W/ address sanitizer

init.el

;; Related savehist config

(use-package savehist
  :hook (after-init . savehist-mode)
  :init (setq enable-recursive-minibuffers t ; Allow commands in minibuffers
              history-length 1000
              savehist-additional-variables '(mark-ring
                                              global-mark-ring
                                              search-ring
                                              regexp-search-ring
                                              extended-command-history)
              savehist-autosave-interval 300))

report.txt

==32163==ERROR: AddressSanitizer: heap-use-after-free on address 0x00011cd77a40 at pc 0x0001006740e4 bp 0x00016fde5ad0 sp 0x00016fde5ac8
READ of size 8 at 0x00011cd77a40 thread T0
    #0 0x1006740e0 in vector_marked_p alloc.c:3972
    #1 0x100672e4c in process_mark_stack alloc.c:6858
    #2 0x100673974 in mark_objects alloc.c:7070
    #3 0x10067efc0 in mark_vectorlike alloc.c:6480
    #4 0x10067dfcc in mark_buffer alloc.c:6543
    #5 0x100672ea8 in process_mark_stack alloc.c:6880
    #6 0x1006713d4 in mark_object alloc.c:7062
    #7 0x100670410 in mark_object_root_visitor alloc.c:5997
    #8 0x10066e220 in visit_static_gc_roots alloc.c:5989
    #9 0x10066f19c in garbage_collect alloc.c:6199
    #10 0x10066e5e4 in maybe_garbage_collect alloc.c:6108
    #11 0x10081cadc in maybe_gc lisp.h:5592
    #12 0x10080e454 in exec_byte_code bytecode.c:782
    #13 0x1007249a4 in fetch_and_exec_byte_code eval.c:3085
    #14 0x10071c74c in funcall_lambda eval.c:3157
    #15 0x10071abc0 in funcall_general eval.c:2949
    #16 0x10070e178 in Ffuncall eval.c:2999
    #17 0x10071a29c in run_hook_wrapped_funcall eval.c:2777
    #18 0x100719f58 in run_hook_with_args eval.c:2858
    #19 0x10071a154 in Frun_hook_wrapped eval.c:2792
    #20 0x10071c170 in funcall_subr eval.c:3063
    #21 0x10080e62c in exec_byte_code bytecode.c:809
    #22 0x1007249a4 in fetch_and_exec_byte_code eval.c:3085
    #23 0x10071c74c in funcall_lambda eval.c:3157
    #24 0x10071abc0 in funcall_general eval.c:2949
    #25 0x10070e178 in Ffuncall eval.c:2999
    #26 0x1004929cc in call1 lisp.h:3248
    #27 0x100488068 in Fkill_emacs emacs.c:2875
    #28 0x10071b4e0 in funcall_subr eval.c:3040
    #29 0x10071ab70 in funcall_general eval.c:2945
    #30 0x10070e178 in Ffuncall eval.c:2999
    #31 0x100718388 in Fapply eval.c:2623
    #32 0x10071c170 in funcall_subr eval.c:3063
    #33 0x10080e62c in exec_byte_code bytecode.c:809
    #34 0x1007249a4 in fetch_and_exec_byte_code eval.c:3085
    #35 0x10071c74c in funcall_lambda eval.c:3157
    #36 0x10071abc0 in funcall_general eval.c:2949
    #37 0x10070e178 in Ffuncall eval.c:2999
    #38 0x1004a5978 in call1 lisp.h:3248
    #39 0x1004b8a24 in timer_check_2 keyboard.c:4690
    #40 0x1004b70f0 in timer_check keyboard.c:4756
    #41 0x1004b0028 in readable_events keyboard.c:3533
    #42 0x1004b6b68 in get_input_pending keyboard.c:7377
    #43 0x1004aca84 in detect_input_pending_run_timers keyboard.c:10907
    #44 0x10083e448 in wait_reading_process_output process.c:5786
    #45 0x1004e3430 in kbd_buffer_get_event keyboard.c:4012
    #46 0x1004e1a08 in read_event_from_main_queue keyboard.c:2279
    #47 0x1004b0a70 in read_decoded_event_from_main_queue keyboard.c:2343
    #48 0x1004a9f20 in read_char keyboard.c:2973
    #49 0x10049f240 in read_key_sequence keyboard.c:10084
    #50 0x100499410 in command_loop_1 keyboard.c:1384
    #51 0x100710e20 in internal_condition_case eval.c:1474
    #52 0x10049821c in command_loop_2 keyboard.c:1133
    #53 0x10070ed14 in internal_catch eval.c:1197
    #54 0x100495aec in command_loop keyboard.c:1111
    #55 0x1004953dc in recursive_edit_1 keyboard.c:720
    #56 0x100496698 in Frecursive_edit keyboard.c:803
    #57 0x10048d3dc in main emacs.c:2521
    #58 0x1867ad0dc  (<unknown module>)

