bug#15907: 24.3; Emacs crash due to substitute-command-keys and after-change-functions

[Eli Zaretskii]

> Date: Sat, 16 Nov 2013 11:46:21 +0000
> From: Bruce Connor <bruce.connor.am@gmail.com>
> 
> The real life use case was that having smart-mode-line active meant emacs
> would crash everytime I hit "C-h m".
> 
> However, I patched smart-mode-line with a work around for this yesterday,
> so it's not a use case anymore. I just figured "format" was such a basic
> function that it was good to report it anyway.

You may wish patching your Emacs with the patch below instead.

The problem was not in 'format', but in substitute-command-keys, btw.

Here's how I fixed that:

=== modified file 'src/doc.c'
--- src/doc.c   2013-08-11 01:30:20 +0000
+++ src/doc.c   2013-11-16 10:20:32 +0000
@@ -850,6 +850,7 @@ Otherwise, return a new string, without 
          /* This is for computing the SHADOWS arg for describe_map_tree.  */
          Lisp_Object active_maps = Fcurrent_active_maps (Qnil, Qnil);
          Lisp_Object earlier_maps;
+         ptrdiff_t count = SPECPDL_INDEX ();
 
          changed = 1;
          strp += 2;            /* skip \{ or \< */
@@ -886,6 +887,10 @@ Otherwise, return a new string, without 
          /* Now switch to a temp buffer.  */
          oldbuf = current_buffer;
          set_buffer_internal (XBUFFER (Vprin1_to_string_buffer));
+         /* This is for an unusual case where some after-change
+            function uses 'format' or 'prin1' or something else that
+            will thrash Vprin1_to_string_buffer we are using.  */
+         specbind (Qinhibit_modification_hooks, Qt);
 
          if (NILP (tem))
            {
@@ -910,6 +915,7 @@ Otherwise, return a new string, without 
          tem = Fbuffer_string ();
          Ferase_buffer ();
          set_buffer_internal (oldbuf);
+         unbind_to (count, Qnil);
 
        subst_string:
          start = SDATA (tem);

=== modified file 'src/keymap.c'
--- src/keymap.c        2013-08-11 01:30:20 +0000
+++ src/keymap.c        2013-11-16 09:24:19 +0000
@@ -3383,9 +3383,12 @@ describe_map (Lisp_Object map, Lisp_Obje
 
       if (vect[i].shadowed)
        {
-         SET_PT (PT - 1);
+         ptrdiff_t pt = max (PT - 1, BEG);
+
+         SET_PT (pt);
          insert_string ("\n  (that binding is currently shadowed by another 
mode)");
-         SET_PT (PT + 1);
+         pt = min (PT + 1, Z);
+         SET_PT (pt);
        }
     }