Crash caused by insert-file-contents, both trunk (bzr 111532) and 24.2.92 affected

[Dmitry Antipov]

Steps to reproduce:

./src/emacs -Q
M-x eval-expression RET (insert-file-contents "/dev/sda")

(assuming /dev/sda is a readable block device).

For trunk, the backtrace is:

#0  0x000000377da0eebb in raise () from /lib64/libpthread.so.0
#1  0x0000000000525d38 in terminate_due_to_signal (address@hidden, 
address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/emacs.c:342
#2  0x0000000000546188 in handle_fatal_signal (sig=11) at 
/home/dima/work/stuff/emacs/trunk/src/sysdep.c:1653
#3  deliver_thread_signal (sig=11, handler=<optimized out>) at 
/home/dima/work/stuff/emacs/trunk/src/sysdep.c:1629
#4  deliver_fatal_thread_signal (sig=11) at 
/home/dima/work/stuff/emacs/trunk/src/sysdep.c:1665
#5  <signal handler called>
#6  0x00000000004ce56f in char_table_ref (table=..., address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/chartab.c:234
#7  0x00000000006265bc in composition_compute_stop_pos (cmp_it=0x7fff169924d8, 
charpos=209, address@hidden, bytepos=216,
    endpos=692, string=..., address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/composite.c:1053
#8  0x000000000062767d in composition_reseat_it (address@hidden, charpos=192, 
bytepos=192, endpos=139249,
    w=0x12c0648, face=0x1b8fb10, string=...) at 
/home/dima/work/stuff/emacs/trunk/src/composite.c:1224
#9  0x0000000000456a68 in next_element_from_buffer (it=0x7fff16991c70) at 
/home/dima/work/stuff/emacs/trunk/src/xdisp.c:8003
#10 0x000000000044b2fa in get_next_display_element (address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/xdisp.c:6623
#11 0x00000000004515eb in display_line (address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/xdisp.c:19437
#12 0x0000000000459f82 in try_window (window=..., address@hidden, pos=..., 
address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/xdisp.c:16301
#13 0x00000000004712a3 in redisplay_window (window=..., address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/xdisp.c:15827
#14 0x0000000000474873 in redisplay_window_0 (window=..., address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/xdisp.c:13881
#15 0x00000000005b38bb in internal_condition_case_1 (address@hidden 
<redisplay_window_0>, arg=..., handlers=...,
    address@hidden <redisplay_window_error>) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:1231
#16 0x0000000000437f5e in redisplay_windows (window=...) at 
/home/dima/work/stuff/emacs/trunk/src/xdisp.c:13861
#17 0x0000000000437eea in redisplay_windows (window=...) at 
/home/dima/work/stuff/emacs/trunk/src/xdisp.c:13855
#18 0x000000000045b195 in redisplay_internal () at 
/home/dima/work/stuff/emacs/trunk/src/xdisp.c:13453
#19 0x000000000045d945 in redisplay () at 
/home/dima/work/stuff/emacs/trunk/src/xdisp.c:12731
#20 0x0000000000534134 in read_char (commandflag=1, address@hidden, 
address@hidden, prev_event=...,
    address@hidden, address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/keyboard.c:2428
#21 0x0000000000536cb9 in read_key_sequence (address@hidden, prompt=...,
    address@hidden, address@hidden,
    address@hidden, bufsize=30) at 
/home/dima/work/stuff/emacs/trunk/src/keyboard.c:9241
#22 0x0000000000539900 in command_loop_1 () at 
/home/dima/work/stuff/emacs/trunk/src/keyboard.c:1460
#23 0x00000000005b3773 in internal_condition_case (address@hidden 
<command_loop_1>, handlers=...,
    address@hidden <cmd_error>) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:1193
#24 0x000000000052997e in command_loop_2 (ignore=..., address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/keyboard.c:1175
#25 0x00000000005b3650 in internal_catch (tag=..., address@hidden 
<command_loop_2>, arg=...)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:964
#26 0x000000000052afb3 in command_loop () at 
/home/dima/work/stuff/emacs/trunk/src/keyboard.c:1146
#27 recursive_edit_1 () at /home/dima/work/stuff/emacs/trunk/src/keyboard.c:787
#28 0x000000000052b3cc in Frecursive_edit () at 
/home/dima/work/stuff/emacs/trunk/src/keyboard.c:851
#29 0x00000000005b59aa in Ffuncall (nargs=<optimized out>, args=<optimized 
out>) at /home/dima/work/stuff/emacs/trunk/src/eval.c:2672
#30 0x00000000005fc753 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=4611686018645491712,
