It's possible to reliably segfault Emacs when using undercover, at least on Travis: https://github.com/Wilfred/elisp-def/commit/57523ad268e0f4d2550386d45d55d7a6ed5fe50c
Not sure why at this point.
miniblog.
Related Posts
I'm fascinated to learn that people are discovering weaknesses in state-of-the-art bots for playing Go, such that a novice player can reliably win: https://goattack.far.ai/human-evaluation
This suggests that self-play doesn't always generalise: it's not sufficient to beat earlier versions.
Debuggers actually set breakpoints after the function prologue, but reliably identifying the prologue across compilers and optimisation levels is hard!