bug#3500: 23.0.94; [NS/Cocoa] Crash when entering accented chacters with Flyspell enabled

[Ian Eure]

Recent (this morning) CVS crashes if you enter an accented character  
with Flyspell enablaed.

Steps to reproduce:
1. Launch emacs with -Q
2. Change modifiers so Option isn’t mapped:
   (setq mac-command-modifier 'meta mac-option-modifier nil)
3. Enable flyspell:
   M-x flyspell-mode RET
4. Type a a word with an accented character:
   touché SPC

   (That’s: t o u c h option-e e)

Emacs crashes with:
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x000ce138 in kbd_buffer_get_event (kbp=0xbfffdfa8,  
used_mouse_menu=0x0, end_time=0xbfffe138) at keyboard.c:4165
4165              *used_mouse_menu = 1;


If flyspell-mode is disabled, Emacs doesn’t crash.

`bt full' output:

(gdb) bt full
#0  0x000ce138 in kbd_buffer_get_event (kbp=0xbfffdfa8,  
used_mouse_menu=0x0, end_time=0xbfffe138) at keyboard.c:4165
        event = (struct input_event *) 0x3ad3f4
        c = 0
        obj = 8252437
#1  0x000cbb65 in read_char (commandflag=0, nmaps=0, maps=0x0,  
prev_event=25165881, used_mouse_menu=0x0, end_time=0xbfffe138) at  
keyboard.c:3059
        kb = (KBOARD *) 0x839260
        c = 25165833
        count = -1
        jmpcount = 8
	local_getcjmp = {895, -1073749600, 8098, 830008, 863736, -1073749600,  
-1073749388, 1645590, -1073749768, -1073750208, 31, 658, 831883, 23,  
-65505, -65505, 0, 55}
        save_jump = {0 <repeats 18 times>}
        key_already_recorded = 0
        tem = 25165833
        save = 25165833
        previous_echo_area_message = 25165833
        also_record = 25165833
        reread = 0
        gcpro1 = {
  next = 0x939be2eb,
  var = 0x1f0b11,
  nvars = -1073749600
}
        gcpro2 = {
  next = 0x2,
  var = 0x8529e0,
  nvars = -1764089896
}
        polling_stopped_here = 1
        orig_kboard = (struct kboard *) 0x839260
#2  0x0019198d in read_filtered_event (no_switch_frame=0,  
ascii_required=0, error_nonascii=0, input_method=0, seconds=24) at  
lread.c:707
        val = 8
        delayed_switch_frame = 25165833
        end_time = {
  tv_sec = 1244497951,
  tv_usec = 581814
}
#3  0x00191c89 in Fread_event (prompt=25165833,  
inherit_input_method=25165833, seconds=24) at lread.c:821
No locals.
#4  0x00168bc4 in Ffuncall (nargs=4, args=0xbfffe270) at eval.c:3051
        fun = 3820052
        original_fun = 25246497
        funcar = 0
        numargs = 3
        lisp_numargs = 1803477
        val = 25165881
        backtrace = {
  next = 0xbfffe550,
  function = 0xbfffe270,
  args = 0xbfffe274,
  nargs = 3,
  evalargs = 0 '\0',
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0xbfffe274
        i = 1
#5  0x001b9105 in Fbyte_code (bytestr=2401179, vector=2401196,  
maxdepth=40) at bytecode.c:678
        count = 8
        op = 3
        vectorp = (Lisp_Object *) 0x24a3b0
        bytestr_length = 90
        stack = {
  pc = 0x39549f "?\034??X",
  top = 0xbfffe27c,
  bottom = 0xbfffe270,
  byte_string = 2401179,
  byte_string_start = 0x39545f "\b??\020",
  constants = 2401196,
  next = 0xbfffe648
}
        top = (Lisp_Object *) 0xbfffe270
        result = -41
#6  0x00169450 in funcall_lambda (fun=2401116, nargs=1,  
arg_vector=0xbfffe5b4) at eval.c:3232
        val = 1476369
        syms_left = 25165833
        next = 25474761
        count = 5
        i = 1
        optional = 1
        rest = 0
#7  0x00168e31 in Ffuncall (nargs=2, args=0xbfffe5b0) at eval.c:3091
        fun = 2401116
        original_fun = 25471361
        funcar = 5206269
        numargs = 1
        lisp_numargs = 1803477
        val = -1073748584
        backtrace = {
  next = 0xbfffe880,
  function = 0xbfffe5b0,
  args = 0xbfffe5b4,
  nargs = 1,
  evalargs = 0 '\0',
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x1805e4a
        i = 25189962
#8  0x001b9105 in Fbyte_code (bytestr=33606163, vector=23225812,  
maxdepth=16) at bytecode.c:678
        count = 5
        op = 1
        vectorp = (Lisp_Object *) 0x16265d8
        bytestr_length = 81
        stack = {
  pc = 0x21021f8 "?̇̇",
  top = 0xbfffe5b4,
  bottom = 0xbfffe5b0,
  byte_string = 33606163,
  byte_string_start = 0x21021ac "dSeX?\t",
  constants = 23225812,
  next = 0xbfffe978
}
        top = (Lisp_Object *) 0xbfffe5b0
        result = 25165833
#9  0x00169450 in funcall_lambda (fun=23225988, nargs=0,  
arg_vector=0xbfffe8e4) at eval.c:3232
        val = 25165833
        syms_left = 25165833
        next = 2096
        count = 5
        i = 0
        optional = 0
        rest = 0
#10 0x00168e31 in Ffuncall (nargs=1, args=0xbfffe8e0) at eval.c:3091
        fun = 23225988
        original_fun = 33605145
        funcar = 1
        numargs = 0
        lisp_numargs = 1359974
        val = 25165833
        backtrace = {
  next = 0xbfffebb0,
  function = 0xbfffe8e0,
  args = 0xbfffe8e4,
  nargs = 0,
  evalargs = 0 '\0',
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x180975a
        i = 25204570
#11 0x001b9105 in Fbyte_code (bytestr=33607635, vector=8509204,  
maxdepth=32) at bytecode.c:678
        count = 3
        op = 0
        vectorp = (Lisp_Object *) 0x81d718
        bytestr_length = 121
        stack = {
