bug#7318: 23.2.50; Crash in GC system

[Ningyu Shi]

There are several cases I can crash emacs, all ends up to the GC system. I 
provide two cases with backtraces.

1. Open emacs with about 10 files, and use global-auto-revert-mode. Then try to 
change the file content very quickly from outside of emacs. I do 'git checkout 
brancha' and 'git checkout branchb' very quickly. Watch for emacs to 
crash/freeze. In case of crash, the bt is

#0  0x000000000059af40 in Fgarbage_collect () at alloc.c:5117
#1  0x000000000060d909 in Fbyte_code (bytestr=8338641, vector=8338677, 
maxdepth=20) at bytecode.c:529
#2  0x00000000005bbcf3 in funcall_lambda (fun=8338557, nargs=2, 
arg_vector=0x7fbff60f18) at eval.c:3220
#3  0x00000000005bb625 in Ffuncall (nargs=3, args=0x7fbff60f10) at eval.c:3077
#4  0x000000000060de0e in Fbyte_code (bytestr=10000449, vector=10000485, 
maxdepth=12) at bytecode.c:680
#5  0x00000000005bbcf3 in funcall_lambda (fun=10000365, nargs=2, 
arg_vector=0x7fbff611a0) at eval.c:3220
#6  0x00000000005bb95f in apply_lambda (fun=10000365, args=8995422, 
eval_flag=1) at eval.c:3143
#7  0x00000000005ba0c4 in Feval (form=8995406) at eval.c:2392
#8  0x00000000005b61d5 in Fif (args=8995486) at eval.c:359
#9  0x00000000005b9a95 in Feval (form=8995390) at eval.c:2295
#10 0x00000000005b6350 in Fprogn (args=8995662) at eval.c:415
#11 0x00000000005bbca8 in funcall_lambda (fun=8995678, nargs=1, 
arg_vector=0x7fbff61860) at eval.c:3213
#12 0x00000000005bb6b1 in Ffuncall (nargs=2, args=0x7fbff61858) at eval.c:3088
#13 0x00000000005ba2f4 in Fapply (nargs=2, args=0x7fbff61858) at eval.c:2453
#14 0x00000000005bb2a3 in Ffuncall (nargs=3, args=0x7fbff61850) at eval.c:3012
#15 0x000000000060de0e in Fbyte_code (bytestr=9999297, vector=9999333, 
maxdepth=28) at bytecode.c:680
#16 0x00000000005bbcf3 in funcall_lambda (fun=9999181, nargs=3, 
arg_vector=0x7fbff61bb8) at eval.c:3220
#17 0x00000000005bb625 in Ffuncall (nargs=4, args=0x7fbff61bb0) at eval.c:3077
#18 0x000000000060de0e in Fbyte_code (bytestr=10000665, vector=10000701, 
maxdepth=16) at bytecode.c:680
#19 0x00000000005bbcf3 in funcall_lambda (fun=10000605, nargs=1, 
arg_vector=0x7fbff61f08) at eval.c:3220
#20 0x00000000005bb625 in Ffuncall (nargs=2, args=0x7fbff61f00) at eval.c:3077
#21 0x00000000005bacde in call1 (fn=10000605, arg1=14708194) at eval.c:2812
#22 0x00000000005c6022 in mapcar1 (leni=9, vals=0x0, fn=10000605, seq=13188102) 
at fns.c:2472
#23 0x00000000005c6461 in Fmapc (function=10000605, sequence=13188102) at 
fns.c:2564
#24 0x00000000005bb3e1 in Ffuncall (nargs=3, args=0x7fbff62120) at eval.c:3034
#25 0x000000000060de0e in Fbyte_code (bytestr=10001033, vector=10001085, 
maxdepth=16) at bytecode.c:680
#26 0x00000000005b9ec1 in Feval (form=10001006) at eval.c:2356
#27 0x00000000005b7c89 in internal_catch (tag=11674626, func=0x5b9757 <Feval>, 
arg=10001006) at eval.c:1228
#28 0x000000000060e985 in Fbyte_code (bytestr=10000857, vector=10000893, 
maxdepth=16) at bytecode.c:855
#29 0x00000000005bbcf3 in funcall_lambda (fun=10000789, nargs=1, 
arg_vector=0x7fbff62978) at eval.c:3220
#30 0x00000000005bb625 in Ffuncall (nargs=2, args=0x7fbff62970) at eval.c:3077
#31 0x000000000060de0e in Fbyte_code (bytestr=10001297, vector=10001333, 
maxdepth=16) at bytecode.c:680
#32 0x00000000005bbcf3 in funcall_lambda (fun=10001229, nargs=1, 
arg_vector=0x7fbff62cb8) at eval.c:3220
#33 0x00000000005bb625 in Ffuncall (nargs=2, args=0x7fbff62cb0) at eval.c:3077
#34 0x000000000060de0e in Fbyte_code (bytestr=10011721, vector=10011757, 
maxdepth=8) at bytecode.c:680
#35 0x00000000005bbcf3 in funcall_lambda (fun=10011677, nargs=0, 
arg_vector=0x7fbff62ff8) at eval.c:3220