0x00011cd77a40 is located 3392 bytes inside of 4096-byte region [0x00011cd76d00,0x00011cd77d00)
freed by thread T0 here:
    #0 0x102f1f380 in wrap_free+0x98 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x53380)
    #1 0x100ac5880 in rpl_free free.c:48
    #2 0x1006613cc in xfree alloc.c:814
    #3 0x100682008 in sweep_vectors alloc.c:3282
    #4 0x10067183c in gc_sweep alloc.c:7431
    #5 0x10066f430 in garbage_collect alloc.c:6263
    #6 0x10066e5e4 in maybe_garbage_collect alloc.c:6108
    #7 0x10081cadc in maybe_gc lisp.h:5592
    #8 0x10080e454 in exec_byte_code bytecode.c:782
    #9 0x1007249a4 in fetch_and_exec_byte_code eval.c:3085
    #10 0x10071c74c in funcall_lambda eval.c:3157
    #11 0x10071abc0 in funcall_general eval.c:2949
    #12 0x10070e178 in Ffuncall eval.c:2999
    #13 0x100719ff4 in funcall_nil eval.c:2681
    #14 0x100719f58 in run_hook_with_args eval.c:2858
    #15 0x100719950 in Frun_hook_with_args eval.c:2723
    #16 0x100719890 in run_hook eval.c:2871
    #17 0x100719714 in Frun_hooks eval.c:2705
    #18 0x10071c170 in funcall_subr eval.c:3063
    #19 0x10080e62c in exec_byte_code bytecode.c:809
    #20 0x1007249a4 in fetch_and_exec_byte_code eval.c:3085
    #21 0x10071c74c in funcall_lambda eval.c:3157
    #22 0x10071abc0 in funcall_general eval.c:2949
    #23 0x10070e178 in Ffuncall eval.c:2999
    #24 0x10081d380 in bcall0 bytecode.c:335
    #25 0x100720398 in do_one_unbind eval.c:3624
    #26 0x10070438c in unbind_to eval.c:3764
    #27 0x10080eb4c in exec_byte_code bytecode.c:838
    #28 0x1007249a4 in fetch_and_exec_byte_code eval.c:3085
    #29 0x10071c74c in funcall_lambda eval.c:3157

previously allocated by thread T0 here:
    #0 0x102f1f244 in wrap_malloc+0x94 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x53244)
    #1 0x10066101c in lmalloc alloc.c:1365
    #2 0x100660f20 in xmalloc alloc.c:755
    #3 0x1006786c4 in allocate_vector_block alloc.c:3003
    #4 0x1006783c4 in allocate_vector_from_block alloc.c:3066
    #5 0x1006679dc in allocate_vectorlike alloc.c:3340
    #6 0x1006678a0 in allocate_pseudovector alloc.c:3417
    #7 0x100669644 in build_marker alloc.c:3760
    #8 0x1006d0994 in Fpoint_marker editfns.c:198
    #9 0x1006d5c08 in save_excursion_save editfns.c:805
    #10 0x10071f2e8 in record_unwind_protect_excursion eval.c:3593
    #11 0x10080fc48 in exec_byte_code bytecode.c:924
    #12 0x1007249a4 in fetch_and_exec_byte_code eval.c:3085
    #13 0x10071c74c in funcall_lambda eval.c:3157
    #14 0x10071abc0 in funcall_general eval.c:2949
    #15 0x10070e178 in Ffuncall eval.c:2999
    #16 0x1005a311c in call2 lisp.h:3255
    #17 0x1005bcc44 in Finsert_file_contents fileio.c:4743
    #18 0x10071b930 in funcall_subr eval.c:3046
    #19 0x10080e62c in exec_byte_code bytecode.c:809
    #20 0x1007249a4 in fetch_and_exec_byte_code eval.c:3085
    #21 0x10071c74c in funcall_lambda eval.c:3157
    #22 0x10071abc0 in funcall_general eval.c:2949
    #23 0x10070e178 in Ffuncall eval.c:2999
    #24 0x100719f58 in run_hook_with_args eval.c:2858
    #25 0x10071a030 in Frun_hook_with_args_until_success eval.c:2744
    #26 0x10071c170 in funcall_subr eval.c:3063
    #27 0x10080e62c in exec_byte_code bytecode.c:809
    #28 0x1007249a4 in fetch_and_exec_byte_code eval.c:3085
    #29 0x10071c74c in funcall_lambda eval.c:3157

