Crash on invalid cons_free_list

[Chong Yidong]

[I sent this to emacs-pretest-bug a few days ago, but it didn't seem
to arrive.  I think my email system was flaking out at the time.]

I installed VM to and played around with it trying to make the
string_free_list/compact_small_strings crash happen.  I got a crash on
an invalid cons_free_list; dunno if that's related.

Unfortunately, I have not been able to reproduce the crash.  I'll keep
the gdb session up for the next day or so in case someone needs more
information.  This Emacs was built about four days ago.


Program received signal SIGSEGV, Segmentation fault.
Fcons (car=137392193, cdr=137392193) at alloc.c:2696
2696          cons_free_list = *(struct Lisp_Cons **)&cons_free_list->cdr;
(gdb) p cons_free_list
$3 = (struct Lisp_Cons *) 0x41081b22
(gdb) p cons_free_list->cdr
Cannot access memory at address 0x41081b26
(gdb) xbacktrace
"mapcar"
"vm-mapc"
"vm-copy-local-variables"
"vm-do-needed-mode-line-update"
0x897134c PVEC_COMPILED
"mapatoms"
"vm-update-summary-and-mode-line"
"vm-decode-mime-message"
"vm-show-current-message"
"vm-scroll-forward"
"call-interactively"
"recursive-edit"
"byte-code"
"debug"
"execute-extended-command"
"call-interactively"
(gdb) bt full
#0  Fcons (car=137392193, cdr=137392193) at alloc.c:2696
        val = 137392193
#1  0x08134900 in Flist (nargs=1, args=0xbf983d80) at alloc.c:2784
        val = 143785469
#2  0x08155930 in Fmapcar (function=143785469, sequence=143784269)
    at fns.c:3208
        leni = 2
        args = (int *) 0xbf983d80
        ret = -1080541824
        sa_must_free = 0
#3  0x0814bf66 in Ffuncall (nargs=3, args=0xbf983e34) at eval.c:2865
        fun = 137108664
        funcar = 137392193
        numargs = 2
        lisp_numargs = 137392193
        val = 137392193
        backtrace = {
          next = 0xbf983f10, 
          function = 0xbf983e30, 
          args = 0xbf983e34, 
          nargs = 2, 
          evalargs = 0 '\0', 
          debug_on_exit = 0 '\0'
       }
       internal_args = (int *) 0xbf983e34
       i = 137392193