#36 0x00000000005bb625 in Ffuncall (nargs=1, args=0x7fbff62ff0) at eval.c:3077
#37 0x00000000005b9cb6 in Feval (form=10012254) at eval.c:2322
#38 0x00000000005b8148 in internal_lisp_condition_case (var=14713122, 
bodyform=10012254, handlers=10012286) at eval.c:1437
#39 0x000000000060ea0b in Fbyte_code (bytestr=10011905, vector=10011941, 
maxdepth=24) at bytecode.c:870
#40 0x00000000005bbcf3 in funcall_lambda (fun=10011853, nargs=0, 
arg_vector=0x7fbff63668) at eval.c:3220
#41 0x00000000005bb625 in Ffuncall (nargs=1, args=0x7fbff63660) at eval.c:3077
#42 0x000000000060de0e in Fbyte_code (bytestr=41191889, vector=17696917, 
maxdepth=20) at bytecode.c:680
#43 0x00000000005bbcf3 in funcall_lambda (fun=17697349, nargs=0, 
arg_vector=0x7fbff639b8) at eval.c:3220
#44 0x00000000005bb625 in Ffuncall (nargs=1, args=0x7fbff639b0) at eval.c:3077
#45 0x000000000060de0e in Fbyte_code (bytestr=41194193, vector=23240885, 
maxdepth=16) at bytecode.c:680
#46 0x00000000005bbcf3 in funcall_lambda (fun=23241173, nargs=0, 
arg_vector=0x7fbff63e40) at eval.c:3220
#47 0x00000000005bb625 in Ffuncall (nargs=1, args=0x7fbff63e38) at eval.c:3077
#48 0x00000000005ba2ba in Fapply (nargs=2, args=0x7fbff63e38) at eval.c:2449
#49 0x00000000005bb2a3 in Ffuncall (nargs=3, args=0x7fbff63e30) at eval.c:3012
#50 0x000000000060de0e in Fbyte_code (bytestr=9635249, vector=9635301, 
maxdepth=16) at bytecode.c:680
#51 0x00000000005b9ec1 in Feval (form=9635222) at eval.c:2356
#52 0x00000000005b8148 in internal_lisp_condition_case (var=11225106, 
bodyform=9635222, handlers=9635366) at eval.c:1437
#53 0x000000000060ea0b in Fbyte_code (bytestr=9634969, vector=9635005, 
maxdepth=20) at bytecode.c:870
#54 0x00000000005bbcf3 in funcall_lambda (fun=9634901, nargs=1, 
arg_vector=0x7fbff646e8) at eval.c:3220
#55 0x00000000005bb625 in Ffuncall (nargs=2, args=0x7fbff646e0) at eval.c:3077
#56 0x00000000005bacde in call1 (fn=11273986, arg1=17821333) at eval.c:2812
#57 0x00000000005241ad in timer_check_2 () at keyboard.c:4754
#58 0x000000000052422d in timer_check (do_it_now=1) at keyboard.c:4805
#59 0x00000000005220ce in readable_events (flags=1) at keyboard.c:3700
#60 0x00000000005278e4 in get_input_pending (addr=0xa9c258, flags=1) at 
keyboard.c:7080
#61 0x000000000052fbc2 in detect_input_pending_run_timers (do_display=1) at 
keyboard.c:10752
#62 0x000000000061a147 in wait_reading_process_output (time_limit=30, 
microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=11225106, 
    wait_proc=0x0, just_wait_proc=0) at process.c:5042
#63 0x000000000041b0b8 in sit_for (timeout=120, reading=1, do_display=1) at 
dispnew.c:6657
#64 0x000000000052076b in read_char (commandflag=1, nmaps=5, maps=0x7fbff650a8, 
prev_event=11225106, used_mouse_menu=0x7fbff65408, 
    end_time=0x0) at keyboard.c:2972
#65 0x000000000052c55f in read_key_sequence (keybuf=0x7fbff65630, bufsize=30, 
prompt=11225106, dont_downcase_last=0, 
    can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9557
#66 0x000000000051d133 in command_loop_1 () at keyboard.c:1645
#67 0x00000000005b82d4 in internal_condition_case (bfun=0x51cdc7 
<command_loop_1>, handlers=11288418, hfun=0x51c745 <cmd_error>)
    at eval.c:1492
#68 0x000000000051cb03 in command_loop_2 () at keyboard.c:1362
#69 0x00000000005b7c89 in internal_catch (tag=11281682, func=0x51cae8 
<command_loop_2>, arg=11225106) at eval.c:1228
#70 0x000000000051cabd in command_loop () at keyboard.c:1341
#71 0x000000000051c2aa in recursive_edit_1 () at keyboard.c:956
#72 0x000000000051c434 in Frecursive_edit () at keyboard.c:1018
#73 0x000000000051a8e2 in main (argc=1, argv=0x7fbff65f18) at emacs.c:1833

