bug#22148: 25.1.50; Segmentation fault when saving file

[Sujith Manoharan]

Emacs crashes when saving a .org file. It happened a few times
when I would just open it, change a line and save it. I got
the backtrace once in gdb, I've attached it below. The crash
doesn't happen consistently, sometimes opening a mbox crashes too.
I am using the master branch.

(gdb) r
Starting program: /home/sujith/dev/emacs/src/emacs
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7fffe973f700 (LWP 1576)]

Program received signal SIGSEGV, Segmentation fault.
0x000000000047c38b in encode_char (charset=charset@entry=0xb2fd88 
<charset_table_init+16072>, c=c@entry=173) at charset.c:1760
1760              code_index = GET_TEMP_CHARSET_WORK_ENCODER (c);
(gdb) bt
#0  0x000000000047c38b in encode_char (charset=charset@entry=0xb2fd88 
<charset_table_init+16072>, c=c@entry=173) at charset.c:1760
#1  0x000000000048772b in char_encodable_p (c=c@entry=173, attrs=<optimized 
out>) at coding.c:8941
#2  0x0000000000490088 in Ffind_coding_systems_region_internal (start=6, 
end=<optimized out>, exclude=<optimized out>) at coding.c:9039
#3  0x0000000000557952 in Ffuncall (nargs=3, args=args@entry=0x7fffffffd218) at 
eval.c:2657
#4  0x000000000058ad63 in exec_byte_code (bytestr=<optimized out>, 
vector=9685013, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=nargs@entry=2, args=<optimized out>, 
args@entry=0x7fffffffd218) at bytecode.c:880
#5  0x00000000005574e4 in funcall_lambda (fun=9684980, nargs=nargs@entry=2, 
arg_vector=0x7fffffffd218, arg_vector@entry=0x7fffffffd3d8)
    at eval.c:2810
#6  0x000000000055778b in Ffuncall (nargs=3, args=args@entry=0x7fffffffd3d0) at 
eval.c:2711
#7  0x000000000058ad63 in exec_byte_code (bytestr=<optimized out>, 
vector=9688781, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=nargs@entry=5, args=<optimized out>, 
args@entry=0x7fffffffd3d0) at bytecode.c:880
#8  0x00000000005574e4 in funcall_lambda (fun=9688748, nargs=nargs@entry=5, 
arg_vector=0x7fffffffd3d0, arg_vector@entry=0x7fffffffd598)
    at eval.c:2810
#9  0x000000000055778b in Ffuncall (nargs=nargs@entry=6, 
args=args@entry=0x7fffffffd590) at eval.c:2711
#10 0x000000000055929e in call5 (fn=<optimized out>, arg1=arg1@entry=6, 
arg2=arg2@entry=264430, arg3=arg3@entry=4067744,
    arg4=arg4@entry=0, arg5=arg5@entry=26114324) at eval.c:2543
#11 0x000000000051b427 in choose_write_coding_system (coding=0x7fffffffd7d0, 
lockname=26185700, visit=44256, append=0,
    filename=26114324, end=264430, start=6) at fileio.c:4595
#12 write_region (start=6, end=264430, filename=26114324, append=0, 
visit=44256, lockname=26185700, mustbenew=0, desc=-1)
    at fileio.c:4789
#13 0x000000000051b76f in Fwrite_region (start=<optimized out>, end=<optimized 
out>, filename=<optimized out>, append=<optimized out>,
    visit=<optimized out>, lockname=<optimized out>, mustbenew=0) at 
fileio.c:4669
#14 0x00000000005578e8 in Ffuncall (nargs=7, args=args@entry=0x7fffffffdb70) at 
eval.c:2683
#15 0x000000000058ad63 in exec_byte_code (bytestr=<optimized out>, 
vector=9119981, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=nargs@entry=0, args=<optimized out>, 
args@entry=0x7fffffffdb70) at bytecode.c:880
#16 0x00000000005574e4 in funcall_lambda (fun=9119948, nargs=nargs@entry=0, 
arg_vector=0x7fffffffdb70, arg_vector@entry=0x7fffffffdd30)
    at eval.c:2810
