bug#81585: 31.0.91 and 32.0.50; Crash on macos hiding header-line with pixel-scroll-precision-mode

Hi,

I found a crash (Fatal error 10: Bus error; Abort trap: 6) on macos and narrowed it down to turning off the header line when pixel-scroll-precision-mode is enabled.

file minimal.el
;; -*- lexical-binding: t; -*-
(pixel-scroll-precision-mode)
(defun toggle-header ()
  (interactive)
  (setq header-line-format
	(unless header-line-format "Pixel scroll, then press C-t to crash")))
(toggle-header)
(bind-key "C-t" #'toggle-header)

To reproduce
1 . emacs -Q --load minimal.el
2. Scroll on the trackpad so half a line of buffer text is going off screen to the top.
3. C-t crash

I built from source in debug mode and reproduced it on master at 32.0.50 and emacs-31 at 31.0.91. Happy to help test any fixes.

Here's a backtrace from lldb -- .src/emacs -Q --load minimal.el

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x111ed1e90)
    frame #0: 0x00007ff81bb07a4c libsystem_platform.dylib`_platform_memmove$VARIANT$Haswell + 268
libsystem_platform.dylib`_platform_memmove$VARIANT$Haswell:
->  0x7ff81bb07a4c <+268>: vmovups %ymm0, (%rax)
    0x7ff81bb07a50 <+272>: vxorps %ymm0, %ymm0, %ymm0
    0x7ff81bb07a54 <+276>: vmovups 0x20(%rsi), %ymm2
    0x7ff81bb07a59 <+281>: addq   $0x40, %rsi
Target 0: (emacs) stopped.
(lldb) bt all
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x111ed1e90)
  * frame #0: 0x00007ff81bb07a4c libsystem_platform.dylib`_platform_memmove$VARIANT$Haswell + 268
    frame #1: 0x000000010023a8f4 emacs`-[EmacsView copyRect:to:](self=<unavailable>, _cmd=<unavailable>, srcRect=(origin = (x = 2, y = 5), size = (width = 576, height = 42)), dest=<unavailable>) at nsterm.m:9345:7
    frame #2: 0x00000001002433ab emacs`ns_scroll_run(w=<unavailable>, run=0x00007fdd1c823bb0) at nsterm.m:2901:5
    frame #3: 0x0000000100006764 emacs`scrolling_window(w=0x00007fdd1d03e1c0, tab_line_p=<unavailable>) at dispnew.c:5567:6
    frame #4: 0x0000000100005b7b emacs`update_window(w=0x00007fdd1d03e1c0) at dispnew.c:4492:16
    frame #5: 0x000000010000adc8 emacs`update_window_tree(w=0x00007fdd1d03e1c0) at dispnew.c:4262:2
    frame #6: 0x00000001000051c1 emacs`update_window_frame(f=0x00007fdd1d03df60) at dispnew.c:3894:3 [inlined]
    frame #7: 0x0000000100005143 emacs`update_frame(f=0x00007fdd1d03df60, inhibit_scrolling=<unavailable>) at dispnew.c:4146:5
    frame #8: 0x00000001000329cb emacs`redisplay_internal at xdisp.c:17979:5
    frame #9: 0x00000001000386e5 emacs`redisplay at xdisp.c:17045:3 [artificial]
    frame #10: 0x00000001000fe460 emacs`read_char(commandflag=1, map=0x00007fdd1b18a3c3, prev_event=0x0000000000000000, used_mouse_menu=0x00007ff7bfefe8bf, end_time=0x0000000000000000) at keyboard.c:2711:6
    frame #11: 0x00000001000ef38c emacs`read_key_sequence(keybuf=<unavailable>, prompt=0x0000000000000000, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=<unavailable>, disable_text_conversion_p=<unavailable>) at keyboard.c:11224:12
    frame #12: 0x00000001000ed429 emacs`command_loop_1 at keyboard.c:1424:15
    frame #13: 0x000000010018358e emacs`internal_condition_case(bfun=(emacs`command_loop_1 at keyboard.c:1319), handlers=<unavailable>, hfun=(emacs`cmd_error at keyboard.c:965)) at eval.c:1712:25
    frame #14: 0x00000001000ed02e emacs`command_loop_2(handlers=0x0000000000000090) at keyboard.c:1163:11
    frame #15: 0x0000000100182ccb emacs`internal_catch(tag=<unavailable>, func=(emacs`command_loop_2 at keyboard.c:1159), arg=0x0000000000000090) at eval.c:1392:25
    frame #16: 0x0000000100275a18 emacs`command_loop.cold.1 at keyboard.c:1141:2
    frame #17: 0x00000001000ec874 emacs`command_loop at keyboard.c:1140:2
    frame #18: 0x00000001000ec74f emacs`recursive_edit_1 at keyboard.c:749:9
    frame #19: 0x00000001000eca10 emacs`Frecursive_edit at keyboard.c:832:3
    frame #20: 0x00000001000eb7fb emacs`main(argc=<unavailable>, argv=0x00007ff7bfeff458) at emacs.c:2635:3
    frame #21: 0x00007ff81b72c530 dyld`start + 3056
  thread #2
    frame #0: 0x00007ff81ba91286 libsystem_kernel.dylib`__workq_kernreturn + 10
  thread #3
    frame #0: 0x00007ff81ba91286 libsystem_kernel.dylib`__workq_kernreturn + 10
    frame #1: 0x6566666141c813fd
    frame #2: 0x00007ff81bacd843 libsystem_pthread.dylib`start_wqthread + 15
  thread #4, name = 'gmain'
    frame #0: 0x00007ff81ba989fe libsystem_kernel.dylib`__select + 10
    frame #1: 0x0000000101305b7b libglib-2.0.0.dylib`g_poll + 663
    frame #2: 0x00000001012f694b libglib-2.0.0.dylib`g_main_context_iterate_unlocked + 392
    frame #3: 0x00000001012f6a07 libglib-2.0.0.dylib`g_main_context_iteration + 55
    frame #4: 0x00000001012f7a31 libglib-2.0.0.dylib`glib_worker_main + 30
    frame #5: 0x000000010131e6c8 libglib-2.0.0.dylib`g_thread_proxy + 77
    frame #6: 0x00007ff81bad1e05 libsystem_pthread.dylib`_pthread_start + 115
    frame #7: 0x00007ff81bacd857 libsystem_pthread.dylib`thread_start + 15
  thread #5
    frame #0: 0x00007ff81ba94962 libsystem_kernel.dylib`__pselect + 10
    frame #1: 0x00007ff81ba94858 libsystem_kernel.dylib`pselect$DARWIN_EXTSN + 42
    frame #2: 0x000000010022ff02 emacs`-[EmacsApp fd_handler:](self=<unavailable>, _cmd=<unavailable>, unused=<unavailable>) at nsterm.m:6780:20
    frame #3: 0x00007ff81ccf8d29 Foundation`__NSThread__start__ + 1014
    frame #4: 0x00007ff81bad1e05 libsystem_pthread.dylib`_pthread_start + 115
    frame #5: 0x00007ff81bacd857 libsystem_pthread.dylib`thread_start + 15
  thread #6, name = 'com.apple.NSEventThread'
    frame #0: 0x00007ff81ba8fb4a libsystem_kernel.dylib`mach_msg2_trap + 10
    frame #1: 0x00007ff81ba9e6bc libsystem_kernel.dylib`mach_msg2_internal + 83
    frame #2: 0x00007ff81ba96bc3 libsystem_kernel.dylib`mach_msg_overwrite + 574
    frame #3: 0x00007ff81ba8fe3b libsystem_kernel.dylib`mach_msg + 19
    frame #4: 0x00007ff81bbbb9f2 CoreFoundation`__CFRunLoopServiceMachPort + 145
    frame #5: 0x00007ff81bbba43f CoreFoundation`__CFRunLoopRun + 1430
    frame #6: 0x00007ff81bbb9872 CoreFoundation`CFRunLoopRunSpecific + 536
    frame #7: 0x00007ff81f7729ff AppKit`_NSEventThread + 127
    frame #8: 0x00007ff81bad1e05 libsystem_pthread.dylib`_pthread_start + 115
    frame #9: 0x00007ff81bacd857 libsystem_pthread.dylib`thread_start + 15
  thread #7, stop reason = thread-creation
    frame #0: 0x00007ff81bacd834 libsystem_pthread.dylib`start_wqthread
  thread #8
    frame #0: 0x00007ff81ba91286 libsystem_kernel.dylib`__workq_kernreturn + 10
    frame #1: 0x00007ff81bace8ba libsystem_pthread.dylib`_pthread_wqthread + 387
    frame #2: 0x00007ff81bacd843 libsystem_pthread.dylib`start_wqthread + 15



