simple elisp code crashes emacs

[Chris Hecker]

This bug report will be sent to the Free Software Foundation,
 not to your local site managers!!
Please write in English, because the Emacs maintainers do not have
translators to read other languages for them.

In GNU Emacs 20.7.1 (i386-*-nt5.0.2195)
 of Tue Jun 13 2000 on buffy
configured using `configure NT'

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

If you eval the following elisp code in a buffer with eval-last-sexp
(once after the defun, then after the call), emacs 20.7 crashes on NT
and hangs on Win98.  The crash appears to be in malloc.

(defun inv-newt (N S)
  (let ((i 0) (iter 10)
        (x N) xp)
    (while (< i iter)
      (setq xp (- (* 2.0 x) (* N x x)))
      (insert (format "%f\n" xp))
      (setq x xp)
      (setq i (+ 1 i)))))

(inv-newt 2.0 2.0)


Recent input:
ESC x r e p SPC SPC o r SPC return

Recent messages:
Loading smtpmail (source)...
Loading smtpmail (source)...done
Loading message...
Loading message...done
For information about the GNU Project and its goals, type C-h C-p.
Fontifying *scratch*...
Fontifying *scratch*... (regexps............)
For information about the GNU Project and its goals, type C-h C-p.
Loading emacsbug...
Loading emacsbug...done