Dear Emacs maintainers,

I've just built Emacs from commit 
4bb27a5ca93f8269d9cd4b85fd948176304236eb on the emacs-29 branch and it 
fails to launch with the following message when loading my init.el 
file: -

free(): invalid pointer
Fatal error 6: Aborted

Launching with -q or -Q works fine. Checking out a previous commit 
(cc30422825a5acf460d026bfe912b327b70dedcf) and rebuilding causes 
everything to work as expected again too.

I've tried `make extraclean` and then `make bootstrap` in order to 
clear out any old byte-compiled or native-compiled elisp as I read 
another message earlier saying that a recent change might have caused 
a backwards incompatible change.

Output of `bt full` in GDB: -

#0  0x00007ffff34a08ec in  () at /usr/lib/libc.so.6
#1  0x00007ffff3451ea8 in raise () at /usr/lib/libc.so.6
#2  0x00007ffff343b53d in abort () at /usr/lib/libc.so.6
#3  0x00007ffff343c29e in  () at /usr/lib/libc.so.6
#4  0x00007ffff34aa657 in  () at /usr/lib/libc.so.6
#5  0x00007ffff34ac4bc in  () at /usr/lib/libc.so.6
#6  0x00007ffff34aee63 in free () at /usr/lib/libc.so.6
#7  0x0000555555741685 in xfree (block=<optimized out>) at alloc.c:814
#8  0x000055555577163c in safe_free (sa_count=...) at 
 /storage/Work/personal/emacs/src/lisp.h:5385
        arg_vector = 0x7fffffffcf40
        tem = 0x0
        sa_avail = <optimized out>
        sa_count = {bytes = 1280}
        numargs = 0
        args_left = <optimized out>
#9  apply_lambda (fun=0x55555c64b685, args=<optimized out>, count=...) 
 at eval.c:3109
        arg_vector = 0x7fffffffcf40
        tem = 0x0
        sa_avail = <optimized out>
        sa_count = {bytes = 1280}
        numargs = 0
        args_left = <optimized out>
#10 0x000055555576f922 in eval_sub (form=<optimized out>) at 
 eval.c:2588
        original_fun = 0xd49110
        original_args = 0x0
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x0, 0x555556020633, 0x1, 0x7fffffffd090, 0x2, 
        0x555555779da3 <mapcar1+115>, 0x7fffffffd0a0, 0x2aaa992060c0}
#11 0x0000555555772511 in internal_lisp_condition_case (var=0xfa3690, 
 bodyform=0x55555c2d8383, handlers=<optimized out>) at eval.c:1428
        oldhandlerlist = 0x555555ee3560
        clausenb = 1
        success_handler = 0x0
        clauses = 0x7fffffffd080
        result = 0x555555dc3460 <freloc>
#12 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d7193
        numargs = 3
        original_fun = 0x4f80
        original_args = 0x55555c2d7193
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x4a0, 0x7fffffffd1a8, 0x7fffffffd1a0, 
        0xffe12e80bef3ce00, 0x6, 0x0, 0x1, 0x55555c2d9b95}
#13 0x00005555557702ad in Fprogn (body=0x55555c2d7b93) at eval.c:436
        form = <optimized out>
        val = 0x0
#14 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d71c3
        numargs = 2
        original_fun = 0xd620
        original_args = 0x55555c2d71c3
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x5555560207c3, 0xffe12e80bef3ce00, 
        0x4000000011000000, 0x55555c2d78f3, 0x7fffffffd300, 
        0x55555576ffba <eval_sub+2266>, 0x1, 0x55555c2d7ff0}
#15 0x0000555555772511 in internal_lisp_condition_case (var=0xfa3690, 
 bodyform=0x55555c2d71b3, handlers=<optimized out>) at eval.c:1428
        oldhandlerlist = 0x555555ffbd30
        clausenb = 1
        success_handler = 0x0
        clauses = 0x7fffffffd2b0
        result = 0x55555575901b <Fset_default+11>
#16 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d6c53
        numargs = 3
        original_fun = 0x4f80
        original_args = 0x55555c2d6c53
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x4, 0x55555576c480 <Fapply+256>, 0x7fffef2bd695, 
        0xffe12e80bef3ce00, 0x55555c2cd0e3, 0x2, 0x4c0, 
        0x7fffffffd408}
#17 0x00005555557702ad in Fprogn (body=0x0) at eval.c:436
        form = <optimized out>
        val = 0x6524060
#18 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d6c83
        numargs = 2
        original_fun = 0xd620
        original_args = 0x55555c2d6c83
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x11, 0x1, 0xb, 0x2aaa994558c0, 0x0, 0x2, 
        0x55555c2d8333, 0x555555dc3460 <freloc>}
#19 0x00005555557702ad in Fprogn (body=0x0) at eval.c:436
        form = <optimized out>
        val = 0x0
#20 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d6cb3
        numargs = 1
        original_fun = 0xd620
        original_args = 0x55555c2d6cb3
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x55555c2d8333, 0x7fffeecdd4b9 
        <F696e7465726e616c2d6d6163726f657870616e642d666f722d6c6f6164_internal_macroexpand_for_load_0+233>, 
        0x7fffffff006c, 0x555555dc3460 <freloc>, 0x55555c2d7c23, 
        0xffe12e80bef3ce00, 0x55555c2d6cc3, 0x55555c2d6cd3}
#21 0x000055555576ffba in eval_sub (form=<optimized out>) at 
 eval.c:2449
        args_left = 0x55555c2d6cd3
        numargs = 2
        original_fun = 0x9000
        original_args = 0x55555c2d6cd3
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x2aaa99603200, 0x555556024e88, 0x0, 0x5555557979b8 
        <readevalloop_eager_expand_eval+376>, 0x0, 0xffe12e80bef3ce00, 
        0x2aaa99603200, 0x55555c2d7c23}