Lisp Backtrace:
"locate-dominating-file" (0xbff60f18)
"vc-find-root" (0xbff611a0)
"if" (0xbff61568)
"vc-hg-registered" (0xbff61860)
"apply" (0xbff61858)
"vc-call-backend" (0xbff61bb8)
0x9898dd PVEC_COMPILED
"mapc" (0xbff62128)
"byte-code" (0xbff623a0)
"vc-registered" (0xbff62978)
"vc-backend" (0xbff62cb8)
0x98c41d PVEC_COMPILED
"funcall" (0xbff62ff0)
"vc-find-file-hook" (0xbff63668)
"auto-revert-handler" (0xbff639b8)
"auto-revert-buffers" (0xbff63e40)
"apply" (0xbff63e38)
"byte-code" (0xbff640b0)
"timer-event-handler" (0xbff646e8)

In this case, the one of the tail pointer value is illegal/corrupted and crash 
the program. No idea where it comes from.

2. When I try to report this bug from within emacs, it crashes... After I type 
some letters in the bug report buffer, it crashes with

#0  0x000000000059c131 in mark_object (arg=3983) at alloc.c:5704
#1  0x000000000059af6a in Fgarbage_collect () at alloc.c:5118
#2  0x00000000005bb0d6 in Ffuncall (nargs=3, args=0x7fbff7ef70) at eval.c:2965
#3  0x00000000005bad59 in call2 (fn=11591778, arg1=11296530, arg2=73072641) at 
eval.c:2834
#4  0x000000000055f7eb in Ffile_readable_p (filename=72582529) at fileio.c:2595
#5  0x00000000005bb3b6 in Ffuncall (nargs=2, args=0x7fbff7f160) at eval.c:3031
#6  0x000000000060de0e in Fbyte_code (bytestr=9864017, vector=9864053, 
maxdepth=20) at bytecode.c:680
#7  0x00000000005bbcf3 in funcall_lambda (fun=9863925, nargs=2, 
arg_vector=0x7fbff7f4b8) at eval.c:3220
#8  0x00000000005bb625 in Ffuncall (nargs=3, args=0x7fbff7f4b0) at eval.c:3077
#9  0x000000000060de0e in Fbyte_code (bytestr=9864017, vector=9864053, 
maxdepth=20) at bytecode.c:680
#10 0x00000000005bbcf3 in funcall_lambda (fun=9863925, nargs=1, 
arg_vector=0x7fbff7f808) at eval.c:3220
#11 0x00000000005bb625 in Ffuncall (nargs=2, args=0x7fbff7f800) at eval.c:3077
#12 0x000000000060de0e in Fbyte_code (bytestr=9864233, vector=9864269, 
maxdepth=20) at bytecode.c:680
#13 0x00000000005bbcf3 in funcall_lambda (fun=9864165, nargs=1, 
arg_vector=0x7fbff7faa0) at eval.c:3220
#14 0x00000000005bb95f in apply_lambda (fun=9864165, args=22056166, 
eval_flag=1) at eval.c:3143
#15 0x00000000005ba0c4 in Feval (form=22056150) at eval.c:2392
#16 0x00000000005bb3b6 in Ffuncall (nargs=2, args=0x7fbff7fda0) at eval.c:3031
#17 0x000000000060de0e in Fbyte_code (bytestr=9909025, vector=9909061, 
maxdepth=20) at bytecode.c:680
#18 0x00000000005bbcf3 in funcall_lambda (fun=9908965, nargs=1, 
arg_vector=0x7fbff80108) at eval.c:3220
#19 0x00000000005bb625 in Ffuncall (nargs=2, args=0x7fbff80100) at eval.c:3077
#20 0x00000000005bacde in call1 (fn=9908965, arg1=22043702) at eval.c:2812
#21 0x00000000005c6022 in mapcar1 (leni=28, vals=0x7fbff80240, fn=9908965, 
