Thanks, Maritn! I have now compiled emacs with your patch, and with --enable-checking, and will let you know if I get a hit.
I got another crash (before compiling with Martin's patch and without --enable-checking, but with Pip's patch and -fno-tree-sra). I got the crash after rapidly pressing 2 keystrokes. I am not sure exactly which keystrokes, but I think it was ' followed by Del. It could be completely unrelated to this bug, but the trace seems pretty weird, as the m pointer represents ASCII text for "ganap/u/", which is the reversed start of my home directory "/u/panagopo". Could it be that we have some sort of memory corruption that is throwing us in different directions?
In any case, I will try to find a reproducer for this. Here is the trace:
Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
adjust_markers_for_insert (from=11354, from_byte=11354, to=11355, to_byte=11355, before_markers=before_markers@entry=false) at insdel.c:301
warning: 301 insdel.c: No such file or directory
(gdb) bt full
#0 adjust_markers_for_insert (from=11354, from_byte=11354, to=11355, to_byte=11355, before_markers=before_markers@entry=false) at insdel.c:301
m = 0x67616e61702f752f
nchars = 1
nbytes = 1
#1 0x000000000055660c in insert_1_both (string=string@entry=0x7fffffffdac3 "t\377\177", nchars=nchars@entry=1, nbytes=nbytes@entry=1, inherit=inherit@entry=true, prepare=prepare@entry=true, before_markers=before_markers@entry=false) at insdel.c:935
No locals.
#2 0x00000000005574d8 in insert_and_inherit (string=string@entry=0x7fffffffdac3 "t\377\177", nbytes=nbytes@entry=1) at insdel.c:694
len = 1
opoint = <optimized out>
#3 0x000000000056b3f4 in internal_self_insert (c=116, n=n@entry=1) at cmds.c:475
hairy = 1
tem = <optimized out>
synt = <optimized out>
overwrite = <optimized out>
len = 1
str = "t\377\177\000"
chars_to_delete = 0
spaces_to_insert = 0
#4 0x000000000056b4f7 in Fself_insert_command (n=<optimized out>, c=0x1d2) at cmds.c:297
character = <optimized out>
val = <optimized out>
#5 0x00000000005aa44b in funcall_subr (subr=subr@entry=0xc6ea40 <Sself_insert_command>, numargs=numargs@entry=2, args=args@entry=0x7fffffffddd0) at eval.c:3168
argbuf = {0x7fffffffdbf0, 0x5d4359 <read0+4885>, 0x15553b93d160 <d_reloc>, 0x100, 0x0, 0xd08be0 <lispsym+77952>, 0x30, 0xe0}
a = <optimized out>
maxargs = 2
keepalive = 0xc6ea45 <Sself_insert_command+5>
ret = <optimized out>
fun = <optimized out>
#6 0x00000000005abdeb in funcall_general (fun=0xc6ea45 <Sself_insert_command+5>, numargs=numargs@entry=2, args=args@entry=0x7fffffffddd0) at /build/source/src/lisp.h:2243
original_fun = 0x10770
#7 0x00000000005a903e in Ffuncall (nargs=nargs@entry=3, args=args@entry=0x7fffffffddc8) at eval.c:3093
count = {bytes = 256}
val = <optimized out>
#8 0x00000000005a4b51 in Ffuncall_interactively (nargs=3, args=0x7fffffffddc8) at callint.c:250
speccount = <optimized out>
#9 0x00000000005aa540 in funcall_subr (subr=subr@entry=0xc754c0 <Sfuncall_interactively>, numargs=numargs@entry=3, args=args@entry=0x7fffffffddc8) at eval.c:3198
maxargs = -2
keepalive = 0xc754c5 <Sfuncall_interactively+5>
ret = <optimized out>
fun = <optimized out>
#10 0x00000000005abdeb in funcall_general (fun=0xc754c5 <Sfuncall_interactively+5>, numargs=numargs@entry=3, args=args@entry=0x7fffffffddc8) at /build/source/src/lisp.h:2243
original_fun = 0x9510
#11 0x00000000005a903e in Ffuncall (nargs=nargs@entry=4, args=args@entry=0x7fffffffddc0) at eval.c:3093
count = {bytes = 192}
val = <optimized out>
#12 0x00000000005a94e2 in Fapply (nargs=nargs@entry=3, args=args@entry=0x7fffffffdf40) at eval.c:2765
i = 4
funcall_nargs = 4
funcall_args = 0x7fffffffddc0
spread_arg = 0x0
fun = <optimized out>
sa_avail = <optimized out>
sa_count = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--c
numargs = <optimized out>
retval = <optimized out>
#13 0x00000000005a535b in Fcall_interactively (function=0x10770, record_flag=0x0, keys=0x364076d) at callint.c:342
funval = <optimized out>
events = <optimized out>
env = <optimized out>
speccount = <optimized out>
arg_from_tty = false
key_count = 1
record_then_fail = false
save_this_command = 0x10770
save_this_original_command = 0x10770
save_real_this_command = 0x10770
save_last_command = 0x15554e3484b0
prefix_arg = 0x0
enable = 0x0
up_event = 0x0
form = <optimized out>
specs = 0x35ad6e13
sa_avail = <optimized out>
sa_count = <optimized out>
string_len = <optimized out>
string = <optimized out>
string_end = <optimized out>
next_event = <optimized out>
nargs = <optimized out>
args = <optimized out>
visargs = <optimized out>
varies = <optimized out>
tem = <optimized out>
val = <optimized out>
#14 0x000015554e73a93d in F636f6d6d616e642d65786563757465_command_execute_0 () from /nix/store/cs45kvg1k756hvp50xvxspixr7gfv1im-emacs-30.1/bin/../lib/emacs/30.1/native-lisp/30.1-4f74827b/preloaded/simple-fab5b0cf-4a9a0458.eln
No symbol table info available.
