display_count_lines core dump (Emacs 21.2 + Gerd's March 30 patch)

[Paul Eggert]

I just got a display-related core dump from GNU Emacs 21.2 with the
dispnew.c patch that Gerd Moellman suggested on March 30 (please see
<http://www.geocrawler.com/archives/3/337/2002/3/0/8252081/>
for a copy of that patch).

Here are the build details:

In GNU Emacs 21.2.1 (sparc-sun-solaris2.8, X toolkit, Xaw3d scroll bars)
 on sic.twinsun.com
configured using `configure  --prefix=/opt/reb --with-gcc --with-pop 
--x-includes=/opt/sfw/include:/usr/openwin/include 
--x-libraries=/opt/sfw/lib:/usr/openwin/lib'
Important settings:
  value of $LC_ALL: en_US
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: C
  locale-coding-system: iso-latin-1
  default-enable-multibyte-characters: t

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

I was attempting to read my mail; I had typed M-x rmail, followed by
my POPO password.  I think I typed ahead after that, but I can't
remember for sure.

Here is a stack backtrace:

(gdb) where
#0  0xfed9c840 in _libc_kill () from /usr/lib/libc.so.1
#1  0x000d8608 in fatal_error_signal (sig=11) at emacs.c:354
#2  <signal handler called>
#3  0x000699c8 in display_count_lines (start=0, start_byte=7463207, 
    limit_byte=0, count=11, byte_pos_ptr=0xffbed54c) at xdisp.c:14290
#4  0x000692e4 in decode_mode_spec (w=0x4c5e00, c=1, field_width=0, 
    precision=-50, multibyte=0x48) at xdisp.c:14048
#5  0x00068600 in display_mode_element (it=0xffbed7b0, depth=4, 
    field_width=-49, precision=-49, elt=808331988) at xdisp.c:13578
#6  0x000688c8 in display_mode_element (it=0xffbed7b0, depth=3, 
    field_width=-49, precision=-49, elt=1345443284) at xdisp.c:13743
#7  0x000688c8 in display_mode_element (it=0xffbed7b0, depth=1, 
    field_width=0, precision=0, elt=1345443076) at xdisp.c:13743
#8  0x000683b0 in display_mode_line (w=0x1, face_id=MODE_LINE_FACE_ID, 
    format=1345442940) at xdisp.c:13454
#9  0x00068334 in display_mode_lines (w=0x4c5e00) at xdisp.c:13411
#10 0x00068098 in redisplay_mode_lines (window=1078746624, force=0)
    at xdisp.c:13372
#11 0x0005c138 in echo_area_display (update_frame_p=1) at xdisp.c:7076
#12 0x0005a390 in message2_nolog (m=0x4d4000 "Loading mailcrypt...done", 
    nbytes=24, multibyte=0) at xdisp.c:5896
#13 0x0005a8ec in message_with_string (m=0x1a12f0 "Loading %s...done", 
    string=808559764, log=1) at xdisp.c:6063
#14 0x0015312c in Fload (file=808559764, noerror=2790976, 
    nomessage=271256580, nosuffix=2786304, must_suffix=271256628)
    at lread.c:866
#15 0x0013dd5c in do_autoload (fundef=1346153660, funname=274090180)
    at eval.c:1849
#16 0x0013f0d4 in Ffuncall (nargs=0, args=0xffbedfec) at eval.c:2721
#17 0x0013ea5c in run_hook_with_args (nargs=1, args=0xffbedfec, 
    cond=to_completion) at eval.c:2330
#18 0x0013e8ac in Frun_hooks (nargs=1, args=0xffbee0f4) at eval.c:2198
#19 0x0013f41c in Ffuncall (nargs=1, args=0xffbee0f0) at eval.c:2640
#20 0x0016da68 in Fbyte_code (bytestr=-4267792, vector=1, maxdepth=2)
    at bytecode.c:716
#21 0x0013e378 in Feval (form=1348043324) at eval.c:2019
#22 0x0013b88c in Fprogn (args=1348043364) at eval.c:431
#23 0x0013ff74 in unbind_to (count=64, value=271256580) at eval.c:3018
#24 0x0016ea04 in Fbyte_code (bytestr=-4267136, vector=7, maxdepth=4)
    at bytecode.c:746
#25 0x0013f71c in funcall_lambda (fun=1078707744, nargs=0, 
    arg_vector=0xffbee598) at eval.c:2851
#26 0x0013f190 in Ffuncall (nargs=0, args=0xffbee594) at eval.c:2707
#27 0x0013ed38 in apply1 (fn=271788660, arg=271256580) at eval.c:2412
#28 0x0013ab8c in Fcall_interactively (function=271788660, 
    record_flag=271256628, keys=1076641792) at callint.c:367
#29 0x000e7770 in Fcommand_execute (cmd=271788660, record_flag=271256628, 
    keys=271256580, special=1078707744) at keyboard.c:9221
#30 0x000e7b8c in Fexecute_extended_command (prefixarg=271256580)
    at keyboard.c:9327
#31 0x0013f2c4 in Ffuncall (nargs=1, args=0xffbee924) at eval.c:2659
#32 0x0013a1f0 in Fcall_interactively (function=271331100, 
    record_flag=271256580, keys=1076641792) at callint.c:797
#33 0x000e7770 in Fcommand_execute (cmd=271331100, record_flag=271256580, 
    keys=271256580, special=1075547652) at keyboard.c:9221
#34 0x000db524 in command_loop_1 () at keyboard.c:1644
#35 0x0013ce84 in internal_condition_case (bfun=0xdb0cc <command_loop_1>, 
    handlers=271378628, hfun=0xdac34 <cmd_error>) at eval.c:1267
#36 0x000daf5c in command_loop_2 () at keyboard.c:1245
#37 0x0013c9ec in internal_catch (tag=271330980, 
    func=0xdaf38 <command_loop_2>, arg=271256580) at eval.c:1030
#38 0x000daee8 in command_loop () at keyboard.c:1224
#39 0x000da9a0 in recursive_edit_1 () at keyboard.c:950
#40 0x000daafc in Frecursive_edit () at keyboard.c:1006
#41 0x000d98c0 in main (argc=0, argv=0xffbef05c, envp=0x197c00)
    at emacs.c:1547