seq=72397206) at fns.c:2472
#22 0x00000000005c63b3 in Fmapcar (function=9908965, sequence=72397206) at 
fns.c:2544
#23 0x00000000005bb3e1 in Ffuncall (nargs=3, args=0x7fbff80430) at eval.c:3034
#24 0x000000000060de0e in Fbyte_code (bytestr=9909305, vector=9909341, 
maxdepth=12) at bytecode.c:680
#25 0x00000000005bbcf3 in funcall_lambda (fun=9909253, nargs=0, 
arg_vector=0x7fbff80788) at eval.c:3220
#26 0x00000000005bb625 in Ffuncall (nargs=1, args=0x7fbff80780) at eval.c:3077
#27 0x000000000060de0e in Fbyte_code (bytestr=9908793, vector=9908829, 
maxdepth=16) at bytecode.c:680
#28 0x00000000005bbcf3 in funcall_lambda (fun=9908709, nargs=1, 
arg_vector=0x7fbff80a00) at eval.c:3220
#29 0x00000000005bb95f in apply_lambda (fun=9908709, args=42287894, 
eval_flag=1) at eval.c:3143
#30 0x00000000005ba0c4 in Feval (form=42287862) at eval.c:2392
#31 0x00000000005b846b in internal_condition_case_1 (bfun=0x5b9757 <Feval>, 
arg=42287862, handlers=11288418, 
    hfun=0x52962b <menu_item_eval_property_1>) at eval.c:1540
#32 0x00000000005296c3 in menu_item_eval_property (sexpr=42287862) at 
keyboard.c:7974
#33 0x000000000053539f in get_keyelt (object=11579346, autoload=1) at 
keymap.c:848
#34 0x0000000000534b4c in access_keymap (map=11218582, idx=11266706, t_ok=1, 
noinherit=0, autoload=1) at keymap.c:627
#35 0x000000000052a2fc in tool_bar_items (reuse=72991973, nitems=0x7fbff8107c) 
at keyboard.c:8365
#36 0x000000000043f326 in update_tool_bar (f=0xf38b30, save_match_data=1) at 
xdisp.c:9867
#37 0x000000000043eb92 in prepare_menu_bars () at xdisp.c:9562
#38 0x0000000000442a5d in redisplay_internal (preserve_echo_area=0) at 
xdisp.c:11405
#39 0x0000000000441924 in redisplay () at xdisp.c:10981
#40 0x000000000052004b in read_char (commandflag=1, nmaps=7, maps=0x7fbff82598, 
prev_event=11225106, used_mouse_menu=0x7fbff82908, 
    end_time=0x0) at keyboard.c:2729
#41 0x000000000052c55f in read_key_sequence (keybuf=0x7fbff82b30, bufsize=30, 
prompt=11225106, dont_downcase_last=0, 
    can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9557
#42 0x000000000051d133 in command_loop_1 () at keyboard.c:1645
#43 0x00000000005b82d4 in internal_condition_case (bfun=0x51cdc7 
<command_loop_1>, handlers=11288418, hfun=0x51c745 <cmd_error>)
    at eval.c:1492
#44 0x000000000051cb03 in command_loop_2 () at keyboard.c:1362
#45 0x00000000005b7c89 in internal_catch (tag=11281682, func=0x51cae8 
<command_loop_2>, arg=11225106) at eval.c:1228
#46 0x000000000051cabd in command_loop () at keyboard.c:1341
#47 0x000000000051c2aa in recursive_edit_1 () at keyboard.c:956
#48 0x000000000051c434 in Frecursive_edit () at keyboard.c:1018
#49 0x000000000051a8e2 in main (argc=1, argv=0x7fbff83418) at emacs.c:1833

