bug#27571: Crashing when printing a lisp object.

[Keith David Bershatsky]

I am using a custom version of undo-tree, which contains some additional 
features and bug fixes that are not present in the ELPA version.  In the 
example below, the buffer undo-tree history variable has a count of 26 because 
I typed each letter of the alphabet in lower case letters and I do not use 
amalgamation -- i.e., every letter typed is separated by a buffer undo boundary.

[cl-struct-undo-tree [nil ([nil ([nil ([nil ([nil ([nil ([nil ([nil ([nil ([nil 
([nil ([nil ([nil ([nil ([nil ([nil ([nil ([nil ([nil ([nil ([nil ([nil ([nil 
([nil ([nil ([nil (#1=[nil nil ((26 . 27)) nil (22874 59645 117315 0) 0 nil 
(((22874 59645 117309 0) . t)) nil nil]) ((25 . 26)) nil (22874 59645 117331 0) 
0 nil (((22874 59645 107309 0))) nil nil]) ((24 . 25)) nil (22874 59645 117335 
0) 0 nil (((22874 59645 97309 0))) nil nil]) ((23 . 24)) nil (22874 59645 
117339 0) 0 nil (((22874 59645 87309 0))) nil nil]) ((22 . 23)) nil (22874 
59645 117343 0) 0 nil (((22874 59645 77309 0))) nil nil]) ((21 . 22)) nil 
(22874 59645 117347 0) 0 nil (((22874 59645 67309 0))) nil nil]) ((20 . 21)) 
nil (22874 59645 117351 0) 0 nil (((22874 59645 57309 0))) nil nil]) ((19 . 
20)) nil (22874 59645 117354 0) 0 nil (((22874 59645 47309 0))) nil nil]) ((18 
. 19)) nil (22874 59645 117358 0) 0 nil (((22874 59645 37309 0))) nil nil]) 
((17 . 18)) nil (22874 59645 117363 0) 0 nil (((22874 59645 27309 0))) nil 
nil]) ((16 . 17)) nil (22874 59645 117366 0) 0 nil (((22874 59645 17309 0))) 
nil nil]) ((15 . 16)) nil (22874 59645 117370 0) 0 nil (((22874 59645 7309 0))) 
nil nil]) ((14 . 15)) nil (22874 59645 117374 0) 0 nil (((22874 59644 997309 
0))) nil nil]) ((13 . 14)) nil (22874 59645 117378 0) 0 nil (((22874 59644 
987309 0))) nil nil]) ((12 . 13)) nil (22874 59645 117382 0) 0 nil (((22874 
59644 977309 0))) nil nil]) ((11 . 12)) nil (22874 59645 117386 0) 0 nil 
(((22874 59644 967309 0))) nil nil]) ((10 . 11)) nil (22874 59645 117390 0) 0 
nil (((22874 59644 957309 0))) nil nil]) ((9 . 10)) nil (22874 59645 117394 0) 
0 nil (((22874 59644 947309 0))) nil nil]) ((8 . 9)) nil (22874 59645 117398 0) 
0 nil (((22874 59644 937309 0))) nil nil]) ((7 . 8)) nil (22874 59645 117402 0) 
0 nil (((22874 59644 927309 0))) nil nil]) ((6 . 7)) nil (22874 59645 117405 0) 
0 nil (((22874 59644 917309 0))) nil nil]) ((5 . 6)) nil (22874 59645 117409 0) 
0 nil (((22874 59644 907309 0))) nil nil]) ((4 . 5)) nil (22874 59645 117413 0) 
0 nil (((22874 59644 897309 0))) nil nil]) ((3 . 4)) nil (22874 59645 117417 0) 
0 nil (((22874 59644 887309 0))) nil nil]) ((2 . 3)) nil (22874 59645 117420 0) 
0 nil (((22874 59644 877309 0))) nil nil]) ((1 . 2) (t 22874 59561 0 0)) nil 
(22874 59645 117425 0) 0 nil (((22874 59644 867309 0))) nil nil]) nil nil 
(22874 59632 379899 0) 0 nil (((0 0))) nil nil] #1# 216 26 nil #1#]

The persistent undo history feature uses `prin1` to create a printed 
representation of the undo-tree history, which is saved to a file and then 
restored at a later point in time with the `read` command.  Emacs 25.2.1 is 
crashing on OSX Snow Leopard and also OSX El Capitan when the undo tree history 
exceeds a count of approximately 6651.  I have concluded that the crashing is 
*not* due to a specific character recently typed, because I was able to 
reproduce the crash typing a variety of characters -- followed by populating 
the undo-tree history variable, followed by `prin1`.  My most recent 
thinking/guessing is that perhaps the nesting of vectors and nesting lists has 
something to do with the crashing.  I have tried other print functions such as 
`prin1-to-string` and `print`, which all cause the familiar crash.  I am not 
proficient in using GDB, but have nevertheless included a backtrace below.

