Emacs 22.0.50.1 crash on make_uninit_multibyte_string

[Daniel Barrett]

Here's a stacktrace of a crash in emacs 22.0.50.1.  Let me know if you want
me to examine any values in this core dump.

Platform: SUSE 9.1 Professional with latest patches
Linux myhost 2.6.5-7.201-smp #1 SMP Thu Aug 25 06:20:45 UTC 2005 i686 i686 i386 
GNU/Linux

$ gdb emacs core
GNU gdb 6.1
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i586-suse-linux"...Using host libthread_db library 
"/lib/tls/libthread_db.so.1".

Core was generated by `emacs -f vm'.
Program terminated with signal 11, Segmentation fault.

warning: current_sos: Can't read pathname for load map: Input/output error

Reading symbols from /usr/X11R6/lib/libXaw3d.so.7...done.
Loaded symbols for /usr/X11R6/lib/libXaw3d.so.7
Reading symbols from /usr/X11R6/lib/libXmu.so.6...done.
Loaded symbols for /usr/X11R6/lib/libXmu.so.6
Reading symbols from /usr/X11R6/lib/libXt.so.6...done.
Loaded symbols for /usr/X11R6/lib/libXt.so.6
Reading symbols from /usr/X11R6/lib/libSM.so.6...done.
Loaded symbols for /usr/X11R6/lib/libSM.so.6
Reading symbols from /usr/X11R6/lib/libICE.so.6...done.
Loaded symbols for /usr/X11R6/lib/libICE.so.6
Reading symbols from /usr/X11R6/lib/libXext.so.6...done.
Loaded symbols for /usr/X11R6/lib/libXext.so.6
Reading symbols from /usr/lib/libtiff.so.3...done.
Loaded symbols for /usr/lib/libtiff.so.3
Reading symbols from /usr/lib/libjpeg.so.62...done.
Loaded symbols for /usr/lib/libjpeg.so.62
Reading symbols from /usr/lib/libpng.so.3...done.
Loaded symbols for /usr/lib/libpng.so.3
Reading symbols from /lib/libz.so.1...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib/tls/libm.so.6...done.
Loaded symbols for /lib/tls/libm.so.6
Reading symbols from /usr/lib/libungif.so.4...done.
Loaded symbols for /usr/lib/libungif.so.4
Reading symbols from /usr/X11R6/lib/libXpm.so.4...done.
Loaded symbols for /usr/X11R6/lib/libXpm.so.4
Reading symbols from /usr/X11R6/lib/libX11.so.6...done.
Loaded symbols for /usr/X11R6/lib/libX11.so.6
Reading symbols from /lib/libncurses.so.5...done.
Loaded symbols for /lib/libncurses.so.5
Reading symbols from /lib/tls/libc.so.6...done.
Loaded symbols for /lib/tls/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from 
/usr/X11R6/lib/X11/locale/lib/common/xlcUTF8Load.so.2...done.
Loaded symbols for /usr/X11R6/lib/X11/locale/lib/common/xlcUTF8Load.so.2
Reading symbols from /usr/X11R6/lib/libXcursor.so.1...done.
Loaded symbols for /usr/X11R6/lib/libXcursor.so.1
Reading symbols from /usr/X11R6/lib/libXrender.so.1...done.
Loaded symbols for /usr/X11R6/lib/libXrender.so.1
Reading symbols from /usr/X11R6/lib/X11/locale/lib/common/ximcp.so.2...done.
Loaded symbols for /usr/X11R6/lib/X11/locale/lib/common/ximcp.so.2
Reading symbols from 
/usr/X11R6/lib/X11/locale/lib/common/xomGeneric.so.2...done.
Loaded symbols for /usr/X11R6/lib/X11/locale/lib/common/xomGeneric.so.2
#0  make_uninit_multibyte_string (nchars=85, nbytes=85) at alloc.c:1880
1880      string_free_list = NEXT_FREE_LISP_STRING (s);
(gdb) bt
#0  make_uninit_multibyte_string (nchars=85, nbytes=85) at alloc.c:1880
#1  0x08133340 in make_uninit_string (length=85) at alloc.c:2441
#2  0x08154f45 in concat (nargs=1, args=0xbfffcb84, target_type=Lisp_String, 
last_special=0) at fns.c:661
#3  0x08155f35 in Fcopy_sequence (arg=139679403) at fns.c:528
#4  0x0812236e in compile_pattern_1 (cp=0x82f5510, pattern=139679403, 
translate=137363473, regp=0x0, posix=0, multibyte=0) at search.c:183
#5  0x081224ed in compile_pattern (pattern=139679403, regp=0x0, 
translate=137363473, posix=0, multibyte=0) at search.c:248
#6  0x08123a6d in fast_string_match (regexp=139679403, string=142755163) at 
search.c:471
#7  0x0810f9df in Ffind_file_name_handler (filename=142755163, 
operation=137496889) at fileio.c:362
#8  0x0811005c in Fexpand_file_name (name=142755163, 
default_directory=137363473) at fileio.c:1063
#9  0x08111f3b in Fdo_auto_save (no_message=137363521, current_only=137363473) 
at fileio.c:5906
#10 0x080e403a in shut_down_emacs (sig=11, no_x=0, stuff=137363473) at 
emacs.c:2127
#11 0x080e598a in fatal_error_signal (sig=11) at emacs.c:410
#12 <signal handler called>
#13 make_uninit_multibyte_string (nchars=5, nbytes=5) at alloc.c:1880
#14 0x08133340 in make_uninit_string (length=5) at alloc.c:2441
#15 0x08154f45 in concat (nargs=2, args=0xbfffd250, target_type=Lisp_String, 
last_special=0) at fns.c:661
#16 0x08172843 in Fbyte_code (bytestr=142569497, vector=141302980, maxdepth=40) 
at bytecode.c:1060
#17 0x08147b3f in funcall_lambda (fun=141302980, nargs=2, 
arg_vector=0xbfffd300) at eval.c:3046
#18 0x08147c3f in apply_lambda (fun=142474628, args=40, eval_flag=1) at 
eval.c:2968
#19 0x0814742c in Feval (form=142349469) at eval.c:2260
#20 0x08147c69 in apply_lambda (fun=142829268, args=142349469, eval_flag=1) at 
eval.c:2976
#21 0x0814742c in Feval (form=142349437) at eval.c:2260
#22 0x081476b4 in Feval (form=142349245) at eval.c:2167
#23 0x081476b4 in Feval (form=142348749) at eval.c:2167
#24 0x08148032 in Ffuncall (nargs=2, args=0xbfffd7a0) at eval.c:2869
#25 0x08172beb in Fbyte_code (bytestr=137540265, vector=142194964, maxdepth=32) 
at bytecode.c:689
#26 0x08147b3f in funcall_lambda (fun=142194964, nargs=3, 
arg_vector=0xbfffd8a8) at eval.c:3046
#27 0x08147e94 in Ffuncall (nargs=4, args=0xbfffd8a4) at eval.c:2914
#28 0x08172beb in Fbyte_code (bytestr=137620265, vector=142248012, maxdepth=48) 
at bytecode.c:689
#29 0x08147b3f in funcall_lambda (fun=142248012, nargs=1, 
arg_vector=0xbfffd9b4) at eval.c:3046
#30 0x08147e94 in Ffuncall (nargs=2, args=0xbfffd9b0) at eval.c:2914
#31 0x08172beb in Fbyte_code (bytestr=137620265, vector=142360452, maxdepth=88) 
at bytecode.c:689
#32 0x08147b3f in funcall_lambda (fun=142360452, nargs=1, 
arg_vector=0xbfffdad4) at eval.c:3046
#33 0x08147e94 in Ffuncall (nargs=2, args=0xbfffdad0) at eval.c:2914
#34 0x08172beb in Fbyte_code (bytestr=145841673, vector=142370252, maxdepth=32) 
at bytecode.c:689
#35 0x08147b3f in funcall_lambda (fun=142370252, nargs=1, 
arg_vector=0xbfffdbd4) at eval.c:3046
#36 0x08147e94 in Ffuncall (nargs=2, args=0xbfffdbd0) at eval.c:2914
#37 0x08172beb in Fbyte_code (bytestr=137620265, vector=143077724, maxdepth=40) 
at bytecode.c:689
#38 0x08147b3f in funcall_lambda (fun=143077724, nargs=5, 
arg_vector=0xbfffdce4) at eval.c:3046
#39 0x08147e94 in Ffuncall (nargs=6, args=0xbfffdce0) at eval.c:2914
#40 0x08172beb in Fbyte_code (bytestr=137672049, vector=143078268, maxdepth=48) 
at bytecode.c:689
#41 0x08147b3f in funcall_lambda (fun=143078268, nargs=2, 
arg_vector=0xbfffddf4) at eval.c:3046
#42 0x08147e94 in Ffuncall (nargs=3, args=0xbfffddf0) at eval.c:2914
#43 0x08172beb in Fbyte_code (bytestr=141153593, vector=143041556, maxdepth=48) 
at bytecode.c:689
#44 0x08147b3f in funcall_lambda (fun=143041556, nargs=0, 
arg_vector=0xbfffdf04) at eval.c:3046
#45 0x08147e94 in Ffuncall (nargs=1, args=0xbfffdf00) at eval.c:2914
#46 0x08172beb in Fbyte_code (bytestr=142060609, vector=142554956, maxdepth=72) 
at bytecode.c:689
#47 0x08147b3f in funcall_lambda (fun=142554956, nargs=1, 
arg_vector=0xbfffe054) at eval.c:3046
#48 0x08147e94 in Ffuncall (nargs=2, args=0xbfffe050) at eval.c:2914
#49 0x08144a04 in Fcall_interactively (function=142022337, 
record_flag=137363473, keys=143479116) at callint.c:884
#50 0x080e8ad7 in Fcommand_execute (cmd=142022337, record_flag=137363473, 
keys=137363473, special=137363473) at keyboard.c:9711
#51 0x080f3936 in command_loop_1 () at keyboard.c:1782
#52 0x08146b0d in internal_condition_case (bfun=0x80f35a0 <command_loop_1>, 
handlers=137424465, hfun=0x80ee4f0 <cmd_error>) at eval.c:1451
#53 0x080ed85c in command_loop_2 () at keyboard.c:1318
#54 0x08146bea in internal_catch (tag=5, func=0x80ed840 <command_loop_2>, 
arg=137363473) at eval.c:1210
#55 0x080ee1d7 in command_loop () at keyboard.c:1297
#56 0x080ee272 in recursive_edit_1 () at keyboard.c:990
#57 0x080ee38f in Frecursive_edit () at keyboard.c:1051
#58 0x080e5115 in main (argc=3, argv=0xbfffe874) at emacs.c:1782
(gdb) quit
$