#17 0x000000000055778b in Ffuncall (nargs=1, args=args@entry=0x7fffffffdd28) at 
eval.c:2711
#18 0x000000000058ad63 in exec_byte_code (bytestr=<optimized out>, 
vector=9119861, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=nargs@entry=0, args=<optimized out>, 
args@entry=0x7fffffffdd28) at bytecode.c:880
#19 0x00000000005574e4 in funcall_lambda (fun=9119828, nargs=nargs@entry=0, 
arg_vector=0x7fffffffdd28, arg_vector@entry=0x7fffffffdec0)
    at eval.c:2810
#20 0x000000000055778b in Ffuncall (nargs=1, args=args@entry=0x7fffffffdeb8) at 
eval.c:2711
#21 0x000000000058ad63 in exec_byte_code (bytestr=<optimized out>, 
vector=9119013, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=nargs@entry=1, args=<optimized out>, 
args@entry=0x7fffffffdeb8) at bytecode.c:880
#22 0x00000000005574e4 in funcall_lambda (fun=9118980, nargs=nargs@entry=1, 
arg_vector=0x7fffffffdeb8, arg_vector@entry=0x7fffffffe050)
    at eval.c:2810
#23 0x000000000055778b in Ffuncall (nargs=2, args=args@entry=0x7fffffffe048) at 
eval.c:2711
#24 0x000000000058ad63 in exec_byte_code (bytestr=<optimized out>, 
vector=9117941, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=nargs@entry=1, args=<optimized out>, 
args@entry=0x7fffffffe048) at bytecode.c:880
#25 0x00000000005574e4 in funcall_lambda (fun=9117908, nargs=nargs@entry=1, 
arg_vector=0x7fffffffe048, arg_vector@entry=0x7fffffffe270)
    at eval.c:2810
#26 0x000000000055778b in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffe268) at eval.c:2711
#27 0x000000000055338a in Ffuncall_interactively (nargs=2, args=0x7fffffffe268) 
at callint.c:248
#28 0x0000000000557879 in Ffuncall (nargs=nargs@entry=3, 
args=args@entry=0x7fffffffe260) at eval.c:2630
#29 0x0000000000553d57 in Fcall_interactively (function=<optimized out>, 
record_flag=<optimized out>, keys=<optimized out>)
    at callint.c:836
#30 0x0000000000557952 in Ffuncall (nargs=4, args=args@entry=0x7fffffffe4b8) at 
eval.c:2657
#31 0x000000000058ad63 in exec_byte_code (bytestr=<optimized out>, 
vector=9567141, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=nargs@entry=1, args=<optimized out>, 
args@entry=0x7fffffffe4b8) at bytecode.c:880
#32 0x00000000005574e4 in funcall_lambda (fun=9567108, nargs=nargs@entry=1, 
arg_vector=0x7fffffffe4b8, arg_vector@entry=0x7fffffffe648)
    at eval.c:2810
#33 0x000000000055778b in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffe640) at eval.c:2711
#34 0x0000000000557a5a in call1 (fn=fn@entry=14736, arg1=<optimized out>) at 
eval.c:2509
#35 0x00000000004f52d4 in command_loop_1 () at keyboard.c:1452
#36 0x0000000000555fb7 in internal_condition_case (bfun=bfun@entry=0x4f4f00 
<command_loop_1>, handlers=handlers@entry=18912,
    hfun=hfun@entry=0x4ebaf0 <cmd_error>) at eval.c:1309
#37 0x00000000004e727c in command_loop_2 (ignore=ignore@entry=0) at 
keyboard.c:1086
#38 0x0000000000555eab in internal_catch (tag=tag@entry=45648, 
func=func@entry=0x4e7260 <command_loop_2>, arg=arg@entry=0)
    at eval.c:1073
#39 0x00000000004e7239 in command_loop () at keyboard.c:1065
#40 0x00000000004eb6db in recursive_edit_1 () at keyboard.c:671
#41 0x00000000004eba28 in Frecursive_edit () at keyboard.c:742
#42 0x000000000041620b in main (argc=1, argv=0x7fffffffe9f8) at emacs.c:1652
(gdb) q
                                                                                
    



