bug#7952: 24.0.50; crash in find_interval

[Romain Francoise]

Emacs from Git as of revision 4817a832f49, which corresponds to the
bzr trunk as of revision 103065, crashes in find_interval() when I
move around grep buffers:

| Core was generated by `./src/emacs -nw'.
| Program terminated with signal 6, Aborted.
| #0  0x00007fc45c00c447 in kill () at ../sysdeps/unix/syscall-template.S:82
| 82      ../sysdeps/unix/syscall-template.S: No such file or directory.
|         in ../sysdeps/unix/syscall-template.S
| (gdb) bt
| #0  0x00007fc45c00c447 in kill () at ../sysdeps/unix/syscall-template.S:82
| #1  0x000000000055b203 in fatal_error_signal (sig=6) at emacs.c:343
| #2  <signal handler called>
| #3  0x00007fc45c00c447 in kill () at ../sysdeps/unix/syscall-template.S:82
| #4  0x000000000055b222 in abort () at emacs.c:372
| #5  0x0000000000669960 in find_interval (tree=0x0, position=1559343)
|     at intervals.c:635
| #6  0x000000000066c116 in set_point_both (charpos=1559343, bytepos=1559964)
|     at intervals.c:2008
| #7  0x000000000048da2d in window_scroll_line_based (window=43271749, n=-49,
|     whole=1, noerror=0) at window.c:5125
| #8  0x000000000048c726 in window_scroll (window=43271749, n=-1, whole=1,
|     noerror=0) at window.c:4715
| #9  0x000000000048dde8 in scroll_command (n=12601730, direction=-1)
|     at window.c:5248
| #10 0x000000000048deb6 in Fscroll_down (arg=12601730) at window.c:5282
| #11 0x00000000005ffb32 in Ffuncall (nargs=2, args=0x7fff5c4c84b0)
|     at eval.c:2842
| #12 0x000000000064bac7 in Fbyte_code (bytestr=10424209, vector=10424245,
|     maxdepth=12) at bytecode.c:676
| #13 0x0000000000600430 in funcall_lambda (fun=10424149, nargs=1,
|     arg_vector=0x7fff5c4c8958) at eval.c:3028
| #14 0x00000000005ffd3f in Ffuncall (nargs=2, args=0x7fff5c4c8950)
|     at eval.c:2891
| #15 0x00000000005fa4ad in Fcall_interactively (function=12963906,
|     record_flag=12601730, keys=12649141) at callint.c:842
| #16 0x00000000005ffb88 in Ffuncall (nargs=4, args=0x7fff5c4c8cd0)
|     at eval.c:2849
| #17 0x00000000005ff539 in call3 (fn=12788898, arg1=12963906, arg2=12601730,
|     arg3=12601730) at eval.c:2674
| #18 0x000000000057250c in Fcommand_execute (cmd=12963906,
|     record_flag=12601730, keys=12601730, special=12601730) at keyboard.c:10180
| #19 0x000000000055ff27 in command_loop_1 () at keyboard.c:1528
| #20 0x00000000005fccad in internal_condition_case (
|     bfun=0x55f711 <command_loop_1>, handlers=12653922,
|     hfun=0x55f019 <cmd_error>) at eval.c:1408
| #21 0x000000000055f412 in command_loop_2 (ignore=12601730) at keyboard.c:1129
| #22 0x00000000005fc64a in internal_catch (tag=12649938,
|     func=0x55f3ec <command_loop_2>, arg=12601730) at eval.c:1152
| #23 0x000000000055f3c5 in command_loop () at keyboard.c:1108
| #24 0x000000000055eb50 in recursive_edit_1 () at keyboard.c:731
| #25 0x000000000055ed03 in Frecursive_edit () at keyboard.c:793
| #26 0x000000000055d04d in main (argc=2, argv=0x7fff5c4c96d8) at emacs.c:1682
| (gdb)

Steps to reproduce:
1) Start ./src/emacs -nw in the top-level of the source tree
2) Do M-x grep-find RET emacs RET
3) Do C-x 0 to maximize the window with *grep* buffer
4) Move around with C-v/M-v until it crashes

This may be related bug #7920, but I'm not sure.