SUMMARY: AddressSanitizer: heap-use-after-free alloc.c:3972 in vector_marked_p
Shadow bytes around the buggy address:
  0x00011cd77780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x00011cd77800: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x00011cd77880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x00011cd77900: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x00011cd77980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x00011cd77a00: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
  0x00011cd77a80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x00011cd77b00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x00011cd77b80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x00011cd77c00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x00011cd77c80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==32163==ABORTING
AddressSanitizer report breakpoint hit. Use 'thread info -s' to get extended information about the report.
Process 32163 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = Use of deallocated memory
    frame #0: 0x0000000102f2912c libclang_rt.asan_osx_dynamic.dylib`__asan::AsanDie()
libclang_rt.asan_osx_dynamic.dylib`__asan::AsanDie:
->  0x102f2912c <+0>:  pacibsp
    0x102f29130 <+4>:  stp    x20, x19, [sp, #-0x20]!
    0x102f29134 <+8>:  stp    x29, x30, [sp, #0x10]
    0x102f29138 <+12>: add    x29, sp, #0x10
Target 0: (emacs) stopped.
Process 32163 launched: '/Users/zrzka/Downloads/emacs-29.2/src/emacs' (arm64)
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = Use of deallocated memory
  * frame #0: 0x0000000102f2912c libclang_rt.asan_osx_dynamic.dylib`__asan::AsanDie()
    frame #1: 0x0000000102f42e64 libclang_rt.asan_osx_dynamic.dylib`__sanitizer::Die() + 192
    frame #2: 0x0000000102f27020 libclang_rt.asan_osx_dynamic.dylib`__asan::ScopedInErrorReport::~ScopedInErrorReport() + 1124
    frame #3: 0x0000000102f262f8 libclang_rt.asan_osx_dynamic.dylib`__asan::ReportGenericError(unsigned long, unsigned long, unsigned long, unsigned long, bool, unsigned long, unsigned int, bool) + 1460
    frame #4: 0x0000000102f27814 libclang_rt.asan_osx_dynamic.dylib`__asan_report_load8 + 56
    frame #5: 0x00000001006740e4 emacs`vector_marked_p(v=0x000000011cd77a40) at alloc.c:3972:10
    frame #6: 0x0000000100672e50 emacs`process_mark_stack(base_sp=0) at alloc.c:6858:10
    frame #7: 0x0000000100673978 emacs`mark_objects(objs=0x000000011cd75908, n=75) at alloc.c:7070:3
    frame #8: 0x000000010067efc4 emacs`mark_vectorlike(header=0x000000011cd75900) at alloc.c:6480:3
    frame #9: 0x000000010067dfd0 emacs`mark_buffer(buffer=0x000000011cd75900) at alloc.c:6543:3
    frame #10: 0x0000000100672eac emacs`process_mark_stack(base_sp=0) at alloc.c:6880:3
    frame #11: 0x00000001006713d8 emacs`mark_object(obj=0x000000011cd75905) at alloc.c:7062:3
    frame #12: 0x0000000100670414 emacs`mark_object_root_visitor(root_ptr=0x0000000101253c00, type=GC_ROOT_STATICPRO, data=0x0000000000000000) at alloc.c:5997:3
    frame #13: 0x000000010066e224 emacs`visit_static_gc_roots(visitor=gc_root_visitor @ 0x000000016fde61a0) at alloc.c:5989:5
    frame #14: 0x000000010066f1a0 emacs`garbage_collect at alloc.c:6199:3
    frame #15: 0x000000010066e5e8 emacs`maybe_garbage_collect at alloc.c:6108:5
    frame #16: 0x000000010081cae0 emacs`maybe_gc at lisp.h:5592:5
