bug#39962: 27.0.90; Crash in Emacs 27.0.90

[Pip Cet]

On Tue, Mar 10, 2020 at 4:36 PM Pieter van Oostrum
<pieter-l@vanoostrum.org> wrote:
> #2  0x0000000100233af4 in adjust_markers_for_insert (from=36399,
>     from_byte=36399, to=36401, to_byte=36401, before_markers=false)
>     at insdel.c:294
> 294           eassert (m->bytepos >= m->charpos
> (gdb) x/32gx m
> 0x1609db830:    0x4000000003005000      0x000000015b29a4b0
> 0x1609db840:    0x00000001609dba44      0x00000001609db800
> 0x1609db850:    0x0000000000000000      0x0000000000002d12
> 0x1609db860:    0x4000000003005000      0x000000015b29a4b0
> 0x1609db870:    0x0000000000000000      0x00000001609db830
> 0x1609db880:    0x0000000000002d6f      0x0000000000002d6f
> 0x1609db890:    0x4000000004001003      0x00000001609db835
> 0x1609db8a0:    0x00000001609db865      0x00000001054d2723
> 0x1609db8b0:    0x00000001609db7a0      0x0000000000000000

So it's a marker marking the start position of an overlay. It's
allocated in the same vector block as other markers and overlays, so
maybe there used to be an overlay at 0x1609db830 and someone set its
"next" pointer to NULL after it had been freed?

I'm not sure this is related, but in looking over the code I spotted a
bit of confusion in the garbage collector between checking a buffer is
"live" (in the sense that it has not been killed) and checking it's
live in the sense that it needs to be preserved by GC: evaluating this
code in *scratch* causes a segfault at least some of the time.

(prog1
    (let ((temp-buffer (generate-new-buffer " *temp*")))
      (prog1
          temp-buffer
        (kill-buffer temp-buffer)
        (setq temp-buffer nil)))
  (garbage-collect))