bug#10071: 24.0.91; Emacs runtime crashes while exporting an org file

[Eli Zaretskii]

> From: Jambunathan K <kjambunathan@gmail.com>
> Date: Fri, 18 Nov 2011 13:25:55 +0530
> Cc: emacs-orgmode@gnu.org
> 
> 1. Start Emacs with -Q
> 2. Open the attached .org file
> 3. C-c C-e l (l as in latex)
> 4. See that Emacs crashes
> 
> I am using the Windows build downloaded from alpha.gnu.org.

Confirmed, both on MS-Windows and on GNU/Linux.  Here's the backtrace
from the current trunk tip (revno 106407) built on MS-Windows:

  intervals.c:1736: Emacs fatal error: assertion failed: (tree) != 0 && 
(tree)->up_obj == 0

  Breakpoint 1, w32_abort () at w32fns.c:7190
  7190      button = MessageBox (NULL,
  (gdb) bt
  #0  w32_abort () at w32fns.c:7190
  #1  0x01043c8e in die (
      msg=0x15f8b84 "assertion failed: (tree) != 0 && (tree)->up_obj == 0",
      file=0x15f8640 "intervals.c", line=1736) at alloc.c:6316
  #2  0x012ebe79 in graft_intervals_into_buffer (source=0x37d1070, position=1,
      length=48, buffer=0x1024d000, inherit=0) at intervals.c:1736
  #3  0x01112c1d in replace_range (from=1, to=26, new=270803377, prepare=1,
      inherit=0, markers=1) at insdel.c:1432
  #4  0x01103c7f in Freplace_match (newtext=270803377, fixedcase=52525106,
      literal=52525106, string=52525082, subexp=52525082) at search.c:2770
  #5  0x01038331 in Ffuncall (nargs=4, args=0x82e6b0) at eval.c:2990
  #6  0x011266a6 in exec_byte_code (bytestr=58343857, vector=269975813,
      maxdepth=44, args_template=52525082, nargs=0, args=0x0) at bytecode.c:785
  #7  0x010390b5 in funcall_lambda (fun=53514373, nargs=0, arg_vector=0x82e924)
      at eval.c:3205
  #8  0x01038550 in Ffuncall (nargs=1, args=0x82e920) at eval.c:3023
  #9  0x011266a6 in exec_byte_code (bytestr=270077793, vector=58106885,
      maxdepth=24, args_template=52525082, nargs=0, args=0x0) at bytecode.c:785
  #10 0x010390b5 in funcall_lambda (fun=55985541, nargs=2, arg_vector=0x82eb8c)
      at eval.c:3205
  #11 0x01038550 in Ffuncall (nargs=3, args=0x82eb88) at eval.c:3023
  #12 0x011266a6 in exec_byte_code (bytestr=55581537, vector=54480389,
      maxdepth=24, args_template=52525082, nargs=0, args=0x0) at bytecode.c:785
  #13 0x010390b5 in funcall_lambda (fun=53556101, nargs=2, arg_vector=0x82ede4)
      at eval.c:3205
  #14 0x01038550 in Ffuncall (nargs=3, args=0x82ede0) at eval.c:3023
  #15 0x011266a6 in exec_byte_code (bytestr=270077793, vector=58106885,
      maxdepth=24, args_template=52525082, nargs=0, args=0x0) at bytecode.c:785
  #16 0x010390b5 in funcall_lambda (fun=55985541, nargs=31, arg_vector=0x82f044)
      at eval.c:3205
  #17 0x01038550 in Ffuncall (nargs=32, args=0x82f040) at eval.c:3023
  #18 0x011266a6 in exec_byte_code (bytestr=55160593, vector=270183429,
      maxdepth=132, args_template=52525082, nargs=0, args=0x0) at bytecode.c:785
  #19 0x010390b5 in funcall_lambda (fun=55874341, nargs=1, arg_vector=0x82f364)
      at eval.c:3205
  #20 0x01038550 in Ffuncall (nargs=2, args=0x82f360) at eval.c:3023
  #21 0x011256d2 in Fcall_interactively (function=53737122,
      record_flag=52525082, keys=52546309) at callint.c:859
  #22 0x01038229 in Ffuncall (nargs=2, args=0x82f610) at eval.c:2981
  #23 0x011266a6 in exec_byte_code (bytestr=270064417, vector=58107397,
      maxdepth=64, args_template=52525082, nargs=0, args=0x0) at bytecode.c:785
  #24 0x010390b5 in funcall_lambda (fun=55986053, nargs=1, arg_vector=0x82f8e4)
      at eval.c:3205
  #25 0x01038550 in Ffuncall (nargs=2, args=0x82f8e0) at eval.c:3023
  #26 0x011256d2 in Fcall_interactively (function=53702258,
      record_flag=52525082, keys=52546309) at callint.c:859
  #27 0x01038229 in Ffuncall (nargs=4, args=0x82fb80) at eval.c:2981
  #28 0x010376c4 in call3 (fn=52645226, arg1=53702258, arg2=52525082,
      arg3=52525082) at eval.c:2774
  #29 0x0102018a in Fcommand_execute (cmd=53702258, record_flag=52525082,
      keys=52525082, special=52525082) at keyboard.c:10292
  #30 0x01006424 in command_loop_1 () at keyboard.c:1570
  #31 0x01033e8a in internal_condition_case (bfun=0x100548f <command_loop_1>,
      handlers=52582810, hfun=0x1004cb9 <cmd_error>) at eval.c:1499
  #32 0x010050f5 in command_loop_2 (ignore=52525082) at keyboard.c:1158
  #33 0x0103384a in internal_catch (tag=52580834,
      func=0x10050d2 <command_loop_2>, arg=52525082) at eval.c:1256
  #34 0x010050ad in command_loop () at keyboard.c:1137
  #35 0x01004677 in recursive_edit_1 () at keyboard.c:757
  #36 0x01004999 in Frecursive_edit () at keyboard.c:821
  #37 0x010027c3 in main (argc=2, argv=0xa32790) at emacs.c:1707