#15 0x00000000005aa47b in funcall_subr (subr=subr@entry=0x15554f51d4b8, numargs=numargs@entry=1, args=args@entry=0x7fffffffe1c8) at eval.c:3174
argbuf = {0x10770, 0x0, 0x0, 0x0, 0x401d4c0, 0x607166 <start_atimer+161>, 0x0, 0x4054b15}
a = <optimized out>
maxargs = 4
keepalive = 0x15554f51d4bd
ret = <optimized out>
fun = <optimized out>
#16 0x00000000005abdeb in funcall_general (fun=0x15554f51d4bd, numargs=numargs@entry=1, args=args@entry=0x7fffffffe1c8) at /build/source/src/lisp.h:2243
original_fun = 0x5b80
#17 0x00000000005a903e in Ffuncall (nargs=nargs@entry=2, args=args@entry=0x7fffffffe1c0) at eval.c:3093
count = {bytes = 128}
val = <optimized out>
#18 0x000000000053aeac in command_loop_1 () at keyboard.c:1550
scount = <optimized out>
cmd = <optimized out>
keybuf = {0x1d2, 0x2e, 0xfa2, 0x5982d3 <set_default_internal+530>, 0x7fffffffe260, 0x2, 0x30, 0x929cedd, 0x0, 0x5a770f <do_one_unbind+319>, 0x9723cd60, 0x60, 0x0, 0x0, 0x0, 0x5a8d59 <unbind_to+105>, 0xb, 0x111c0, 0x30, 0x929cedd, 0x7bc0, 0x105ecaab80e9e00, 0xcf32a0 <globals>, 0x1ca924f3, 0x60,
0x52f4c6 <cmd_error+363>, 0x0, 0x105ecaab80e9e00, 0x60, 0x15554edf4d83}
i = <optimized out>
last_pt = 11354
prev_modiff = 387358
prev_buffer = 0x4054b10
#19 0x00000000005a7e25 in internal_condition_case (bfun=bfun@entry=0x53a9ce <command_loop_1>, handlers=handlers@entry=0x90, hfun=hfun@entry=0x52f35b <cmd_error>) at eval.c:1613
val = <optimized out>
c = 0xe0fc60
#20 0x00000000005292ae in command_loop_2 (handlers=handlers@entry=0x90) at keyboard.c:1168
val = <optimized out>
#21 0x00000000005a7d42 in internal_catch (tag=tag@entry=0x122d0, func=func@entry=0x529294 <command_loop_2>, arg=arg@entry=0x90) at eval.c:1292
val = <optimized out>
c = 0xea0f40
#22 0x000000000052926b in command_loop () at keyboard.c:1146
No locals.
#23 0x000000000052eec4 in recursive_edit_1 () at keyboard.c:754
count = <optimized out>
val = <optimized out>
#24 0x000000000052f25c in Frecursive_edit () at keyboard.c:837
count = <optimized out>
buffer = <optimized out>
#25 0x0000000000528660 in main (argc=<optimized out>, argv=0x7fffffffe5a8) at emacs.c:2635
stack_bottom_variable = 0x155553f84458 <_gnutls_lib_state>
old_argc = <optimized out>
dump_file = 0x0
no_loadup = false
junk = 0x0
dname_arg = 0x0
ch_to_dir = 0x0
original_pwd = 0x0
dump_mode = <optimized out>
skip_args = 1
temacs = 0x0
attempt_load_pdump = <optimized out>
only_version = false
rlim = {rlim_cur = 18446744073709551615, rlim_max = 18446744073709551615}
lc_all = <optimized out>
sockfd = -1
module_assertions = <optimized out>
(gdb) p *(struct Lisp_Marker *) m
Cannot access memory at address 0x67616e61702f752f