Here is some other GDB output that you may find useful:

(gdb) p cursor
$1 = (unsigned char *) 0x1440000 <Address 0x1440000 out of bounds>
(gdb) p ceiling_addr
$2 = (
    unsigned char *) 0x13141ed "\037\f\n0, unseen,,\nSummary-line: 15-May       
 miles@lsi.nec.co.jp  [83] #Re: Replacement for C-x 8 based on input 
methods\nX-Coding-System: undecided-unix\nReceived: from alcor.twinsun.com 
(alcor.twinsun.c"...
(gdb) p base
$3 = (unsigned char *) 0x25 <Address 0x25 out of bounds>
(gdb) p start_byte
$4 = 7463207
(gdb) p limit_byte
$5 = 0
(gdb) p ceiling
$6 = 20005357
...
(gdb) p current_buffer->text[0]
$10 = {
  beg = 0xcfd7c8 "BABYL OPTIONS: -*- rmail -*-\nVersion: 5\nLabels:\nNote:   
This is the header of an rmail file.\nNote:   If you are seeing it in 
rmail,\nNote:    it means the file has no messages in it.\n\037\f\n1, 
filed,,\nSumm"..., 
  gpt = 6353524, z = 7514959, gpt_byte = 6380338, z_byte = 7548527, 
  gap_size = 3261, modiff = 119, save_modiff = 86, overlay_modiff = 3, 
  beg_unchanged = 6350855, end_unchanged = 0, unchanged_modified = 11, 
  overlay_unchanged_modified = 1, intervals = 0x0, markers = 540754484}