bug#66098: Crash in itree.c on macOS with incomplete backtrace

[Stefan Kangas]

After rebuilding from master yesterday, I've started seeing frequent
crashes (several times a day) on macOS.  Thus, I re-built with all the
debug flags to investigate, and was able to get Emacs to crash almost
immediately after start, with the command `M-x notmuch'.

I'm not able to get much of a backtrace (see below).  Could it be that
the stack got corrupted somehow?  I've left the gdb session of the
crashed process open in case anyone has any ideas.  Is valgrind the best
tool for digging further, or are there any other tricks I can try?

Note the messages "Backtrace stopped: frame did not save the PC" and
"Cannot access memory at address 0x1e00000500000039".

(gdb) bt
#0  0x00000001003fb62c in itree_validate (tree=0x6000002720e0,
node=0x1e00000500000001) at itree.c:416
#1  0x00000001003fb6bd in itree_node_end (tree=0x6000002720e0,
node=0x1e00000500000001) at itree.c:462
#2  0x00000001001aded4 in terminate_due_to_signal (sig=298035829,
backtrace_limit=1) at emacs.c:447
#3  0x0000000111c3aa70 in ?? ()
#4  0x0000000111c3aa75 in ?? ()
#5  0x00007ff7bfef5210 in ?? ()
#6  0x00000001001a540d in OVERLAY_END (ov=XIL(0x111c3aa75)) at ./buffer.h:1428
Backtrace stopped: frame did not save the PC
[New Thread 0x1c37 of process 20794]

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
(gdb) bt full
#0  0x00000001003fb62c in itree_validate (tree=0x6000002720e0,
node=0x1e00000500000001) at itree.c:416
No locals.
#1  0x00000001003fb6bd in itree_node_end (tree=0x6000002720e0,
node=0x1e00000500000001) at itree.c:462
No locals.
#2  0x00000001001aded4 in terminate_due_to_signal (sig=298035829,
backtrace_limit=1) at emacs.c:447
No locals.
#3  0x0000000111c3aa70 in ?? ()
No symbol table info available.
#4  0x0000000111c3aa75 in ?? ()
No symbol table info available.
#5  0x00007ff7bfef5210 in ?? ()
No symbol table info available.
#6  0x00000001001a540d in OVERLAY_END (ov=XIL(0x111c3aa75)) at ./buffer.h:1428
No locals.
Backtrace stopped: frame did not save the PC

