Failing to GC killed buffers considered harmful

[Eli Zaretskii]

This recent change on master:

  commit afaf2f465188ab1f438ff3e021260e7c529b1b9d
  Author:     Pip Cet <address@hidden>
  AuthorDate: Sat Mar 14 18:26:33 2020 +0000
  Commit:     Eli Zaretskii <address@hidden>
  CommitDate: Sun Mar 15 16:35:07 2020 +0200

      Make sure we mark reachable killed buffers during GC

      * src/alloc.c (live_buffer_holding): Add ALL_BUFFERS argument for
      returning killed buffers.
      (mark_maybe_object, mark_maybe_pointer): Use the additional
      argument.  (Bug#39962)

causes us to dump killed buffers in some cases.  Presumably, the call
to GC right before we start pdumping fails to collect a killed buffer,
and it ends up being dumped.  When we restore from emacs.pdump, an
Emacs built with --enable-checking on a platform that uses mmap for
buffer text aborts here:

  #ifdef USE_MMAP_FOR_BUFFERS
    if (dumped_with_unexec_p ())
      {
        ...
      }
    else
      {
        struct buffer *b;

        /* Only buffers with allocated buffer text should be present at
           this point in temacs.  */
        FOR_EACH_BUFFER (b)
          {
            eassert (b->text->beg != NULL);  <<<<<<<<<<<<<<<<<
          }
      }
  #endif /* USE_MMAP_FOR_BUFFERS */

because a killed buffer has its text freed and set to NULL.

We could, of course, remove the assertion, but then we are left with a
dead buffer that will never be GC'ed, AFAIU, because objects that come
from the portable dump are considered constantly marked.

Another idea is to avoid dumping such buffers.  But I couldn't find a
facility for doing that safely; simply having dump_buffer return
causes an assertion violation later:

  #ifdef ENABLE_CHECKING
  static Lisp_Object
  dump_check_overlap_dump_reloc (Lisp_Object lreloc_a,
                                 Lisp_Object lreloc_b)
  {
    struct dump_reloc reloc_a = dump_decode_dump_reloc (lreloc_a);
    struct dump_reloc reloc_b = dump_decode_dump_reloc (lreloc_b);
    eassert (dump_reloc_get_offset (reloc_a) < dump_reloc_get_offset (reloc_b));
    return Qnil;
  }
  #endif

Daniel, did I miss some facility to avoid dumping an object safely?

If not, what other solutions could we try, given that whether some
pointer into a buffer ends up on the stack at pdump time is something
we cannot really control?

TIA