Emacs 20.2.1 segfaults in increment_row_positions()

[Andrew Ross]

This bug report will be sent to the Free Software Foundation,
not to your local site managers!
Please write in English, because the Emacs maintainers do not have
translators to read other languages for them.

Your bug report will be posted to the bug-gnu-emacs@gnu.org mailing list,
and to the gnu.emacs.bug news group.

In GNU Emacs 21.2.1 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2002-05-27 on shlc0022
configured using `configure  --prefix=/proj/tang/usertools/ia32_linux/'
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US
  locale-coding-system: iso-latin-1
  default-enable-multibyte-characters: t

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

It seems that the last action I make in emacs is generaly a mouse click in a 
buffer. Then it segfaults.
Below is the output from a GDB stack dump:

This GDB was configured as "i386-redhat-linux"...
Core was generated by `emacs -fn *courier-medium-r-normal-*-iso8859-1 
m_common_comps/M_MemWriter.cxx m'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/X11R6/lib/libXaw3d.so.7...done.
Loaded symbols for /usr/X11R6/lib/libXaw3d.so.7
Reading symbols from /usr/X11R6/lib/libXmu.so.6...done.
Loaded symbols for /usr/X11R6/lib/libXmu.so.6
Reading symbols from /usr/X11R6/lib/libXt.so.6...done.
Loaded symbols for /usr/X11R6/lib/libXt.so.6
Reading symbols from /usr/X11R6/lib/libSM.so.6...done.
Loaded symbols for /usr/X11R6/lib/libSM.so.6
Reading symbols from /usr/X11R6/lib/libICE.so.6...done.
Loaded symbols for /usr/X11R6/lib/libICE.so.6
Reading symbols from /usr/X11R6/lib/libXext.so.6...done.
Loaded symbols for /usr/X11R6/lib/libXext.so.6
Reading symbols from /usr/lib/libtiff.so.3...done.
Loaded symbols for /usr/lib/libtiff.so.3
Reading symbols from /usr/lib/libjpeg.so.62...done.
Loaded symbols for /usr/lib/libjpeg.so.62
Reading symbols from /usr/lib/libpng.so.2...done.
Loaded symbols for /usr/lib/libpng.so.2
Reading symbols from /usr/lib/libz.so.1...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /lib/i686/libm.so.6...done.
Loaded symbols for /lib/i686/libm.so.6
Reading symbols from /usr/lib/libungif.so.4...done.
Loaded symbols for /usr/lib/libungif.so.4
Reading symbols from /usr/X11R6/lib/libXpm.so.4...done.
Loaded symbols for /usr/X11R6/lib/libXpm.so.4
Reading symbols from /usr/X11R6/lib/libX11.so.6...done.
Loaded symbols for /usr/X11R6/lib/libX11.so.6
Reading symbols from /usr/lib/libncurses.so.5...done.
Loaded symbols for /usr/lib/libncurses.so.5
Reading symbols from /lib/i686/libc.so.6...done.
Loaded symbols for /lib/i686/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /lib/libnss_nis.so.2...done.
Loaded symbols for /lib/libnss_nis.so.2
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /usr/lib/gconv/ISO8859-1.so...done.
Loaded symbols for /usr/lib/gconv/ISO8859-1.so
#0  0x4033fb01 in __kill () from /lib/i686/libc.so.6
(gdb) bt
#0  0x4033fb01 in __kill () from /lib/i686/libc.so.6
#1  0x080df525 in fatal_error_signal (sig=11) at emacs.c:354
#2  <signal handler called>
#3  0x0805070d in increment_row_positions (row=0x84a14cc, delta=0, 
delta_bytes=0) at dispnew.c:1195
#4  0x0804feaf in increment_matrix_positions (matrix=0x862a5e8, start=9, 
end=39, delta=0, delta_bytes=0) at dispnew.c:927
#5  0x08069af0 in redisplay_internal (preserve_echo_area=0) at xdisp.c:8692
#6  0x08068a6d in redisplay () at xdisp.c:8273
#7  0x080e4a6b in read_char (commandflag=1, nmaps=2, maps=0xbfffb870, 
prev_event=405346940, used_mouse_menu=0xbfffb8a8) at keyboard.c:2272
#8  0x080eaeda in read_key_sequence (keybuf=0xbfffb9d0, bufsize=30, 
prompt=405346940, dont_downcase_last=0, can_return_switch_frame=1, 
fix_current_buffer=1) at keyboard.c:8180
#9  0x080e2214 in command_loop_1 () at keyboard.c:1440
#10 0x0813d2fe in internal_condition_case (bfun=0x80e2020 <command_loop_1>, 
handlers=405443260, hfun=0x80e1be0 <cmd_error>) at eval.c:1267
#11 0x080e1ed8 in command_loop_2 () at keyboard.c:1245
#12 0x0813ce8a in internal_catch (tag=405404868, func=0x80e1eb0 
<command_loop_2>, arg=405346940) at eval.c:1030
#13 0x080e1e84 in command_loop () at keyboard.c:1224
#14 0x080e197d in recursive_edit_1 () at keyboard.c:950
#15 0x080e1a9c in Frecursive_edit () at keyboard.c:1006
#16 0x080e0376 in main (argc=5, argv=0xbfffbf14, envp=0xbfffbf2c) at 
emacs.c:1547
#17 0x4032d647 in __libc_start_main (main=0x80dfb10 <main>, argc=5, 
ubp_av=0xbfffbf14, init=0x804d858 <_init>, fini=0x81889e0 <_fini>, 
rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbfffbf0c)
    at ../sysdeps/generic/libc-start.c:129

this was run on redHat 2.4 kernel on an ix86


Recent input:
<help-menu> <emacs-version> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<menu-bar> <help-menu> <report-emacs-bug> C-g <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <menu-bar> <help-menu> <emacs-version> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <menu-bar> 
<help-menu> <report-emacs-bug>

Recent messages:
isearch-abort: Quit [2 times]
Mark saved where search started
Loading view...done
Note: file is write protected
Type C-h for help, h for commands, q to quit.
isearch-abort: Quit
GNU Emacs 21.2.1 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars) of 
2002-05-27 on shlc0022
Loading emacsbug...done
byte-code: Quit
GNU Emacs 21.2.1 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars) of 
2002-05-27 on shlc0022