subst-char-in-region broken when a before-change function reads buffer contents

[Milan Zamazal]

In GNU Emacs 22.0.50.1 (x86_64-unknown-linux-gnu, X toolkit)
 of 2006-06-15 on blackbird
X server distributor `The X.Org Foundation', version 11.0.70000000
configured using `configure '--prefix=/usr/local/stow/emacs-cvs' 
'--with-toolkit=lucid''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: cs_CZ.UTF-8
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: C
  locale-coding-system: utf-8
  default-enable-multibyte-characters: t

When I put a function calling buffer-substring into the
before-change-functions hook, then subst-chars-in-region sometimes
produces wrong results.

How to reproduce the bug:

- Start Emacs and read in the attached file `emacs.el' with `C-x C-f':

emacs.el
Description: application/emacs-lisp

- Set mark at the beginning of the emacs.el buffer with `C-SPC'.

- Press `C-n' (next-line) five times.  The cursor should be placed on
  the empty line between the Elisp code and the text now.

- Call `M-x eval-region'.  The text below gets changed as expected --
  all newlines are replaced by spaces.

- Call undo: `C-x u'.

- Move the cursor back to its original position on the empty line:
  Press `C-p' (previous line) once.

- Call `C-x C-e'.  This time the text gets changed in a wrong way --
  newline after the first line of the text is not replaced by space.

Some observations:

- The bug doesn't appear if the function `foo' is removed from
  before-change-functions.

- The bug is present at least in CVS Emacs 2006-06-15 and 2006-08-03.

- The bug doesn't seem to be present in Emacs 21.4.