bug#30931: 27.0.50; Crash in "Automatic GC"

[Noam Postavsky]

found 30931 25.3
found 30931 26.0.91
tags 30931 + confirmed
retitle 30931 abort() due to CHECK_ALLOCATED_AND_LIVE failure during GC
quit

Michał Kondraciuk <k.michal@zoho.com> writes:
>
> 1. emacs -Q
> 2. M-x package-initialize
> 3. Evaluate: |(add-to-list 'package-archives '("melpa"
> . "https://melpa.org/packages/";)) 4. M-x package-refresh-contents
> 5. M-x 
> package-install RET ivy RET |6||. M-x package-install RET yasnippet
> RET |||7. M-x package-install RET yasnippet-snippets RET|
> 8. Evaluate form below.
> 9. Wait 1-10 minutes.

I'm able to reproduce this in a fresh HOME (I've tried with versions
25.3 and 26.0.91), with the attached init.el.

init.el
Description: init.el to reproduce crash

It looks like there is a Lisp_Misc_Free object in the undo-list. At
least, I think it's the undo-list.  One time I actually got the
mark_object (BVAR (nextb, undo_list)) in the backtrace, although the
next time it was just mark_stack, but the object being marked still
looks like an undo-list.