In GNU Emacs 25.1.50.1 (x86_64-unknown-linux-gnu, GTK+ Version 2.24.28)
 of 2015-12-11
Repository revision: 6148555ee5a3d0139ae517803718b3e0357933c7
Windowing system distributor 'The X.Org Foundation', version 11.0.11800000
Configured using:
 'configure --prefix=/usr --with-x-toolkit=gtk2 --without-gconf
 --without-gsettings --without-selinux --without-gnutls'

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS NOTIFY ACL LIBXML2
FREETYPE M17N_FLT LIBOTF XFT ZLIB TOOLKIT_SCROLL_BARS GTK2 X11

Important settings:
  value of $LANG: en_IN.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  display-battery-mode: t
  display-time-mode: t
  iswitchb-mode: t
  savehist-mode: t
  save-place-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: 1
  line-number-mode: t
  transient-mark-mode: t

Recent messages:
/home/sujith/mail/INBOX-gmail: Reading folder... done
INBOX-gmail: 65 messages, 0 new, 0 unread, 0 deleted
INBOX-gmail: Decoding MIME message...
INBOX-gmail: Inlining text/html by emacs-w3m...
INBOX-gmail: Decoding quoted-printable... done
INBOX-gmail: Inlining text/html by emacs-w3m... done.
INBOX-gmail: Decoding MIME message... done
INBOX-gmail: 65 messages, 0 new, 0 unread, 0 deleted [2 times]
Starting new Ispell process /usr/bin/aspell with default dictionary...
Making completion list... [2 times]

Load-path shadows:
/home/sujith/.emacs.d/elpa/emms-20150519.736/tq hides 
/home/sujith/dev/emacs/lisp/emacs-lisp/tq

Features:
(shadow emacsbug message idna format-spec rfc822 mml mml-sec gmm-utils
mailheader mailabbrev flyspell ispell vm-reply w3m-form w3m browse-url doc-view
jka-compr image-mode timezone w3m-hist w3m-fb bookmark-w3m w3m-ems w3m-ccl ccl
w3m-favicon w3m-image w3m-proc w3m-util vm-w3m u-vm-color vm-save tapestry
vm-sort sendmail mail-utils vm-rfaddons vm-undo vm-virtual vm-summary-faces
vm-pop utf7 vm-imap vm-thread vm-mime vm-toolbar vm-menu vm-window vm-folder
vm-crypto vm-summary vm-mouse vm-page vm-motion vm-minibuf vm-message vm-misc
vm-macro mairix derived cus-edit cus-start cus-load wid-edit vm-autoloads
vm-vars vm-version vm advice battery time dired-x dired edmacro kmacro xcscope
ring server iswitchb savehist saveplace finder-inf info package epg-config
url-handlers easy-mmode mm-decode mm-bodies mm-encode mail-parse rfc2231 rfc2047
rfc2045 cl ietf-drums url-parse auth-source cl-seq eieio byte-opt bytecomp
byte-compile cl-extra cconv eieio-core cl-macs gv gnus-util mm-util help-fns
help-mode easymenu cl-loaddefs cl-lib mail-prsvr password-cache url-vars
time-date mule-util pcase tooltip eldoc electric uniquify ediff-hook vc-hooks
lisp-float-type mwheel x-win term/common-win x-dnd tool-bar dnd fontset image
regexp-opt fringe tabulated-list newcomment elisp-mode lisp-mode prog-mode
register page menu-bar rfn-eshadow timer select scroll-bar mouse jit-lock
font-lock syntax facemenu font-core frame cl-generic cham georgian utf-8-lang
misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms cp51932
hebrew greek romanian slovak czech european ethiopic indian cyrillic chinese
charscript case-table epa-hook jka-cmpr-hook help simple abbrev obarray
minibuffer cl-preloaded nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote dbusbind inotify dynamic-setting
font-render-setting move-toolbar gtk x-toolkit x multi-tty make-network-process
emacs)

Memory information:
((conses 16 256181 7551)
 (symbols 48 33012 0)
 (miscs 40 744 316)
 (strings 32 53467 9370)
 (string-bytes 1 1717823)
 (vectors 16 23377)
 (vector-slots 8 549170 10179)
 (floats 8 268 33)
 (intervals 56 1611 0)
 (buffers 976 16)
 (heap 1024 19875 918))