Subject: bug#78444: 30.1; Crash in GC (vector_marked_p)

From: Eli Zaretskii <[email-masked]>
Date: Fri, 16 May 2025 09:47:13 +0300

> From: George P <[email-masked]>
> Date: Thu, 15 May 2025 14:45:09 -0400
> 
> I am experiencing crashes during GC, and I have no idea what causes these crashes or how to reproduce
> them consistently.

Can you describe what you were doing at the time of the crash?

> I have posted another crash without debugging symbols in
> https://lists.gnu.org/archive/html/emacs-devel/2024-11/msg00724.html. This time, I was running emacs in
> gdb, the trace is below. Seems to be related to bug#38936.

I'm not sure this is related to bug#38936: that one seemed to be
fixed, and there's no process_mark_stack in the backtrace there.  But
maybe this is indeed the same problem.

> (gdb) bt full
> #0  vector_marked_p (v=v@entry=0x4000000023000008) at alloc.c:4273

Please show the details of 'v'.  Like this:

  (gdb) frame 0
  (gdb) p v
  (gdb) p/x v->header

Also, you've elided the part where GDB says what fatal signal was
delivered.  I'm guessing it was SIGSEGV, but please show that part of
what GDB displayed when it kicked in.

Please keep the crashed session inside GDB in case we want you to look
around and report more data.

> #105 0x00000000005a903e in Ffuncall (nargs=1, args=0x7fffffffd188) at eval.c:3093
>         count = {bytes = 384}
>         val = <optimized out>
> #106 0x000015553995b5ea in
> F67636d682d69646c652d676172626167652d636f6c6c656374_gcmh_idle_garbage_collect_0 () from
> /u/panagopo/.config/emacs/.local/cache/eln/30.1-1ed0c1e8/gcmh-f09b0fce-70d70e65.eln
> No symbol table info available.
> #107 0x00000000005aa3d3 in funcall_subr (subr=subr@entry=0x285c188, numargs=numargs@entry=0,
> args=args@entry=0x7fffffffd4b8) at eval.c:3159
>         argbuf = {0x580de943, 0x1d5e625d, 0x2, 0x5a770f <do_one_unbind+319>, 0x1815260, 0x1c0,
> 0x6a0b0985, 0x0}
>         a = <optimized out>
>         maxargs = 0
>         fun = <optimized out>
> #108 0x00000000005abdab in funcall_general (fun=0x285c18d, numargs=numargs@entry=0,
> args=args@entry=0x7fffffffd4b8) at /build/source/src/lisp.h:2243
>         original_fun = 0x1b0c9f0
> #109 0x00000000005a903e in Ffuncall (nargs=nargs@entry=1, args=args@entry=0x7fffffffd4b0) at
> eval.c:3093
>         count = {bytes = 352}
>         val = <optimized out>
> #110 0x00000000005a9314 in Fapply (nargs=2, args=0x7fffffffd4b0) at eval.c:2718
>         i = <optimized out>
>         funcall_nargs = <optimized out>
>         funcall_args = 0x0
>         spread_arg = 0x0
>         fun = 0x1b0c9f0
>         sa_avail = 16384
>         sa_count = <optimized out>
>         numargs = <optimized out>
>         retval = <optimized out>
> #111 0x00000000005aa4cd in funcall_subr (subr=subr@entry=0xc75b20 <Sapply>,
> numargs=numargs@entry=2, args=args@entry=0x7fffffffd4b0) at eval.c:3184
>         maxargs = -2
>         fun = <optimized out>
> #112 0x00000000005abdab in funcall_general (fun=0xc75b25 <Sapply+5>, numargs=numargs@entry=2,
> args=args@entry=0x7fffffffd4b0) at /build/source/src/lisp.h:2243
>         original_fun = 0x3e10
> #113 0x00000000005a903e in Ffuncall (nargs=3, args=0x7fffffffd4a8) at eval.c:3093
>         count = {bytes = 320}
>         val = <optimized out>
> #114 0x000015554e2e9ff8 in F74696d65722d6576656e742d68616e646c6572_timer_event_handler_0 ()
> from
> /nix/store/xdxaa55akicvs3jjrr8d7nmzla4gzbyl-emacs-30.1/bin/../lib/emacs/30.1/native-lisp/30.1-1ed0c1e8/preloaded/timer-3ee7cfd9-ae4e9eed.eln
> 
> No symbol table info available.
> #115 0x00000000005aa3de in funcall_subr (subr=subr@entry=0x15554f4aaf10,
> numargs=numargs@entry=1, args=args@entry=0x7fffffffd688) at eval.c:3161
>         argbuf = {0x12099370, 0x59778c <store_symval_forwarding+196>, 0xffffffe2, 0x1, 0xceb360 <mpz>,
> 0xceb360 <mpz>, 0x1, 0x9a821eca03d5ad00}
>         a = <optimized out>
>         maxargs = 1
>         fun = <optimized out>
> #116 0x00000000005abdab in funcall_general (fun=0x15554f4aaf15, numargs=numargs@entry=1,
> args=args@entry=0x7fffffffd688) at /build/source/src/lisp.h:2243
>         original_fun = 0x11fd0
> #117 0x00000000005a903e in Ffuncall (nargs=nargs@entry=2, args=args@entry=0x7fffffffd680) at
> eval.c:3093
>         count = {bytes = 224}
>         val = <optimized out>
> #118 0x000000000052de9e in timer_check_2 (timers=<optimized out>, timers@entry=0x580de363,
> idle_timers=<optimized out>, idle_timers@entry=0x580de303) at keyboard.c:4800

This part seems to indicate you run something called
gcmh-idle-garbage-collect, which triggers GC from a timer function?
If so, please describe what you do with this and show the relevant
code.

In general, please describe anything related to GC and timers that you
customized in your sessions, as that could be relevant to the nature
and the reasons of this bug.

Also, what is the memory footprint of the crashed Emacs process?

> In GNU Emacs 30.1 (build 1, x86_64-pc-linux-gnu, X toolkit, cairo
> version 1.18.2, Xaw3d scroll bars)
> Windowing system distributor 'The Cygwin/X Project', version 11.0.12000000
> System Description: Red Hat Enterprise Linux 8.10 (Ootpa)

Does this mean you run Emacs on a Red Hat system via the Cygwin X
implementation that runs on Windows?

Anything else that is "unusual" in your sessions?  Please don't save
us any such details, as they might be relevant, or provide important
clues as to where to look for the causes.

Thanks.