    frame #17: 0x000000010080e458 emacs`exec_byte_code(fun=0x0000000107815eed, args_template=513, nargs=2, args=0x0000000109104970) at bytecode.c:782:6
    frame #18: 0x00000001007249a8 emacs`fetch_and_exec_byte_code(fun=0x000000010788905d, args_template=257, nargs=1, args=0x00000001091048a8) at eval.c:3085:10
    frame #19: 0x000000010071c750 emacs`funcall_lambda(fun=0x000000010788905d, nargs=1, arg_vector=0x00000001091048a8) at eval.c:3157:9
    frame #20: 0x000000010071abc4 emacs`funcall_general(fun=0x000000010788905d, numargs=1, args=0x00000001091048a8) at eval.c:2949:12
    frame #21: 0x000000010070e17c emacs`Ffuncall(nargs=2, args=0x00000001091048a0) at eval.c:2999:21
    frame #22: 0x000000010071a2a0 emacs`run_hook_wrapped_funcall(nargs=2, args=0x00000001091048a0) at eval.c:2777:9
    frame #23: 0x0000000100719f5c emacs`run_hook_with_args(nargs=2, args=0x00000001091048a0, funcall=(emacs`run_hook_wrapped_funcall at eval.c:2773)) at eval.c:2858:14
    frame #24: 0x000000010071a158 emacs`Frun_hook_wrapped(nargs=2, args=0x00000001091048a0) at eval.c:2792:10
    frame #25: 0x000000010071c174 emacs`funcall_subr(subr=0x00000001011605c0, numargs=2, args=0x00000001091048a0) at eval.c:3063:9
    frame #26: 0x000000010080e630 emacs`exec_byte_code(fun=0x0000000107889005, args_template=257, nargs=1, args=0x000000016fdef990) at bytecode.c:809:14
    frame #27: 0x00000001007249a8 emacs`fetch_and_exec_byte_code(fun=0x0000000107889005, args_template=257, nargs=1, args=0x000000016fdef988) at eval.c:3085:10
    frame #28: 0x000000010071c750 emacs`funcall_lambda(fun=0x0000000107889005, nargs=1, arg_vector=0x000000016fdef988) at eval.c:3157:9
    frame #29: 0x000000010071abc4 emacs`funcall_general(fun=0x0000000107889005, numargs=1, args=0x000000016fdef988) at eval.c:2949:12
    frame #30: 0x000000010070e17c emacs`Ffuncall(nargs=2, args=0x000000016fdef980) at eval.c:2999:21
    frame #31: 0x00000001004929d0 emacs`call1(fn=0x000000000000d230, arg1=0x0000000000009450) at lisp.h:3248:10
    frame #32: 0x000000010048806c emacs`Fkill_emacs(arg=0x0000000000000000, restart=0x0000000000000000) at emacs.c:2875:2
    frame #33: 0x000000010071b4e4 emacs`funcall_subr(subr=0x0000000101153d80, numargs=0, args=0x0000000109104848) at eval.c:3040:15
    frame #34: 0x000000010071ab74 emacs`funcall_general(fun=0x0000000101153d85, numargs=0, args=0x0000000109104848) at eval.c:2945:12
    frame #35: 0x000000010070e17c emacs`Ffuncall(nargs=1, args=0x0000000109104840) at eval.c:2999:21
    frame #36: 0x000000010071838c emacs`Fapply(nargs=2, args=0x0000000109104840) at eval.c:2623:12
    frame #37: 0x000000010071c174 emacs`funcall_subr(subr=0x0000000101160320, numargs=2, args=0x0000000109104840) at eval.c:3063:9
    frame #38: 0x000000010080e630 emacs`exec_byte_code(fun=0x0000000107bcd555, args_template=257, nargs=1, args=0x0000000109104840) at bytecode.c:809:14
    frame #39: 0x00000001007249a8 emacs`fetch_and_exec_byte_code(fun=0x0000000108300b8d, args_template=257, nargs=1, args=0x000000016fdf5488) at eval.c:3085:10
    frame #40: 0x000000010071c750 emacs`funcall_lambda(fun=0x0000000108300b8d, nargs=1, arg_vector=0x000000016fdf5488) at eval.c:3157:9
    frame #41: 0x000000010071abc4 emacs`funcall_general(fun=0x0000000108300b8d, numargs=1, args=0x000000016fdf5488) at eval.c:2949:12
    frame #42: 0x000000010070e17c emacs`Ffuncall(nargs=2, args=0x000000016fdf5480) at eval.c:2999:21
