Segmentation fault

Bug description

Tarantool 3.7.0 crashes with SIGSEGV when box.cfg{instance_name = ...} is called on a read-only replica.

The crash happens in the box_set_instance_name() -> box_register_on_master() -> applier_resume_to_state() path and ends in error_ref().

• OS: docker container (ubuntu based)
• Architecture: amd64

Tarantool 3.7.0-0-g78b01ace947
Target: Linux-x86_64-RelWithDebInfo
Build options: cmake . -DCMAKE_INSTALL_PREFIX=/tarantool/static-build/tarantool-prefix -DENABLE_BACKTRACE=TRUE
Compiler: GNU-8.3.1
C_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -static-libstdc++ -fno-common -msse2  -fmacro-prefix-map=/tarantool=. -std=c11 -Wall -Wextra -Wno-gnu-alignof-expression -fno-gnu89-inline -Wno-cast-function-type -O2 -g -DNDEBUG -ggdb -O2
CXX_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -static-libstdc++ -fno-common -msse2  -fmacro-prefix-map=/tarantool=. -std=c++17 -Wall -Wextra -Wno-invalid-offsetof -Wno-gnu-alignof-expression -Wno-cast-function-type -O2 -g -DNDEBUG -ggdb -O2

Steps to reproduce

Start a replica with compat.skip_replication_names = "old" and without instance_name stored in the schema, then execute on the read-only replica:

box.cfg{instance_name = 'instance-1'}

The observed backtrace is:

#14 0xe6a07e in coro_init+62
#13 0x61c397 in fiber_loop+55
#12 0x431eec in fiber_cxx_invoke(int (*)(__va_list_tag*), __va_list_tag*)+12
#11 0x5f0a4e in lua_fiber_run_f+94
#10 0x5f920b in luaT_call+11
#9  0x6600af in lua_pcall+207
#8  0x65aa71 in lj_BC_FUNCC+86
#7  0x5c0de9 in lbox_cfg_set_instance_name(lua_State*)+9
#6  0x529f3b in box_set_instance_name()+123
#5  0x5238c9 in box_register_on_master()+73
#4  0x54ccc5 in applier_resume_to_state+341
#3  0x612e7a in error_ref+10
#2  0x7f42d1781520 in __sigaction+80
#1  0x614011 in crash_signal_cb+129
this may fail as well
Attempting backtrace... Note: since the server has already crashed,
Please file a bug at https://github.com/tarantool/tarantool/issues
Current time: 1787577276
  trapno   0xe                14
  oldmask  0x0                0
  err      0x4                4
  cr2      0x18               24
  fs       0x0                0
  gs       0x0                0
  cs       0x33               51
  eflags   0x10202            66050
  rip      0x612e7a           6368890
  r15      0x5c0de0           6032864
  r14      0x7f42d16863f8     139924957848568
  r13      0x0                0
  r12      0x4862b40          75901760
  r11      0x1f               31
  r10      0x7f4299f80d40     139924027739456
  r9       0x48e64b0          76440752
  r8       0x48e66d0          76441296
  rbp      0x7f42d1001b60     139924951014240
  rsp      0x7f42cc280d78     139924869746040
  rdi      0x0                0
  rsi      0x7f42cc280d00     139924869745920
  rdx      0x7fffffffffffffff 9223372036854775807
  rcx      0x48e66a0          76441248
  rbx      0x0                0
  rax      0x33a5720          54155040
  siginfo: 0x467b1f0
  context: 0x467b0c0
  addr: 0x18
  code: SEGV_MAPERR
Segmentation fault

The crash is SEGV_MAPERR, address 0x18.

Actual behavior

Tarantool crashes with SIGSEGV while trying to register the new instance name on the master.
The issue is intermittent and reproduces roughly once in 20-30 attempts.

Expected behavior

box.cfg{instance_name = ...} should either update the instance name successfully or return a Lua error without crashing the process.

Start by reproducing the read-only replica scenario with compat.skip_replication_names = "old" and trace the box_set_instance_name() -> box_register_on_master() -> applier_resume_to_state() -> error_ref() path. Confirm the intermittent SIGSEGV at address 0x18, then verify that the same configuration either updates the instance name or returns a Lua error without crashing.