bug#39962: 27.0.90; Crash in Emacs 27.0.90

[Pip Cet]

On Mon, Mar 16, 2020 at 3:33 PM Pip Cet <pipcet@gmail.com> wrote:
> On Mon, Mar 16, 2020 at 10:44 AM Pieter van Oostrum
> <pieter-l@vanoostrum.org> wrote:
> > Pieter van Oostrum <pieter-l@vanoostrum.org> writes:
> >
> > (gdb) f 3
> > #3  0x00000001002b56e7 in mark_overlay (ptr=0x12c489030) at alloc.c:6213
> > 6213          set_vectorlike_marked (&XMARKER (ptr->end)->header);
> > (gdb) p *ptr
> > $9 = {
> >   header = {
> >     size = -4611686018360274941
> >   },
> >   start = XIL(0x12c488fc5),
> >   end = XIL(0),
> >   plist = XIL(0x11dc4e263),
> >   next = 0x12c488f30
> > }
>
> Can you show the entire small vector block containing 0x12c488fc0?
> Something like
>
> x/1024gx 0x12c488000
>
> should work.
>
> What I think happened is that the vector free list got corrupted
> somehow, and two vectors believed they owned the memory location
> 0x12c489040.

Another thing we could try is poisoning the memory area used by a
vector when we put it on the free list. Something like the attached
patch might work.

0001-poison-memory-of-vectors-put-on-the-free-list.patch
Description: Text Data