bug#21666: 25.0.50; Random segfaults

[Paul Eggert]

On 10/16/2015 02:03 AM, Eli Zaretskii wrote:
> Do I read the backtrace correctly to indicate that Fabs was called
> with an argument that is a symbol, not a number?

No, Fabs's argument is 95, which means its tag is 7, which is 
Lisp_Float. Applying XFLOAT to 95 yields (struct Lisp_Float *) 0x58, 
which is not a valid pointer.

The new backtrace contains a call to Fmapcar, so it could well be that 
the problem is mapcar-related. However, my hypothesis does not look 
right, because this code has been patched so that sa_must_free is false, 
which means mapcar's temporary array of Lisp_Object values is allocated 
on the C stack and not via malloc. I'm afraid this means I am at a loss.