  pc = 0x210262b "?*",
  top = 0xbfffe8e0,
  bottom = 0xbfffe8e0,
  byte_string = 33607635,
  byte_string_start = 0x2102610 "\b?x",
  constants = 8509204,
  next = 0x0
}
        top = (Lisp_Object *) 0xbfffe8e0
        result = 24110326
#12 0x00169450 in funcall_lambda (fun=8509412, nargs=0,  
arg_vector=0xbfffeca0) at eval.c:3232
        val = 25501976
        syms_left = 25165833
        next = 6297212
        count = 3
        i = 0
        optional = 0
        rest = 0
#13 0x00168e31 in Ffuncall (nargs=1, args=0xbfffec9c) at eval.c:3091
        fun = 8509412
        original_fun = 33930793
        funcar = 1362040
        numargs = 0
        lisp_numargs = 34545322
        val = 25165833
        backtrace = {
  next = 0xbfffed20,
  function = 0xbfffec9c,
  args = 0xbfffeca0,
  nargs = 0,
  evalargs = 0 '\0',
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x1800009
        i = 34545322
#14 0x00168413 in run_hook_with_args (nargs=1, args=0xbfffec9c,  
cond=to_completion) at eval.c:2704
        sym = 25196057
        val = 8191213
        ret = 25165833
        globals = 25165833
        gcpro1 = {
  next = 0x0,
  var = 0x0,
  nvars = 33827088
}
        gcpro2 = {
  next = 0xbfffec78,
  var = 0x181b109,
  nvars = 25165833
}
        gcpro3 = {
  next = 0x82787a,
  var = 0x105,
  nvars = 1480343
}
#15 0x001681dc in Frun_hooks (nargs=1, args=0xbfffeda4) at eval.c:2567
        hook = {33930793}
        i = 0
#16 0x00168a21 in Ffuncall (nargs=2, args=0xbfffeda0) at eval.c:3026
        fun = 3815364
        original_fun = 25255761
        funcar = 1021522
        numargs = 1
        lisp_numargs = 0
        val = -1073746552
        backtrace = {
  next = 0x0,
  function = 0xbfffeda0,
  args = 0xbfffeda4,
  nargs = 1,
  evalargs = 0 '\0',
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x828
        i = 2096
#17 0x00168630 in call1 (fn=25255761, arg1=25196057) at eval.c:2830
        ret_ungc_val = 1142808
        gcpro1 = {
  next = 0x0,
  var = 0x116299,
  nvars = 2
}
#18 0x000ca3bf in safe_run_hooks_1 (hook=-1073746408) at keyboard.c:2156
No locals.
#19 0x00165fac in internal_condition_case (bfun=0xca36b  
<safe_run_hooks_1>, handlers=25165881, hfun=0xca3cb  
<safe_run_hooks_error>) at eval.c:1512
        val = 677756
        c = {
  tag = 25165833,
  val = 25165833,
  next = 0xbffff0a8,
  gcpro = 0x0,
  jmp = {-1073806465, 25253690, 8098, 1465995, 0, 1, 0, 25165833,  
-1073746296, -1073746480, 31, 658, 1466161, 1441815, 25231391,  
25165855, 6291456, 55},
  backlist = 0x0,
  handlerlist = 0xbffff094,
  lisp_eval_depth = 0,
  pdlcount = 3,
  poll_suppress_count = 0,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        h = {
  handler = 25165881,
  var = 25165833,
  chosen_clause = 1361607,
  tag = 0xbfffee08,
  next = 0xbffff094
}
#20 0x000ca4a3 in safe_run_hooks (hook=25196057) at keyboard.c:2184
        count = 2
#21 0x000c95a7 in command_loop_1 () at keyboard.c:1920
        cmd = 25195913
        lose = 0
        nonundocount = 5
	keybuf = {832, 40, -1566119790, 4122928, -1754246680, -1880941672,  
-1880949728, -1073745796, 152, 0, 4706304, 163, 1245186, 249856,  
-1880941408, 182, 151, 41910568, -1826387128, 230, 9, 0, -1073745904,  
-1073746208, 0, 524288, 25165833, 25599729, 2600356, 4856205}
        i = 1
        prev_modiff = 336
        prev_buffer = (struct buffer *) 0x601678
        already_adjusted = 0
#22 0x00165fac in internal_condition_case (bfun=0xc775e  
<command_loop_1>, handlers=25205425, hfun=0xc6e67 <cmd_error>) at  
eval.c:1512
        val = 4856205
        c = {
  tag = 25165833,
  val = 25165833,
  next = 0xbffff16c,
  gcpro = 0x0,
  jmp = {-1073806465, 76, 8098, 1465995, 33630208, 1464437, 0, 0,  
-1073745624, -1073745808, 31, 658, 1466161, -1826422761, 31, 31, 0, 55},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 0,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        h = {
  handler = 25205425,
  var = 25165833,
  chosen_clause = -1881116971,
  tag = 0xbffff0a8,
  next = 0x0
}
#23 0x000c738e in command_loop_2 () at keyboard.c:1359
        val = 4028928
#24 0x0016593d in internal_catch (tag=25201545, func=0xc7359  
<command_loop_2>, arg=25165833) at eval.c:1248
        c = {
  tag = 25201545,
  val = 25165833,
  next = 0x0,
  gcpro = 0x0,
  jmp = {-1826421889, 0, 8098, 1464437, -1826422635, 0, 0, 0,  
-1073745432, -1073745584, 25296927, 662, 1464622, 23, 25165855,  
-1073807329, 25296896, 25296951},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 0,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
#25 0x000c7317 in command_loop () at keyboard.c:1338
No locals.
#26 0x000c68eb in recursive_edit_1 () at keyboard.c:953
        count = 1
        val = 1481113
#27 0x000c6af4 in Frecursive_edit () at keyboard.c:1015
        count = 0
        buffer = 25165833
#28 0x000c4df9 in main (argc=2, argv=0xbffff47c) at emacs.c:1852
        dummy = 0
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {
  rlim_cur = 8388608,
  rlim_max = 67104768
}
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
	dname_arg2 = "|???\002\000\000\000X???r\030?? 
\000\020\000\000\000\000\000\000\002\000\000\000|???????\030???", '\0'  
<repeats 39 times>