#22 0x00005555557a0009 in readevalloop (readcharfun=0x555556024e8d, 
 infile0=0x0, sourcename=0x555556030204, printflag=false, 
 unibyte=<optimized out>, readfun=0x0, start=0x0, end=<optimized out>) 
 at lread.c:2347
        c = <optimized out>
        val = 0x55555c2d8333
        b = <optimized out>
        continue_reading_p = true
        lex_bound = <optimized out>
        whole_buffer = true
        first_sexp = <optimized out>
        macroexpand = 0x2aaa99603200
#23 0x00005555557a12c7 in Feval_buffer (buffer=<optimized out>, 
 printflag=0x0, filename=0x555556030204, unibyte=0x0, 
 do_allow_print=<optimized out>) at lread.c:2420
        tem = <optimized out>
        buf = 0x555556024e8d
#24 0x00007fffeeadb478 in 
 F6c6f61642d776974682d636f64652d636f6e76657273696f6e_load_with_code_conversion_0 
 () at 
 /storage/Work/personal/emacs/src/../native-lisp/29.0.60-349da14f/preloaded/mule-3352613d-1fec1ce7.eln
#25 0x000055555576c266 in Ffuncall (nargs=nargs@entry=5, 
 args=args@entry=0x7fffffffd9c0) at eval.c:2995
        val = <optimized out>
#26 0x00005555557a0f07 in call4 (arg4=0x30, arg3=<optimized out>, 
 arg2=0x555556030204, arg1=<optimized out>, fn=<optimized out>) at 
 /storage/Work/personal/emacs/src/lisp.h:3269
        val = <optimized out>
        stream = 0x0
        fd = 19
        found = 0x555556030204
        efound = <optimized out>
        hist_file_name = 0x555556030204
        newer = false
        compiled = false
        handler = <optimized out>
        fmode = 0x55555585a19c "r"
        version = <optimized out>
        no_native = <optimized out>
        is_module = false
        is_native_elisp = false
        found_eff = <optimized out>
        is_elc = false
        input = {stream = 0x0, lookahead = 0 '\000', buf = 
        "\000\000\000"}
#27 Fload (file=0x555556030084, noerror=<optimized out>, 
 nomessage=<optimized out>, nosuffix=<optimized out>, 
 must_suffix=<optimized out>) at lread.c:1484
        val = <optimized out>
        stream = 0x0
        fd = 19
        found = 0x555556030204
        efound = <optimized out>
        hist_file_name = 0x555556030204
        newer = false
        compiled = false
        handler = <optimized out>
        fmode = 0x55555585a19c "r"
        version = <optimized out>
        no_native = <optimized out>
        is_module = false
        is_native_elisp = false
        found_eff = <optimized out>
        is_elc = false
        input = {stream = 0x0, lookahead = 0 '\000', buf = 
        "\000\000\000"}
#28 0x000055555576c266 in Ffuncall (nargs=4, args=0x7fffffffdb20) at 
 eval.c:2995
        val = <optimized out>
#29 0x00007fffeeb05276 in 
 F737461727475702d2d6c6f61642d757365722d696e69742d66696c65_startup__load_user_init_file_0 
 () at 
 /storage/Work/personal/emacs/src/../native-lisp/29.0.60-349da14f/preloaded/startup-bbc6ea72-476504a2.eln
#30 0x000055555576c266 in Ffuncall (nargs=4, args=0x7fffffffdc10) at 
 eval.c:2995
        val = <optimized out>
#31 0x00007fffeeb07268 in F636f6d6d616e642d6c696e65_command_line_0 () 
 at 
 /storage/Work/personal/emacs/src/../native-lisp/29.0.60-349da14f/preloaded/startup-bbc6ea72-476504a2.eln
#32 0x000055555576c266 in Ffuncall (nargs=1, args=0x7fffffffdce8) at 
 eval.c:2995
        val = <optimized out>
#33 0x00007fffeeb03460 in 
 F6e6f726d616c2d746f702d6c6576656c_normal_top_level_0 () at 
 /storage/Work/personal/emacs/src/../native-lisp/29.0.60-349da14f/preloaded/startup-bbc6ea72-476504a2.eln
#34 0x000055555576ffaf in eval_sub (form=<optimized out>) at 
 eval.c:2495
        i = <optimized out>
        maxargs = <optimized out>
        args_left = <optimized out>
        numargs = 0
        original_fun = 0x2aaa993b5180
        original_args = 0x0
        fun = <optimized out>
        val = <optimized out>
        funcar = <optimized out>
        argvals = {0x7fffffffde00, 0x555555edff73, 0x555555dc3460 
        <freloc>, 0x0, 0x7fffffffddf8, 0x7fffffffde78, 0x7fffffffde70, 
        0x555555dc3460 <freloc>}
#35 0x0000555555772726 in Feval (form=0x7fffef5695ab, 
 lexical=<optimized out>) at eval.c:2361
#36 0x000055555576a8f7 in internal_condition_case 
 (bfun=bfun@entry=0x5555556da400 <top_level_2>, 
 handlers=handlers@entry=0x90, hfun=hfun@entry=0x5555556e19e0 
 <cmd_error>) at eval.c:1474
        val = <optimized out>
        c = 0x5555560490c0
#37 0x00005555556dad86 in top_level_1 (ignore=ignore@entry=0x0) at 
 keyboard.c:1141
#38 0x000055555576a851 in internal_catch (tag=tag@entry=0x10050, 
 func=func@entry=0x5555556dad60 <top_level_1>, arg=arg@entry=0x0) at 
 eval.c:1197
        val = <optimized out>
        c = 0x55555604ae00
#39 0x00005555556da37f in command_loop () at keyboard.c:1101
#40 0x00005555556e1562 in recursive_edit_1 () at keyboard.c:711
        val = <optimized out>
#41 0x00005555556e18f0 in Frecursive_edit () at keyboard.c:794
        buffer = <optimized out>
#42 0x00005555555aca5f in main (argc=1, argv=0x7fffffffe1b8) at 
 emacs.c:2529
        stack_bottom_variable = 0x555555e37a40
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>
        dump_mode = <optimized out>
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>


