I'm still able to reproduce this issue on the emacs-28 branch with the
following basic recipe.  The details of the backtrace, where in the
code it fails, and how long it takes until it aborts all vary between
runs.

    1. start `emacs -Q`
    2. evaluate `(package-initialize)` to make the elpa magit package
    available.
    3. run magit commands (like magit-log commands) repeatedly until
    emacs (eventually) aborts.


The good news is that I have since built Emacs 29 from the `master`
branch, and I've not been able to reproduce the issue with it.  I did
some git bisecting on `master` and found that the below commit is the
first one where I cannot reproduce the issue.


    commit 5f1bd872478927ad4bc635502e74628d39885286
    Author: Gerd Moellmann <gerd.moellmann@gmail.com>
    Date:   Tue Jun 21 15:49:44 2022 +0200

Prevent GC of window referenced from EmacsScroller

* src/nsterm.m (EmacsScroller.mark, mark_nsterm): New functions.
* src/nsterm.h (EmacsScroller.mark, mark_nsterm): Declare.
* src/alloc.c (garbage_collect) [MAVE_NS]: Call mark_nsterm.
(Bug#56095)

     src/alloc.c  |  4 ++++
     src/nsterm.h |  4 ++++
     src/nsterm.m | 30 ++++++++++++++++++++++++++++++
     3 files changed, 38 insertions(+)




Thanks.