Size: 1578 bytes --]


(require 'package)
(add-to-list 'package-archives '("melpa" . "https://melpa.org/packages/"))
(package-refresh-contents)
(package-initialize)

(unless (package-installed-p 'ivy)
  (package-install 'ivy))
(unless (package-installed-p 'yasnippet-snippets)
  (package-install 'yasnippet-snippets))

(require 'yasnippet)
(require 'ivy)

(yas-reload-all)

(switch-to-buffer "*scratch*")
(lisp-interaction-mode)
(yas-minor-mode-on)

(let ((templates (mapcar #'yas--template-key
                         (yas--all-templates (yas--get-snippet-tables)))))
  (defun update-fn ()
    (with-current-buffer "*scratch*"
      (save-restriction
        (narrow-to-region 3 3)
        (insert " " (ivy-state-current ivy-last))
        (yas-expand)
        (mapc #'yas-abort-snippet (yas-active-snippets)))
      (redisplay)))
  (let ((buffer-undo-list t))
    (while t
      (erase-buffer)
      (insert "aaaaaa")
      (redisplay)
      (sit-for 0.1)
      (run-with-timer
       0.01 nil (lambda ()
                  (dotimes (_ (% (random) 15))
                    (execute-kbd-macro "\C-n")
                    (sit-for 0.05)
                    (redisplay)
                    (when (zerop (% (random) 4))
                      (execute-kbd-macro "\C-p")
                      (sit-for 0.05)
                      (redisplay)))
                  (sit-for 0.1)
                  (redisplay)
                  (abort-recursive-edit)))
      (catch 'exit
        (condition-case err
            (ivy-read "foo: " templates
                      :update-fn #'update-fn)
          (quit))))))

[-- Attachment #3: Type: text/plain, Size: 296 bytes --]


It looks like there is a Lisp_Misc_Free object in the undo-list. At
least, I think it's the undo-list.  One time I actually got the
mark_object (BVAR (nextb, undo_list)) in the backtrace, although the
next time it was just mark_stack, but the object being marked still
looks like an undo-list.