I am saddened by the apparent reality that I may need to reduce my undo-tree 
history to a count limit of 6500, which seems rather small considering that 
each character that I type would go towards that limit.  It is possible that 
some prior large undo/redo is contributing to the crashing, but I was able to 
narrow it down to `prin1` working with a history count of 6651 and I was able 
to "break the camel's back" repeatedly with just one additional keystroke + 
populate history variable + prin1.  I don't think it is a garbage collection 
issue, because I tried binding let-binding (gc-cons-threshold 
most-positive-fixnum) and the crash still occurred.  Any ideas on how to avoid 
crashing (other than truncating the size of my undo tree history variable) 
would be greatly appreciated.

    Program received signal SIGSEGV, Segmentation fault.
    0x0000000100141da7 in print_object (obj=4790542093, printcharfun=0, 
        escapeflag=true) at print.c:1350
    1350        {
    (gdb) bt full
    #0  0x0000000100141da7 in print_object (obj=4790542093, printcharfun=0, 
        escapeflag=true) at print.c:1350
            buf = "\000\000\000\000\000\000\000\000\070\346\211\035\001", 
'\000' <repeats 11 times>, "\303o\024\034\001\000\000\000\350\345\211\035\001", 
'\000' <repeats 11 times>, "\320\360:_\377\177"
    #1  0x000000010014261f in print_object (obj=4766068675, printcharfun=0, 
        escapeflag=true) at print.c:1659
            halftail = 4766068675
            print_length = 9223372036854775807
            i = 1
            buf = "\000\000\000\000\000\000\000\000\070\346\211\035\001", 
'\000' <repeats 11 times>, "\265މ\035\001\000\000\000\350\345\211\035\001", 
'\000' <repeats 11 times>, "`\363:_\377\177"
    #2  0x0000000100143a77 in print_object (obj=<optimized out>, 
printcharfun=0, 
        escapeflag=true) at print.c:1965
            idx = 0
            tem = 4790542093
            size = 10
            buf = "\000\000\000\000\000\000\000\000\070\346\211\035\001", 
'\000' <repeats 11 times>, "\243#\n\034\001\000\000\000\350\345\211\035\001", 
'\000' <repeats 11 times>, "\360\365:_\377\177"
    #3  0x000000010014261f in print_object (obj=4765393827, printcharfun=0, 
        escapeflag=true) at print.c:1659
    ---Type <return> to continue, or q <return> to quit---    Program received 
signal SIGSEGV, Segmentation fault.
    0x0000000100141da7 in print_object (obj=4790542093, printcharfun=0, 
        escapeflag=true) at print.c:1350
    1350        {
    (gdb) bt full
    #0  0x0000000100141da7 in print_object (obj=4790542093, printcharfun=0, 
        escapeflag=true) at print.c:1350
            buf = "\000\000\000\000\000\000\000\000\070\346\211\035\001", 
'\000' <repeats 11 times>, "\303o\024\034\001\000\000\000\350\345\211\035\001", 
'\000' <repeats 11 times>, "\320\360:_\377\177"
    #1  0x000000010014261f in print_object (obj=4766068675, printcharfun=0, 
        escapeflag=true) at print.c:1659
            halftail = 4766068675
            print_length = 9223372036854775807
            i = 1
            buf = "\000\000\000\000\000\000\000\000\070\346\211\035\001", 
'\000' <repeats 11 times>, "\265މ\035\001\000\000\000\350\345\211\035\001", 
'\000' <repeats 11 times>, "`\363:_\377\177"
    #2  0x0000000100143a77 in print_object (obj=<optimized out>, 
printcharfun=0, 
        escapeflag=true) at print.c:1965
            idx = 0
            tem = 4790542093
            size = 10
            buf = "\000\000\000\000\000\000\000\000\070\346\211\035\001", 
'\000' <repeats 11 times>, "\243#\n\034\001\000\000\000\350\345\211\035\001", 
'\000' <repeats 11 times>, "\360\365:_\377\177"
    #3  0x000000010014261f in print_object (obj=4765393827, printcharfun=0, 
        escapeflag=true) at print.c:1659
    ---Type <return> to continue, or q <return> to quit---