    frame #43: 0x00000001004a597c emacs`call1(fn=0x000000000000ec10, arg1=0x00000002c021086d) at lisp.h:3248:10
    frame #44: 0x00000001004b8a28 emacs`timer_check_2(timers=0x00000001077ec3b3, idle_timers=0x00000001077ec313) at keyboard.c:4690:8
    frame #45: 0x00000001004b70f4 emacs`timer_check at keyboard.c:4756:18
    frame #46: 0x00000001004b002c emacs`readable_events(flags=1) at keyboard.c:3533:5
    frame #47: 0x00000001004b6b6c emacs`get_input_pending(flags=1) at keyboard.c:7377:42
    frame #48: 0x00000001004aca88 emacs`detect_input_pending_run_timers(do_display=true) at keyboard.c:10907:5
    frame #49: 0x000000010083e44c emacs`wait_reading_process_output(time_limit=0, nsecs=0, read_kbd=-1, do_display=true, wait_for_cell=0x0000000000000000, wait_proc=0x0000000000000000, just_wait_proc=0) at process.c:5786:8
    frame #50: 0x00000001004e3434 emacs`kbd_buffer_get_event(kbp=0x000000016fdfa0e0, used_mouse_menu=0x000000016fdfbec0, end_time=0x0000000000000000) at keyboard.c:4012:4
    frame #51: 0x00000001004e1a0c emacs`read_event_from_main_queue(end_time=0x0000000000000000, local_getcjmp=0x000000016fdfba00, used_mouse_menu=0x000000016fdfbec0) at keyboard.c:2279:7
    frame #52: 0x00000001004b0a74 emacs`read_decoded_event_from_main_queue(end_time=0x0000000000000000, local_getcjmp=0x000000016fdfba00, prev_event=0x0000000000000000, used_mouse_menu=0x000000016fdfbec0) at keyboard.c:2343:11
    frame #53: 0x00000001004a9f24 emacs`read_char(commandflag=1, map=0x00000001077d5543, prev_event=0x0000000000000000, used_mouse_menu=0x000000016fdfbec0, end_time=0x0000000000000000) at keyboard.c:2973:11
    frame #54: 0x000000010049f244 emacs`read_key_sequence(keybuf=0x000000016fdfd060, prompt=0x0000000000000000, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:10084:12
    frame #55: 0x0000000100499414 emacs`command_loop_1 at keyboard.c:1384:15
    frame #56: 0x0000000100710e24 emacs`internal_condition_case(bfun=(emacs`command_loop_1 at keyboard.c:1278), handlers=0x0000000000000090, hfun=(emacs`cmd_error at keyboard.c:936)) at eval.c:1474:25
    frame #57: 0x0000000100498220 emacs`command_loop_2(handlers=0x0000000000000090) at keyboard.c:1133:11
    frame #58: 0x000000010070ed18 emacs`internal_catch(tag=0x000000000000eee0, func=(emacs`command_loop_2 at keyboard.c:1129), arg=0x0000000000000090) at eval.c:1197:25
    frame #59: 0x0000000100495af0 emacs`command_loop at keyboard.c:1111:2
    frame #60: 0x00000001004953e0 emacs`recursive_edit_1 at keyboard.c:720:9
    frame #61: 0x000000010049669c emacs`Frecursive_edit at keyboard.c:803:3
    frame #62: 0x000000010048d3e0 emacs`main(argc=1, argv=0x000000016fdff1c8) at emacs.c:2521:3
    frame #63: 0x00000001867ad0e0 dyld`start + 2360

xbacktrace.txt

(unsigned char *) data = 0x0000000100b55080 "Automatic GC"
(unsigned char *) data = 0x0000000100b600c0 "read"
(unsigned char *) data = 0x000000011af3a528 "savehist-save"
(unsigned char *) data = 0x000000011af3a4d8 "savehist-autosave"
PVEC_COMPILED
(unsigned char *) data = 0x0000000100b4e900 "run-hook-wrapped"
(unsigned char *) data = 0x0000000100b60760 "run-hook-query-error-with-timeout"
(unsigned char *) data = 0x0000000100b5d1c0 "kill-emacs"
(unsigned char *) data = 0x0000000100b56f80 "apply"
(unsigned char *) data = 0x0000000100b61ce0 "timer-event-handler"