Re: abort on query-replace

[Richard Stallman]

    Breakpoint 1, abort () at emacs.c:428
    428       kill (getpid (), SIGABRT);
    (gdb) where
    #0  abort () at emacs.c:428
    #1  0x08147992 in buf_charpos_to_bytepos (b=0xa2c4f80, charpos=0) at 
marker.c:141
    #2  0x081c6d94 in set_point (buffer=0xa2c4f80, charpos=0) at 
intervals.c:1957
    #3  0x081c7601 in move_if_not_intangible (position=0) at intervals.c:2284

A position value of 0 is invalid.
So I see two bugs here:

1. One bug is that Freplace_match fails to defend against such invalid values.

2. The other bug is whatever produced this invalid value.

I wrote a fix for the first bug, and I'll install it,
but meanwhile we need to find the second bug.  Can you debug it?
Or tell us precisely how to reproduce it?