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
(gdb) xbacktrace
[New Thread 0x1c5b of process 20794]
[New Thread 0x1e27 of process 20794]
"redisplay_internal (C function)" (0x0)
(gdb) p tree->otick
$1 = 1
(gdb) p node->otick
Cannot access memory at address 0x1e00000500000039
(gdb) maintenance info sections
Exec file: `/Users/skangas/wip/emacs/src/emacs', file type mach-o-x86-64.
 [0]      0x100003280->0x1004ad680 at 0x00003280: .text ALLOC LOAD
CODE HAS_CONTENTS
 [1]      0x1004ad680->0x1004ae96a at 0x004ad680: __TEXT.__stubs ALLOC
LOAD READONLY CODE HAS_CONTENTS
 [2]      0x1004ae96c->0x1004b0902 at 0x004ae96c: __TEXT.__stub_helper
ALLOC LOAD READONLY CODE HAS_CONTENTS
 [3]      0x1004b0910->0x1004c6c5f at 0x004b0910: .const ALLOC LOAD
READONLY DATA HAS_CONTENTS
 [4]      0x1004c6c5f->0x10051d801 at 0x004c6c5f: .cstring ALLOC LOAD
READONLY DATA HAS_CONTENTS
 [5]      0x10051d804->0x10051d820 at 0x0051d804:
__TEXT.__gcc_except_tab ALLOC LOAD READONLY CODE HAS_CONTENTS
 [6]      0x10051d820->0x100521807 at 0x0051d820:
__TEXT.__objc_methname ALLOC LOAD READONLY CODE HAS_CONTENTS
 [7]      0x100521807->0x100521905 at 0x00521807:
__TEXT.__objc_classname ALLOC LOAD READONLY CODE HAS_CONTENTS
 [8]      0x100521905->0x100523e3f at 0x00521905:
__TEXT.__objc_methtype ALLOC LOAD READONLY CODE HAS_CONTENTS
 [9]      0x100523e40->0x100523ffc at 0x00523e40: __TEXT.__unwind_info
ALLOC LOAD READONLY CODE HAS_CONTENTS
 [10]     0x100524000->0x100524380 at 0x00524000: __DATA_CONST.__got
ALLOC LOAD DATA HAS_CONTENTS
 [11]     0x100524380->0x10052d4a8 at 0x00524380: __DATA_CONST.__const
ALLOC LOAD DATA HAS_CONTENTS
 [12]     0x10052d4a8->0x10052dee8 at 0x0052d4a8:
__DATA_CONST.__cfstring ALLOC LOAD DATA HAS_CONTENTS
 [13]     0x10052dee8->0x10052df50 at 0x0052dee8:
__DATA_CONST.__objc_classlist ALLOC LOAD DATA HAS_CONTENTS
 [14]     0x10052df50->0x10052df60 at 0x0052df50:
__DATA_CONST.__objc_catlist ALLOC LOAD DATA HAS_CONTENTS
 [15]     0x10052df60->0x10052df88 at 0x0052df60:
__DATA_CONST.__objc_protolist ALLOC LOAD DATA HAS_CONTENTS
 [16]     0x10052df88->0x10052df90 at 0x0052df88:
__DATA_CONST.__objc_imageinfo ALLOC LOAD DATA HAS_CONTENTS
 [17]     0x100530000->0x100531938 at 0x00530000:
__DATA.__la_symbol_ptr ALLOC LOAD DATA HAS_CONTENTS
 [18]     0x100531938->0x100535958 at 0x00531938: __DATA.__objc_const
ALLOC LOAD DATA HAS_CONTENTS
 [19]     0x100535958->0x100536ce0 at 0x00535958:
__DATA.__objc_selrefs ALLOC LOAD DATA HAS_CONTENTS
 [20]     0x100536ce0->0x100536f20 at 0x00536ce0:
__DATA.__objc_classrefs ALLOC LOAD DATA HAS_CONTENTS
 [21]     0x100536f20->0x100536f78 at 0x00536f20:
__DATA.__objc_superrefs ALLOC LOAD DATA HAS_CONTENTS
 [22]     0x100536f78->0x1005371b0 at 0x00536f78: __DATA.__objc_ivar
ALLOC LOAD DATA HAS_CONTENTS
 [23]     0x1005371b0->0x1005375c0 at 0x005371b0: __DATA.__objc_data
ALLOC LOAD DATA HAS_CONTENTS
 [24]     0x1005375c0->0x10054acd0 at 0x005375c0: __DATA.subrs ALLOC
LOAD DATA HAS_CONTENTS
 [25]     0x10054acd0->0x100aed21c at 0x0054acd0: .data ALLOC LOAD
DATA HAS_CONTENTS
 [26]     0x100aed220->0x100b32b74 at 0x00000000: .bss ALLOC
 [27]     0x100b32b80->0x100b9ba78 at 0x00000000: __DATA.__common ALLOC
(gdb)


In GNU Emacs 30.0.50 (build 3, x86_64-apple-darwin21.6.0, NS
 appkit-2113.60 Version 12.6.9 (Build 21G726)) of 2023-09-18 built on
 MY-MacBook-Pro
Repository revision: 861f9cb78370e2b78f852e5ccde9b63c94486ca8
Repository branch: master
Windowing system distributor 'Apple', version 10.3.2113
System Description:  macOS 12.6.9

Configured using:
 'configure --enable-checking=yes,glyphs --enable-check-lisp-object-type
 'CFLAGS=-O0 -g3''

Configured features:
ACL GIF GMP GNUTLS JPEG JSON LCMS2 LIBXML2 MODULES NOTIFY KQUEUE NS
PDUMPER PNG SQLITE3 THREADS TIFF TOOLKIT_SCROLL_BARS TREE_SITTER WEBP
XIM ZLIB

Important settings:
  value of $LC_COLLATE: C
  value of $LC_CTYPE: sv_SE.UTF-8
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Message

Minor modes in effect:
  midnight-mode: t
  yas-global-mode: t
  yas-minor-mode: t
  openwith-mode: t
  recentf-mode: t
  flyspell-mode: t
  global-company-mode: t
  company-mode: t
  global-git-commit-mode: t
  magit-auto-revert-mode: t
  marginalia-mode: t
  repeat-mode: t
  pyvenv-mode: t
  org-super-agenda-mode: t
  ivy-mode: t
  dired-async-mode: t
  mml-mode: t
  auto-insert-mode: t
  server-mode: t
  winum-mode: t
  winner-mode: t
  which-key-mode: t
  engine-mode: t
  beacon-mode: t
  override-global-mode: t
  global-hl-line-mode: t
  savehist-mode: t
  save-place-mode: t
  display-time-mode: t
  auto-image-file-mode: t
  ns-auto-titlebar-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  context-menu-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  minibuffer-regexp-mode: t
  column-number-mode: t
  line-number-mode: t
  auto-fill-function: yas--auto-fill
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  auto-save-visited-mode: t
  abbrev-mode: t