  Lisp Backtrace:
  "replace-match" (0x82e6b4)
  "org-export-normalize-links" (0x82e924)
  "org-export-preprocess-string" (0x82eb8c)
  "org-footnote-normalize" (0x82ede4)
  "org-export-preprocess-string" (0x82f044)
  "org-export-as-latex" (0x82f364)
  "call-interactively" (0x82f614)
  "org-export" (0x82f8e4)
  "call-interactively" (0x82fb84)
  (gdb) up
  #1  0x01043c8e in die (
      msg=0x15f8b84 "assertion failed: (tree) != 0 && (tree)->up_obj == 0",
      file=0x15f8640 "intervals.c", line=1736) at alloc.c:6316
  6316      abort ();
  (gdb) up
  #2  0x012ebe79 in graft_intervals_into_buffer (source=0x37d1070, position=1,
      length=48, buffer=0x1024d000, inherit=0) at intervals.c:1736
  1736          BUF_INTERVALS (buffer) = reproduce_tree (source, 
INTERVAL_PARENT (tree));
  (gdb) l
  1731        /* If the buffer contains only the new string, but
  1732           there was already some interval tree there, then it may be
  1733           some zero length intervals.  Eventually, do something clever
  1734           about inserting properly.  For now, just waste the old 
intervals.
    */
  1735        {
  1736          BUF_INTERVALS (buffer) = reproduce_tree (source, 
INTERVAL_PARENT (
  tree));
  1737          BUF_INTERVALS (buffer)->position = BEG;
  1738          BUF_INTERVALS (buffer)->up_obj = 1;
  1739          /* Explicitly free the old tree here.  */
  1740
  (gdb) p tree
  $1 = (INTERVAL) 0x1023d0a8
  (gdb) p *$
  $2 = {
    total_length = 48,
    position = 3,
    left = 0x101db3d4,
    right = 0x1023d0fc,
    up = {
      interval = 0x1024d005,
      obj = 270848005
    },
    up_obj = 1,
    gcmarkbit = 0,
    write_protect = 0,
    visible = 0,
    front_sticky = 0,
    rear_sticky = 0,
    plist = 269970294
  }
  (gdb) p tree->up_obj
  $3 = 1
  (gdb)

But INTERVAL_PARENT wants up_obj to be zero:

  #define INTERVAL_PARENT(i) \
     (eassert ((i) != 0 && (i)->up_obj == 0),(i)->up.interval)