Output from M-x report-emacs-bug:

In GNU Emacs 32.0.50 (build 1, x86_64-apple-darwin24.6.0, NS
 appkit-2575.70 Version 15.7.8 (Build 24G824)) of 2026-08-08 built on
 XXX
Repository revision: b157d8e96a26e7509136bf93fad2c7ec49c0ee88
Repository branch: master
Windowing system distributor 'Apple', version 10.3.2575
System Description: macOS 15.7.8

Configured using:
 'configure --with-native-compilation=no 'CFLAGS=-g -ggdb3''

Configured features:
ACL DBUS GIF GLIB GMP GNUTLS JPEG LCMS2 LIBXML2 MODULES NOTIFY KQUEUE NS
PDUMPER PNG RSVG SQLITE3 THREADS TIFF TOOLKIT_SCROLL_BARS TREE_SITTER
WEBP XIM ZLIB

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  override-global-mode: t
  pixel-scroll-precision-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  minibuffer-nonselected-mode: t
  minibuffer-regexp-mode: t
  line-number-mode: t
  indent-tabs-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug lisp-mnt message mailcap yank-media puny
dired dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg
rfc6068 epg-config gnus-util text-property-search time-date mm-decode
mm-bodies mm-encode mailabbrev gmm-utils mailheader sendmail mail-parse
rfc2231 rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils edmacro
kmacro bind-key easy-mmode cl-loaddefs cl-lib pixel-scroll ring subr-x
rmc iso-transl tooltip cconv eldoc paren electric uniquify ediff-hook
vc-hooks lisp-float-type elisp-mode mwheel term/ns-win ns-win
ucs-normalize mule-util term/common-win tool-bar dnd fontset image
regexp-opt fringe tabulated-list replace newcomment text-mode lisp-mode
prog-mode register page tab-bar menu-bar rfn-eshadow isearch easymenu
timer select scroll-bar mouse jit-lock font-lock syntax font-core
term/tty-colors frame minibuffer nadvice seq simple cl-generic
indonesian philippine cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
composite emoji-zwj charscript charprop case-table epa-hook
jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button loaddefs
theme-loaddefs faces cus-face macroexp files window text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget keymap
hashtable-print-readable backquote threads dbusbind kqueue cocoa ns
lcms2 multi-tty make-network-process tty-child-frames emacs)

Memory information:
((conses 16 44123 8967) (symbols 48 7016 0) (strings 32 15654 1055)
 (string-bytes 1 344177) (vectors 16 10273)
 (vector-slots 8 117236 8476) (floats 8 33 3) (intervals 56 231 0)
 (buffers 1064 10))



Best,
Corwin