Load-path shadows:
/Users/skangas/.emacs.d/elpa/elsa-20230621.1005/Elsafile hides
/Users/skangas/.emacs.d/elpa/trinary-20230301.2044/Elsafile
/Users/skangas/.emacs.d/elpa/transient-20230812.2142/transient hides
/Users/skangas/wip/emacs/lisp/transient
/Users/skangas/.emacs.d/elpa/ef-themes-1.3.0/theme-loaddefs hides
/Users/skangas/wip/emacs/lisp/theme-loaddefs

Features:
(shadow sort emacsbug tramp-cmds mail-extr tabify easy-kill executable
time-stamp ffap tramp trampver tramp-integration tramp-message
tramp-compat parse-time iso8601 tramp-loaddefs diary-lib diary-loaddefs
midnight yasnippet-snippets yasnippet paredit openwith orderless recentf
tree-widget log-view vc bug-reference macrostep-c cmacexp macrostep
flyspell ispell rainbow-delimiters elide-head ws-butler cc-mode cc-fonts
cc-guess cc-menus cc-cmds cc-styles cc-align cc-engine cc-vars cc-defs
company-oddmuse company-keywords company-etags etags fileloop
company-gtags company-dabbrev-code company-dabbrev company-files
company-capf company-cmake company-xcode company-clang company-semantic
company-eclim company-template company-bbdb company face-remap
magit-bookmark magit-submodule magit-blame magit-stash magit-reflog
magit-bisect magit-push magit-pull magit-fetch magit-clone magit-remote
magit-commit magit-sequence magit-notes magit-worktree magit-tag
magit-merge magit-branch magit-reset magit-files magit-refs magit-status
magit magit-repos magit-apply magit-wip magit-log which-func imenu
magit-diff smerge-mode diff git-commit log-edit pcvs-util add-log
magit-core magit-autorevert autorevert filenotify magit-margin
magit-transient magit-process with-editor magit-mode transient magit-git
magit-base magit-section cursor-sensor crm marginalia compat repeat
pixel-scroll cua-base sk-misc pcase sk-idom-article-length sk-lisp
init-python pyvenv init-lang-perl init-lang-elisp init-lang-cpp
init-lang-c init-coding-common init-org-mode org-super-agenda ts ht
org-habit org-agenda ol-man org-tempo tempo org-protocol ob-restclient
restclient ob-shell shell init-mail init-mentor init-ivy counsel xref
project compile swiper ivy delsel ivy-faces ivy-overlay colir color flx
init-hydra init-elfeed elfeed-org s org-element org-persist xdg org-id
org-refile org ob ob-tangle ob-ref ob-lob ob-table ob-exp org-macro
org-src ob-comint org-pcomplete org-list org-footnote org-faces
org-entities noutline outline ob-emacs-lisp ob-core ob-eval org-cycle
org-table ol org-fold org-fold-core org-keys oc org-loaddefs find-func
org-version org-compat org-macs elfeed-show elfeed-search vc-git
diff-mode vc-dispatcher bookmark message sendmail yank-media dired-async
dired-aux async dired dired-loaddefs rfc822 mml mml-sec epa derived epg
rfc6068 epg-config gnus-util mm-decode mm-bodies mm-encode mail-parse
rfc2231 rfc2047 rfc2045 mm-util ietf-drums mail-prsvr mailabbrev
mail-utils gmm-utils mailheader shr text-property-search pixel-fill
kinsoku puny svg dom elfeed-csv elfeed elfeed-curl elfeed-log elfeed-db
elfeed-lib time-date thingatpt avl-tree url-queue url-file xml-query xml
hydra lv init-auto-insert-mode skeleton autoinsert init-keybindings
init-emacs-server server init-compat init-general winum dash winner
which-key ibuf-macs eshell esh-cmd generator esh-ext esh-opt esh-proc
esh-io esh-arg pcomplete comint ansi-osc ring esh-module esh-groups
esh-util files-x engine-mode format-spec rx cus-edit pp cus-load icons
wid-edit two-column finder-inf beacon edmacro kmacro
use-package-bind-key bind-key easy-mmode use-package-diminish
sv-kalender advice lunar solar cal-dst holidays holiday-loaddefs
cal-menu calendar cal-loaddefs hl-line savehist saveplace time
image-file image-converter ansi-color init-portability ns-auto-titlebar
exec-path-from-shell modus-operandi-theme modus-themes diminish cl-extra
