Subject: bug#30931: 27.0.50; Crash in "Automatic GC"

From: Michał Kondraciuk <[email-masked]>
Date: Wed, 28 Mar 2018 23:02:40 +0200

I don't know if it helps, but I was able to reproduce a crash in the 
same place (mark_object()) with bare Emacs, however only in 27.0.50.

I have no idea what this code does at all. The way I wrote this is I 
kept rerunning the previous recipe but each time I commented out some
part of yasnippet.el library. If Emacs crashed, I kept the change, 
otherwise I uncommented those parts and focused on another region, and 
so on until I was left with very simple functions. I hope someone can 
confirm that it crashes.

(progn
   (require 'cl-lib)
   (defvar overlays nil)

   (defun on-overlay-modification (&rest args)
     (push nil buffer-undo-list))

   (defun crash ()
     (save-restriction
       (narrow-to-region 1 1)

       (let (start end field)
         (goto-char 2)
         (insert " 123aaaa")
         (narrow-to-region 2 5)

         (setq start (set-marker (make-marker) 2))
         (setq end (set-marker (make-marker) 3))
         (indent-according-to-mode)

         (sit-for 0)
         (cond (overlays
                (move-overlay (nth 1 overlays) end (1+ end)))
               (t
                (setq overlays
                      (list (make-overlay (1- start) start nil t nil)
                            (make-overlay end (1+ end) nil t nil)))
                (dolist (ov (list (make-overlay (1- start) start nil t nil)
                            (make-overlay end (1+ end) nil t nil)))
                  (overlay-put ov 'modification-hooks 
'(on-overlay-modification))))))))

   (with-current-buffer "*scratch*"
     (let ((buffer-undo-list t))
       (while t
         (erase-buffer)
         (crash)))))