bug#66098: Crash in itree.c on macOS with incomplete backtrace

[Stefan Kangas <stefankangas@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 1564 bytes --]

Stefan Kangas <stefankangas@gmail.com> writes:

> I'm still trying various configurations to find out more, but it's slow
> going since I can't seem to find a way to reproduce it consistently.
> I'm now running this build:
>
> Configured using:
>  'configure 'CFLAGS=-O0 -g3 -fsanitize=address'
>  --with-native-compilation CPPFLAGS=-I/usr/local/opt/llvm/include
>  LDFLAGS=-L/usr/local/opt/llvm/lib'

I was now able to reproduce the crash again.  This time I was typing
C-M-x (`eval-defun') in an elisp-mode buffer when it crashed, for a form
which AFAICT basically sets some variables and nothing more.  Here is
the form, for the sake of completion:

    (use-package magit
      :bind (("C-c g" . magit-dispatch))
      :custom
      (magit-diff-refine-hunk 'all)
      (magit-repository-directories '(("~/wip/emacs/" . 0)))
      :config
      (with-eval-after-load 'magit-extras
        (setq magit-pop-revision-stack-format
              (pcase-let ((`(,pt ,_eob ,index-regexp)
                           (default-value 'magit-pop-revision-stack-format)))
                `(,pt "[%N: %h]: %ci\n  %s\n
https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=%H"
                      ,index-regexp)))))

Unfortunately, ASan didn't catch anything useful.  The terminal output
is only this:

    Fatal error 11: Segmentation fault
    Abort trap: 6

The Apple crash log looks rather similar to the old one, but the line
numbers for some of the calls are a bit different.  I've attached it
here just in case anyone else is able to glean something useful from it.

[-- Attachment #2: Type: text/plain, Size: 357 bytes --]


> Since I did not see this a few weeks ago, perhaps it's time to bite the
> bullet and bisect.

I'll start bisecting, but since the crash is so infrequent and
unpredictable, I'm not sure what criteria I should use for marking a
commit "good".  Use Emacs normally for 72 hours, and if it doesn't
crash, then it's probably okay?  That might take me a while.

[-- Attachment #3: crash.txt.gz --]
[-- Type: application/octet-stream, Size: 8852 bytes --]