help-mode use-package-ensure use-package-core package browse-url url
url-proxy url-privacy url-expand url-methods url-history url-cookie
generate-lisp-file url-domsuf url-util mailcap url-handlers url-parse
auth-source cl-seq eieio eieio-core cl-macs password-cache json subr-x
map byte-opt gv bytecomp byte-compile url-vars cl-loaddefs cl-lib info
ag-autoloads aggressive-indent-autoloads auto-virtualenv-autoloads
avy-autoloads beacon-autoloads blacken-autoloads boxquote-autoloads
browse-kill-ring-autoloads company-autoloads counsel-autoloads
debbugs-autoloads default-text-scale-autoloads diff-hl-autoloads
diminish-autoloads dired-collapse-autoloads dired-hacks-utils-autoloads
dired-single-autoloads diredfl-autoloads discover-my-major-autoloads
docker-compose-mode-autoloads dockerfile-mode-autoloads
doom-themes-autoloads easy-kill-autoloads ef-themes-autoloads
el-search-autoloads elfeed-org-autoloads elfeed-autoloads elsa-autoloads
async-autoloads ansi-autoloads embark-autoloads engine-mode-autoloads
exec-path-from-shell-autoloads flx-autoloads flymake-easy-autoloads
flymake-ruff-autoloads geiser-autoloads haskell-mode-autoloads
hydra-autoloads idle-highlight-mode-autoloads iedit-autoloads
inf-ruby-autoloads ioccur-autoloads know-your-http-well-autoloads
lgr-autoloads lsp-mode-autoloads f-autoloads lv-autoloads
macrostep-autoloads magit-autoloads git-commit-autoloads makey-autoloads
marginalia-autoloads markdown-mode-autoloads multiple-cursors-autoloads
nameless-autoloads nov-autoloads esxml-autoloads kv-autoloads
ns-auto-titlebar-autoloads nyan-mode-autoloads ob-restclient-autoloads
openwith-autoloads orderless-autoloads org-journal-autoloads
org-modern-autoloads org-roam-autoloads magit-section-autoloads
emacsql-autoloads org-super-agenda-autoloads ht-autoloads
package-lint-autoloads paredit-autoloads php-mode-autoloads
pip-requirements-autoloads python-docstring-autoloads pyvenv-autoloads
rainbow-delimiters-autoloads restclient-autoloads ripgrep-autoloads
smartscan-autoloads spinner-autoloads sql-indent-autoloads
stream-autoloads swiper-autoloads ivy-autoloads toml-mode-autoloads
transient-autoloads trinary-autoloads ts-autoloads s-autoloads
undo-tree-autoloads queue-autoloads visual-fill-column-autoloads
web-mode-autoloads wgrep-autoloads which-key-autoloads winum-autoloads
dash-autoloads with-editor-autoloads compat-autoloads
writegood-mode-autoloads ws-butler-autoloads xml-rpc-autoloads
xr-autoloads yaml-mode-autoloads yasnippet-snippets-autoloads
yasnippet-autoloads rmc iso-transl tooltip cconv eldoc paren electric
uniquify ediff-hook vc-hooks lisp-float-type elisp-mode mwheel
term/ns-win ns-win ucs-normalize mule-util term/common-win touch-screen
tool-bar dnd fontset image regexp-opt fringe tabulated-list replace
newcomment text-mode lisp-mode prog-mode register page tab-bar menu-bar
rfn-eshadow isearch easymenu timer select scroll-bar mouse jit-lock
font-lock syntax font-core term/tty-colors frame minibuffer nadvice seq
simple cl-generic indonesian philippine cham georgian utf-8-lang
misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms
cp51932 hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese composite emoji-zwj charscript charprop case-table
epa-hook jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button
loaddefs theme-loaddefs faces cus-face macroexp files window
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget keymap hashtable-print-readable backquote threads kqueue
cocoa ns lcms2 multi-tty make-network-process emacs)

Memory information:
((conses 16 666326 475097) (symbols 48 43608 59) (strings 32 201523 17492)
 (string-bytes 1 5944970) (vectors 16 73529) (vector-slots 8 981609 158728)
 (floats 8 882 6143) (intervals 56 10864 472) (buffers 992 19))