bug#25684: 25.1; (downcase -1) segfaults Emacs on GNU/Linux

[Glenn Morris]

Wilfred Hughes wrote:

> The elisp primitives downcase and upcase cause Emacs to segfault when
> given a negative argument. For example, (downcase -1).
>
> I can reproduce this on Emacs 25.1 as well as on master. It occurs on
> GNU/Linux but not on OS X.

I can't reproduce this, but it seems to me that (downcase -1) should
signal a wrong-type-argument error, since negative numbers are not characters.
But I think there are probably subtleties here that I don't get.

--- i/src/casefiddle.c
+++ w/src/casefiddle.c
@@ -41,7 +41,7 @@
   if (NILP (XCHAR_TABLE (BVAR (current_buffer, downcase_table))->extras[1]))
     Fset_case_table (BVAR (current_buffer, downcase_table));
 
-  if (INTEGERP (obj))
+  if (NATNUMP (obj))
     {
       int flagbits = (CHAR_ALT | CHAR_SUPER | CHAR_HYPER
                      | CHAR_SHIFT | CHAR_CTL | CHAR_META);