bug#23869: 25.0.95; replace-match can crash emacs

[Leo Liu]

On 2016-06-29 18:37 +0300, Eli Zaretskii wrote:
> Do you still have this crashed session in a debugger?  Because some of
> the values involved in this crash are not clear or not shown.

Yes.

[snipped 4 lines]
> The immediate reason is obviously the POSITION = -1 above, but the
> question is: how did replace-match allow that to happen?  It's a large
> function, so it's hard to tell how this could happen without seeing
> some of the variables there.
>
> Do you perhaps remember or know what text was replaced by what when
> this happened?

Luckily I am able to find a way to reproduce this.

1. Save the attached bug.el and bug.m to disk
2. start emacs like this:
   emacs -q -l ./bug.el ./bug.m
3. Make sure we are in the bug.m buffer and eval
   (unexport-defun "is_odd/1")

Emacs should crash.

bug.el
Description: bug.el

bug.m
Description: bug.m