bug#10617: 24.0.92; Bidi crash reading a message from emacs-devel

[Nix]

On 30 Jan 2012, Eli Zaretskii stated:

>> From: Nix <nix@esperi.org.uk>
>> >> (gdb) print it->string
>> >> $6 = 12065314
>> >
>> > What does "xtype" say about this string?  If it says Lisp_String, what
>> > does "xstring" say?
>> 
>> (gdb) xtype
>> Lisp_Symbol
>> (gdb) xstring
>> $2 = (struct Lisp_String *) 0xb81a20
>> There is no member named data.
>> 
>> Not very useful.
>
> It's a symbol (see above), not a string, so using "xstring" with it is
> not useful.  Try "xsymbol" (I'm guessing it's nil).

Oh, how... obvious. I shouldn't respond to these when exhausted.

Ooo:

(gdb) xsymbol it->string
$2 = (struct Lisp_Symbol *) 0xb81a20
There is no member named data.
(gdb) print *((struct Lisp_Symbol *) 0xb81a20)
$3 = {
  gcmarkbit = 0,
  redirect = SYMBOL_PLAINVAL,
  constant = 1,
  interned = 2,
  declared_special = 0,
  xname = 8697697,
  val = {
    value = 12065314,
    alias = 0xb81a22,
    blv = 0xb81a22,
    fwd = 0xb81a22
  },
  function = 12065266,
  plist = 38661286,
  next = 0x0
}

(gdb) print/x Qnil
$6 = 0xb81a22

So this is clearly actually a forwarded or buffer-localized nil
variable, but redirect has become corrupted so that Emacs thinks,
incorrectly, that it's a value. Right?