    args=0x2, address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/bytecode.c:898
#31 0x00000000005b5305 in funcall_lambda (fun=..., address@hidden, 
address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:2841
#32 0x00000000005b57ab in Ffuncall (address@hidden, address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:2736
#33 0x00000000005b687e in Fapply (address@hidden, address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:2209
#34 0x00000000005b5c9e in apply1 (fn=..., arg=..., address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:2443
#35 0x00000000005b5e46 in call_debugger (arg=...) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:222
#36 0x00000000005b63e6 in maybe_call_debugger (data=..., sig=..., 
conditions=...)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:1611
#37 Fsignal (error_symbol=..., data=...) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:1431
#38 0x00000000005b64a9 in xsignal (error_symbol=..., address@hidden, data=...)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:1466
#39 0x00000000005b6dc7 in xsignal1 (error_symbol=..., arg=..., address@hidden) 
at /home/dima/work/stuff/emacs/trunk/src/eval.c:1481
#40 0x00000000005b6e39 in verror (m=<optimized out>, address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:1680
#41 0x00000000005b6ecc in error (address@hidden "IO error reading %s: %s") at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:1692
#42 0x00000000005684c3 in Finsert_file_contents (filename=..., visit=..., 
beg=..., end=..., replace=...)
    at /home/dima/work/stuff/emacs/trunk/src/fileio.c:4329
#43 0x00000000005b4994 in eval_sub (form=..., address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:2054
#44 0x00000000005b73ae in Feval (form=..., lexical=...) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:1902
#45 0x00000000005b598e in Ffuncall (nargs=<optimized out>, args=<optimized 
out>) at /home/dima/work/stuff/emacs/trunk/src/eval.c:2678
#46 0x00000000005fc753 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=4611686018645491712,
    args=0x2, address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/bytecode.c:898
#47 0x00000000005b5305 in funcall_lambda (fun=..., address@hidden, 
address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:2841
#48 0x00000000005b57ab in Ffuncall (address@hidden, address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:2736
#49 0x00000000005b687e in Fapply (address@hidden, address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:2209
#50 0x00000000005b5c9e in apply1 (fn=..., arg=..., address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:2443
#51 0x00000000005b13b4 in Fcall_interactively (function=..., record_flag=..., 
keys=...)
    at /home/dima/work/stuff/emacs/trunk/src/callint.c:377
#52 0x00000000005b597c in Ffuncall (address@hidden, address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:2682
#53 0x00000000005b5b64 in call3 (fn=..., arg1=..., address@hidden, arg2=..., 
address@hidden, arg3=..., address@hidden)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:2500
#54 0x0000000000528ab5 in Fcommand_execute (cmd=..., record_flag=..., keys=..., 
special=...)
    at /home/dima/work/stuff/emacs/trunk/src/keyboard.c:10251
#55 0x0000000000539bbd in command_loop_1 () at 
/home/dima/work/stuff/emacs/trunk/src/keyboard.c:1588
#56 0x00000000005b3773 in internal_condition_case (address@hidden 
<command_loop_1>, handlers=...,
    address@hidden <cmd_error>) at 
/home/dima/work/stuff/emacs/trunk/src/eval.c:1193
#57 0x000000000052997e in command_loop_2 (ignore=..., address@hidden) at 
/home/dima/work/stuff/emacs/trunk/src/keyboard.c:1175
#58 0x00000000005b3650 in internal_catch (tag=..., address@hidden 
<command_loop_2>, arg=...)
    at /home/dima/work/stuff/emacs/trunk/src/eval.c:964
#59 0x000000000052b02e in command_loop () at 
/home/dima/work/stuff/emacs/trunk/src/keyboard.c:1154
#60 recursive_edit_1 () at /home/dima/work/stuff/emacs/trunk/src/keyboard.c:787
#61 0x000000000052b3cc in Frecursive_edit () at 
/home/dima/work/stuff/emacs/trunk/src/keyboard.c:851
#62 0x0000000000417f85 in main (argc=2, argv=<optimized out>) at 
/home/dima/work/stuff/emacs/trunk/src/emacs.c:1554

