bug#9401: 24.0.50; Crash during fontification

[Stefan Monnier]

> I can trigger this crash about 50 percent of the time by doing
> emacs -q trunk/src/buffer.h
> C-s defvar

> Emacs then crashes with a segfault.

> The problem involves a call to scan_sexps_forward (frame#4) with
> from_byte larger than the byte size of the buffer.

[...]

> #4  0x00000000006300a5 in scan_sexps_forward (stateptr=0x7fffffff30b0,
>     from=26298, from_byte=48082, end=38471, targetdepth=-10000, stopbefore=0,
>     oldstate=12552834, commentstop=0) at syntax.c:3133
> #5  0x000000000061e721 in back_comment (from=38165, from_byte=38165, stop=1,
>     comnested=0, comstyle=0, charpos_ptr=0x7fffffff3418,
>     bytepos_ptr=0x7fffffff3420) at syntax.c:733

There's something pretty fishy going on, indeed, since we end going
"back" from 38165/38165 to 26298/38471, i.e. the char position is
smaller but the byte position is larger.


        Stefan