bug#31888: 27.0.50; Segmentation fault in replace-buffer-contents

[Michał Kondraciuk]

Run this shell command in Emacs source tree (the file contents.c was
generated with clang-format):

emacs -Q src/dispnew.c contents.c --eval '(with-current-buffer
"dispnew.c" (replace-buffer-contents "contents.c"))'

Backtrace (full backtrace in attachment):
Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
0x00000000005b34cb in find_interval (tree=0x0, 
position=position@entry=-12) at ../../src/intervals.c:616
616           if (relative_position < LEFT_TOTAL_LENGTH (tree))
#0  0x00000000005b34cb in find_interval (tree=0x0, 
position=position@entry=-12) at ../../src/intervals.c:616
        relative_position = -13
#1  0x00000000005b4dfd in set_point_both (charpos=-12, bytepos=-12) at 
../../src/intervals.c:1864
        to = <optimized out>
        from = <optimized out>
        toprev = <optimized out>
        fromprev = <optimized out>
        buffer_point = <optimized out>
        old_position = 160
        backwards = true
        original_position = <optimized out>
#2  0x00000000005b5586 in set_point (charpos=<optimized out>) at 
../../src/intervals.c:1754
No locals.
#3  0x000000000055c40d in Freplace_buffer_contents (source=0x184d9a4) at 
../../src/editfns.c:3267
        end_a = <optimized out>
        end_b = <optimized out>
        beg_b = <optimized out>
        a = <optimized out>
        source_buffer = <optimized out>
        min_a = 1
        min_b = 1
        size_a = <optimized out>
        a_empty = <optimized out>
        b_empty = false
        diags = <optimized out>
        buffer = <optimized out>
        sa_avail = <optimized out>
        sa_must_free = <optimized out>
        del_bytes = <optimized out>
        ins_bytes = <optimized out>
        ctx = {buffer_a = 0x1727fa0, buffer_b = 0x177d180, deletions = 
0x184db90 "\254^", insertions = 0x1853ac0 "B\327\v", fdiag = 
0x7fffe336f158, bdiag = 0x7fffe36828e8, too_expensive = 1000000}
        i = <optimized out>
        j = <optimized out>

Lisp backtrace:
"replace-buffer-contents" (0xffffc9f0)
"save-current-buffer" (0xffffcad8)
"with-current-buffer" (0xffffcb98)
"eval" (0xffffcd28)
"command-line-1" (0xffffd340)
"command-line" (0xffffdb48)
"normal-top-level" (0xffffde60)



In GNU Emacs 27.0.50 (build 4, x86_64-pc-linux-gnu, X toolkit, Xaw3d 
scroll bars)
 of 2018-06-17 built on mkc
Repository revision: fa9679ca488a17b2b6b9f31299d69c190aa86642
Windowing system distributor 'The X.Org Foundation', version 11.0.11804000
System Description: Linux Mint 18.2

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Configured using:
 'configure --with-x-toolkit=lucid'

Configured features:
XAW3D XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GSETTINGS
NOTIFY LIBSELINUX GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS LUCID X11 THREADS LIBSYSTEMD LCMS2

Important settings:
  value of $LC_MONETARY: pl_PL.UTF-8
  value of $LC_NUMERIC: pl_PL.UTF-8
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message rmc puny seq byte-opt gv
bytecomp byte-compile cconv dired dired-loaddefs format-spec rfc822 mml
easymenu mml-sec password-cache epa derived epg epg-config gnus-util
rmail rmail-loaddefs mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader cl-loaddefs cl-lib sendmail rfc2047
rfc2045 ietf-drums mm-util mail-prsvr mail-utils elec-pair time-date
mule-util tooltip eldoc electric uniquify ediff-hook vc-hooks
lisp-float-type mwheel term/x-win x-win term/common-win x-dnd tool-bar
dnd fontset image regexp-opt fringe tabulated-list replace newcomment
text-mode elisp-mode lisp-mode prog-mode register page menu-bar
rfn-eshadow isearch timer select scroll-bar mouse jit-lock font-lock
syntax facemenu font-core term/tty-colors frame cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese composite charscript charprop
case-table epa-hook jka-cmpr-hook help simple abbrev obarray minibuffer
cl-preloaded nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote dbusbind inotify lcms2
dynamic-setting system-font-setting font-render-setting x-toolkit x
multi-tty make-network-process emacs)

Memory information:
((conses 16 94745 9710)
 (symbols 48 20133 1)
 (miscs 40 35 86)
 (strings 32 28988 1919)
 (string-bytes 1 755246)
 (vectors 16 14157)
 (vector-slots 8 503184 11636)
 (floats 8 50 67)
 (intervals 56 232 0)
 (buffers 992 11)
 (heap 1024 14329 1068))

gdb.txt
Description: Text document

contents.c
Description: Text Data