bin/56425: top crashed on system with 80 cpus and being resized

[mrg%eterna.com.au@localhost]

>Number:         56425
>Category:       bin
>Synopsis:       top crashed on system with 80 cpus and being resized
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Sep 30 02:10:00 +0000 2021
>Originator:     matthew green
>Release:        9.99.88
>Organization:
people's front against (bozotic) www (softwar foundation)
>Environment:
System: NetBSD agamemnon.warped.com 9.99.88 NetBSD 9.99.88 (GENERIC) #0: Tue Sep  7 14:39:37 UTC 2021  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:

	while running top and resizing i got this crash.  i had
	pressed 't' at it, and also 's1', switching to to thread
	and 1-second update modes.

agamemnon# gdb /usr/bin/top top.core
GNU gdb (GDB) 11.0.50.20200914-git
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/top...
Reading symbols from /usr/libdata/debug//usr/bin/top.debug...
[New process 9149]
Core was generated by `top'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000076db4bae5ec2 in je_extent_heap_remove (ph=<optimized out>, phn=phn@entry=0x76db4b80ca80)
    at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:278
278     ph_gen(, extent_heap_, extent_heap_t, extent_t, ph_link, extent_snad_comp)
(gdb) bt
#0  0x000076db4bae5ec2 in je_extent_heap_remove (ph=<optimized out>, phn=phn@entry=0x76db4b80ca80)
    at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:278
#1  0x000076db4bae6243 in extents_remove_locked (extents=extents@entry=0x76db4b802608, extent=extent@entry=0x76db4b80ca80, 
    tsdn=0x76db4d07e040) at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:342
#2  0x000076db4bae632f in extent_activate_locked (extent=0x76db4b80ca80, extents=0x76db4b802608, arena=0x76db4b800980, tsdn=0x76db4d07e040)
    at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:652
#3  extent_coalesce (tsdn=tsdn@entry=0x76db4d07e040, arena=arena@entry=0x76db4b800980, r_extent_hooks=r_extent_hooks@entry=0x7f7fff29fed8, 
    extents=extents@entry=0x76db4b802608, inner=inner@entry=0x76db4b80c000, outer=outer@entry=0x76db4b80ca80, forward=forward@entry=true, 
    growing_retained=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:1513
#4  0x000076db4bae65e6 in extent_try_coalesce (tsdn=tsdn@entry=0x76db4d07e040, arena=arena@entry=0x76db4b800980, 
    r_extent_hooks=r_extent_hooks@entry=0x7f7fff29fed8, rtree_ctx=rtree_ctx@entry=0x76db4d07e068, extents=extents@entry=0x76db4b802608, 
    extent=0x76db4b80c000, coalesced=coalesced@entry=0x7f7fff29fcdf, growing_retained=<optimized out>)
    at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:1553
#5  0x000076db4bae6824 in extent_record (tsdn=tsdn@entry=0x76db4d07e040, arena=arena@entry=0x76db4b800980, 
    r_extent_hooks=r_extent_hooks@entry=0x7f7fff29fed8, extents=extents@entry=0x76db4b802608, extent=<optimized out>, 
    extent@entry=0x76db4b80c000, growing_retained=false) at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:1629
#6  0x000076db4bae802a in je_extents_dalloc (tsdn=tsdn@entry=0x76db4d07e040, arena=arena@entry=0x76db4b800980, 
    r_extent_hooks=r_extent_hooks@entry=0x7f7fff29fed8, extents=extents@entry=0x76db4b802608, extent=extent@entry=0x76db4b80c000)
    at /usr/src/external/bsd/jemalloc/lib/../dist/src/extent.c:528
#7  0x000076db4bb108db in je_arena_extents_dirty_dalloc (tsdn=tsdn@entry=0x76db4d07e040, arena=arena@entry=0x76db4b800980, 
    r_extent_hooks=r_extent_hooks@entry=0x7f7fff29fed8, extent=extent@entry=0x76db4b80c000)
    at /usr/src/external/bsd/jemalloc/lib/../dist/src/arena.c:214
#8  0x000076db4bae00ca in large_dalloc_finish_impl (extent=0x76db4b80c000, arena=0x76db4b800980, tsdn=0x76db4d07e040)
    at /usr/src/external/bsd/jemalloc/lib/../dist/src/large.c:332
#9  je_large_dalloc (tsdn=0x76db4d07e040, extent=0x76db4b80c000) at /usr/src/external/bsd/jemalloc/lib/../dist/src/large.c:349
#10 0x000076db4bb1a099 in arena_dalloc (slow_path=<optimized out>, alloc_ctx=<optimized out>, tcache=<optimized out>, ptr=<optimized out>, 
    tsdn=<optimized out>) at /usr/src/external/bsd/jemalloc/lib/../include/jemalloc/internal/arena_inlines_b.h:237
#11 0x0000000126a05544 in display_resize () at /usr/src/external/bsd/top/bin/../dist/display.c:700
#12 0x0000000126a0c78e in main (argc=1, argv=0x7f7fff2a05e8) at /usr/src/external/bsd/top/bin/../dist/top.c:934
(gdb) f 11
#11 0x0000000126a05544 in display_resize () at /usr/src/external/bsd/top/bin/../dist/display.c:700
700                 free(colorbuf);
(gdb) l
695             {
696                 free(screenbuf);
697             }
698             if (colorbuf != NULL)
699             {
700                 free(colorbuf);
701             }
702     
703             /* allocate space for the screen and color buffers */
704             bufsize = newsize;
(gdb) p colorbuf
$1 = 0x76db4cd58b40 ""
(gdb)

>How-To-Repeat:
>Fix: