bug#14444: segfault in emacs 24.3 in set_buffer_internal_1 (b=0xc3b1ad) at buffer.c:2133

[emacs-bugs . 20 . edCynonfev]

emacs 24.3 segfaults when doing the following:

After starting emas as "emacs -Q"

  * type:  M-: (add-hook 'buffer-list-update-hook (lambda () (message "foo")))

  * then type:  C-h ? i

This bug was originally seen on an amd64 Gentoo Linux (from which the
backtrace below was taken), and has also been reproduced on OpenBSD 5.3.
A couple of attempts were made to reproduce it on Ubuntu and Debian,
but failed.

The Gentoo Linux system was running kernel 3.7.10-gentoo-r1 #4 PREEMPT

============================================================================

Backtrace:

GNU gdb (Gentoo 7.3.1 p2) 7.3.1
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>...
Reading symbols from /home/me/emacs-24.3/src/emacs...done.
SIGINT is used by the debugger.
Are you sure you want to change it? (y or n) [answered Y; input not from 
terminal]
DISPLAY = :0
TERM = screen-256color
Breakpoint 1 at 0x53caef: file emacs.c, line 317.
Temporary breakpoint 2 at 0x5606f6: file sysdep.c, line 863.
(gdb) run -Q
Starting program: /home/me/emacs-24.3/src/emacs -Q
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffe8f2f700 (LWP 689)]
[New Thread 0x7fffe3fff700 (LWP 690)]

Program received signal SIGSEGV, Segmentation fault.
0x0000000000568852 in set_buffer_internal_1 (b=0xc3b1ad) at buffer.c:2133
2133        bset_undo_list (b, BVAR (b->base_buffer, undo_list));
(gdb) bt b
(gdb) bt full
#0  0x0000000000568852 in set_buffer_internal_1 (b=0xc3b1ad) at buffer.c:2133
        old_buf = 0xc55f10
        tail = 140737488337824
#1  0x000000000056416d in set_buffer_internal (b=0xc3b1ad) at buffer.h:1057
No locals.
#2  0x0000000000541083 in command_loop_1 () at keyboard.c:1396
        cmd = 16141446
        keybuf = {140737488336272, 12825058, 140737488336288, 6281604, 
17008306, 140737488336384, 12825058, 20002006,
          21218352, 0, 4289440, 4093019759, 140737488336192, 5555673, 
140737488336224, 5257661, 139646566643072, 19108352,
          140737488336272, 5170221, 140737488335824, 19108352, 12670256, 0, 
140737488336288, 12825058, 140737488336352,
          5507800, 140737488336384, 20002006}
        i = 0
        prev_modiff = 0
        prev_buffer = 0x0
        already_adjusted = false
#3  0x00000000005d8f4f in internal_condition_case (bfun=0x540eae 
<command_loop_1>, handlers=12876690,
    hfun=0x5407b6 <cmd_error>) at eval.c:1289
        val = 1
        c = {
          tag = 12825010,
          val = 12825010,
          next = 0x7fffffffb820,
          gcpro = 0x0,
          jmp = {{
              __jmpbuf = {2, -3647302737333739132, 4289440, 140737488337824, 0, 
0, -3647302737285504636,
                3647302412860498308},
              __mask_was_saved = 0,
              __saved_mask = {
                __val = {3647302412860498308, 0, 140737247930976, 4294967295, 
2, 9294456, 0, 0, 0, 0, 140737351948860, 1, 0,
                  1, 140737244092856, 0}
              }
            }},
          backlist = 0x0,
          handlerlist = 0x0,
          lisp_eval_depth = 0,
          pdlcount = 2,
          poll_suppress_count = 1,
          interrupt_input_blocked = 0,
          byte_stack = 0x0
        }
        h = {
          handler = 12876690,
          var = 12825010,
          chosen_clause = 12876690,
          tag = 0x7fffffffb6a0,
          next = 0x0
        }
#4  0x0000000000540bc7 in command_loop_2 (ignore=12825010) at keyboard.c:1168
        val = 2
#5  0x00000000005d8923 in internal_catch (tag=12872530, func=0x540ba1 
<command_loop_2>, arg=12825010) at eval.c:1060
        c = {
          tag = 12872530,
          val = 12825010,
          next = 0x0,
          gcpro = 0x0,
          jmp = {{
              __jmpbuf = {2, -3647302737384070780, 4289440, 140737488337824, 0, 
0, -3647302737358904956,
                3647302413036134788},
              __mask_was_saved = 0,
              __saved_mask = {
                __val = {12825010, 140737488337168, 6034137, 4294967296, 
12825010, 12825010, 13073330, 140737488337264,
                  140737488337272, 12222528, 12851808, 140737488337168, 
6032653, 140737488337232, 13073328, 352}
              }
            }},
          backlist = 0x0,
          handlerlist = 0x0,
          lisp_eval_depth = 0,
          pdlcount = 2,
          poll_suppress_count = 1,
          interrupt_input_blocked = 0,
          byte_stack = 0x0
        }
#6  0x0000000000540b79 in command_loop () at keyboard.c:1147
No locals.
#7  0x0000000000540303 in recursive_edit_1 () at keyboard.c:779
        count = 1
        val = 12825010
#8  0x00000000005404a9 in Frecursive_edit () at keyboard.c:843
        count = 0
        buffer = 12825010
#9  0x000000000053e476 in main (argc=2, argv=0x7fffffffbba8) at emacs.c:1528
        dummy = 4246560
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = true
        dumping = false
        skip_args = 0
        rlim = {
          rlim_cur = 8720000,
          rlim_max = 18446744073709551615
        }
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0xfc7e30 "\320\023;\001"
(gdb) xbacktrace
(gdb) quit
A debugging session is active.

        Inferior 1 [process 675] will be killed.

Quit anyway? (y or n) y

============================================================================

In GNU Emacs 24.3.1 (x86_64-unknown-linux-gnu, GTK+ Version 3.2.4)
 of 2013-05-22 on saturn
Windowing system distributor `The X.Org Foundation', version 11.0.11304000
Configured using:
 `configure '--prefix=/usr/local/debug-emacs' 'CC=gcc-4.5.3' 'CFLAGS=-O0
 -ggdb3''

Important settings:
  value of $LC_COLLATE: en_US.UTF-8
  value of $LC_CTYPE: en_US.UTF-8
  value of $LC_MESSAGES: en_US.UTF-8
  value of $LC_MONETARY: en_US.UTF-8
  value of $LC_NUMERIC: en_US.UTF-8
  value of $LC_TIME: en_US.UTF-8
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x r e p o r t <tab> <return>

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr emacsbug message format-spec rfc822 mml
easymenu mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils time-date tooltip ediff-hook vc-hooks
lisp-float-type mwheel x-win x-dnd tool-bar dnd fontset image regexp-opt
fringe tabulated-list newcomment lisp-mode register page menu-bar
rfn-eshadow timer select scroll-bar mouse jit-lock font-lock syntax
facemenu font-core frame cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese hebrew greek romanian slovak
czech european ethiopic indian cyrillic chinese case-table epa-hook
jka-cmpr-hook help simple abbrev minibuffer loaddefs button faces
cus-face macroexp files text-properties overlay sha1 md5 base64 format
env code-pages mule custom widget hashtable-print-readable backquote
make-network-process dbusbind dynamic-setting system-font-setting
font-render-setting move-toolbar gtk x-toolkit x multi-tty emacs)