Lisp Backtrace:
"file-readable-p" (0xbff7f168)
"image-search-load-path" (0xbff7f4b8)
"image-search-load-path" (0xbff7f808)
"find-image" (0xbff7faa0)
"eval" (0xbff7fda8)
0x9732e5 PVEC_COMPILED
"mapcar" (0xbff80438)
"tool-bar-make-keymap-1" (0xbff80788)
"tool-bar-make-keymap" (0xbff80a00)
"file-readable-p" (0xbff7f168)
"image-search-load-path" (0xbff7f4b8)
"image-search-load-path" (0xbff7f808)
"find-image" (0xbff7faa0)
"eval" (0xbff7fda8)
0x9732e5 PVEC_COMPILED
"mapcar" (0xbff80438)
"tool-bar-make-keymap-1" (0xbff80788)
"tool-bar-make-keymap" (0xbff80a00)




In GNU Emacs 23.2.50.3 (x86_64-unknown-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2010-11-02 on opteron0157.magma-da.com
Windowing system distributor `The XFree86 Project, Inc', version 11.0.40300000
configured using `configure  '--prefix=/home/nshi/local' '--without-makeinfo' 
'CC=gcc' 'CFLAGS=-O0 -ggdb3''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: POSIX
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US
  value of $XMODIFIERS: nil
  locale-coding-system: iso-latin-1-unix
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  yas/global-mode: t
  yas/minor-mode: t
  desktop-save-mode: t
  tabbar-mwheel-mode: t
  tabbar-mode: t
  display-time-mode: t
  show-paren-mode: t
  auto-image-file-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Features:
(shadow sort mail-extr emacsbug message sendmail ecomplete rfc822 mml
mml-sec password-cache mm-decode mm-bodies mm-encode mail-parse rfc2231
rfc2047 rfc2045 qp ietf-drums mailabbrev nnheader gnus-util netrc
time-date gmm-utils wid-edit mailheader canlock sha1 hex-util hashcash
mail-utils egg ring ffap ediff-merg ediff-diff ediff-wind ediff-help
ediff-util ediff-mult ediff-init ediff electric yasnippet-bundle
dropdown-list yasnippet assoc desktop session xgtags derived easymenu cl
cl-19 tempo url url-proxy url-privacy url-expand url-methods url-history
url-cookie url-util url-parse url-vars mm-util mail-prsvr mailcap
xml-parse doxymacs tabbar easy-mmode ido cc-styles cc-align cc-engine
cc-vars cc-defs edmacro kmacro time avoid paren uniquify advice help-fns
advice-preload regexp-opt image-file cal-china-x-autoloads
company-autoloads kill-ring-search-autoloads package reporter tooltip
ediff-hook vc-hooks lisp-float-type mwheel x-win x-dnd font-setting
tool-bar dnd fontset image fringe lisp-mode register page menu-bar
rfn-eshadow timer select scroll-bar mldrag mouse jit-lock font-lock
syntax facemenu font-core frame cham georgian utf-8-lang misc-lang
vietnamese tibetan thai tai-viet lao korean japanese hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
case-table epa-hook jka-cmpr-hook help simple abbrev loaddefs button
minibuffer faces cus-face files text-properties overlay md5 base64
format env code-pages mule custom widget hashtable-print-readable
backquote make-network-process font-render-setting x-toolkit x multi-tty
emacs)