In GNU Emacs 29.0.60 (build 1, x86_64-pc-linux-gnu, GTK+ Version
 3.24.36, cairo version 1.17.8) of 2023-02-14 built on palenque
Repository revision: 4bb27a5ca93f8269d9cd4b85fd948176304236eb
Repository branch: emacs-29
Windowing system distributor 'The X.Org Foundation', version 
11.0.12101007
System Description: Arch Linux

Configured using:
 'configure --with-native-compilation --with-json --with-modules
 --with-tree-sitter --with-xinput2'

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ 
JPEG
JSON LCMS2 LIBOTF LIBSYSTEMD LIBXML2 M17N_FLT MODULES NATIVE_COMP 
NOTIFY
INOTIFY PDUMPER PNG RSVG SECCOMP SOUND SQLITE3 THREADS TIFF
TOOLKIT_SCROLL_BARS TREE_SITTER WEBP X11 XDBE XIM XINPUT2 XPM GTK3 
ZLIB

Important settings:
  value of $LC_CTYPE: en_GB.UTF-8
  value of $LANG: en_GB.UTF-8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  line-number-mode: t
  indent-tabs-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message mailcap yank-media puny dired
dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg 
rfc6068
epg-config gnus-util text-property-search time-date mm-decode 
mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail
rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils comp 
comp-cstr
warnings icons subr-x rx cl-seq cl-macs gv cl-extra help-mode
cl-loaddefs cl-lib bytecomp byte-compile rmc iso-transl tooltip cconv
eldoc paren electric uniquify ediff-hook vc-hooks lisp-float-type
elisp-mode mwheel term/x-win x-win term/common-win x-dnd tool-bar dnd
fontset image regexp-opt fringe tabulated-list replace newcomment
text-mode lisp-mode prog-mode register page tab-bar menu-bar 
rfn-eshadow
isearch easymenu timer select scroll-bar mouse jit-lock font-lock 
syntax
font-core term/tty-colors frame minibuffer nadvice seq simple 
cl-generic
indonesian philippine cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew 
greek
romanian slovak czech european ethiopic indian cyrillic chinese
composite emoji-zwj charscript charprop case-table epa-hook
jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button 
loaddefs
theme-loaddefs faces cus-face macroexp files window text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget 
keymap
hashtable-print-readable backquote threads dbusbind inotify lcms2
dynamic-setting system-font-setting font-render-setting cairo
move-toolbar gtk x-toolkit xinput2 x multi-tty make-network-process
native-compile emacs)

Memory information:
((conses 16 98683 13034)
 (symbols 48 7145 0)
 (strings 32 28345 2128)
 (string-bytes 1 897813)
 (vectors 16 21940)
 (vector-slots 8 378753 18583)
 (floats 8 43 45)
 (intervals 56 219 0)
 (buffers 984 11))