`xbacktrace' output:



In GNU Emacs 23.0.94.1 (i386-apple-darwin9.7.0, NS apple-appkit-949.46)
 of 2009-06-08 on neutron.local
Windowing system distributor `Apple', version 10.3.949
configured using `configure  '--with-ns''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  value of $XMODIFIERS: nil
  locale-coding-system: nil
  default-enable-multibyte-characters: t

Major mode: Inferior Python

Minor modes in effect:
  diff-auto-refine-mode: t
  erc-track-mode: t
  erc-track-minor-mode: t
  erc-spelling-mode: t
  erc-ring-mode: t
  erc-pcomplete-mode: t
  erc-netsplit-mode: t
  erc-match-mode: t
  erc-button-mode: t
  erc-fill-mode: t
  erc-autojoin-mode: t
  erc-irccontrols-mode: t
  erc-noncommands-mode: t
  erc-readonly-mode: t
  erc-scrolltobottom-mode: t
  compilation-shell-minor-mode: t
  which-function-mode: t
  yas/minor-mode: t
  shell-dirtrack-mode: t
  ime-bindings: t
  show-paren-mode: t
  recentf-mode: t
  iswitchb-mode: t
  cua-mode: t
  auto-insert-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  size-indication-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t
  abbrev-mode: t

Recent input:
<menu-bar> <help-menu> <send-emacs-bug-report>

Recent messages:
Quit