For 24.2.92, the backtrace looks nearly the same:

#0  0x000000377da0eebb in raise () from /lib64/libpthread.so.0
#1  0x00000000004deb28 in terminate_due_to_signal (address@hidden, 
address@hidden) at emacs.c:344
#2  0x00000000004f8478 in handle_fatal_signal (sig=11) at sysdep.c:1638
#3  deliver_thread_signal (sig=11, handler=<optimized out>) at sysdep.c:1614
#4  deliver_fatal_thread_signal (sig=11) at sysdep.c:1650
#5  <signal handler called>
#6  0x0000000000499c52 in char_table_ref (table=<optimized out>, c=4195088) at 
chartab.c:234
#7  0x00000000005ab4c8 in composition_compute_stop_pos (cmp_it=0x7fffc90e0e98, 
charpos=209, address@hidden, bytepos=216,
    endpos=692, address@hidden) at composite.c:1053
#8  0x00000000005ac49d in composition_reseat_it (address@hidden, charpos=192, 
bytepos=192, endpos=139249,
    w=<optimized out>, face=0xc701b0, string=12079650) at composite.c:1224
#9  0x0000000000446ec8 in next_element_from_buffer (it=0x7fffc90e0630) at 
xdisp.c:7992
#10 0x000000000043d9e2 in get_next_display_element (address@hidden) at 
xdisp.c:6612
#11 0x0000000000442dea in display_line (address@hidden) at xdisp.c:19475
#12 0x0000000000449782 in try_window (address@hidden, pos=..., address@hidden) 
at xdisp.c:16352
#13 0x000000000045b853 in redisplay_window (window=18402949, address@hidden) at 
xdisp.c:15878
#14 0x000000000045db03 in redisplay_window_0 (address@hidden) at xdisp.c:13933
#15 0x0000000000552a1b in internal_condition_case_1 (bfun=0x45dad0 
<redisplay_window_0>, arg=18402949, handlers=12050374,
    hfun=0x42a4b0 <redisplay_window_error>) at eval.c:1327
#16 0x000000000042f91e in redisplay_windows (window=4195088) at xdisp.c:13913
#17 0x000000000042f940 in redisplay_windows (window=4195088) at xdisp.c:13907
#18 0x000000000044a471 in redisplay_internal () at xdisp.c:13492
#19 0x000000000044beb5 in redisplay () at xdisp.c:12692
#20 0x00000000004e9522 in read_char (commandflag=1, address@hidden, 
address@hidden, prev_event=12079650,
    address@hidden, end_time=0x0, address@hidden) at keyboard.c:2429
#21 0x00000000004eb8d3 in read_key_sequence (address@hidden, prompt=12079650,
    address@hidden, address@hidden,
    address@hidden, bufsize=30) at keyboard.c:9231
#22 0x00000000004ed8ce in command_loop_1 () at keyboard.c:1459
#23 0x00000000005528d3 in internal_condition_case (address@hidden 
<command_loop_1>, handlers=12131330,
    address@hidden <cmd_error>) at eval.c:1289
#24 0x00000000004e16de in command_loop_2 (address@hidden) at keyboard.c:1168
#25 0x00000000005527b0 in internal_catch (tag=202662897254400, address@hidden 
<command_loop_2>, arg=12079650)
    at eval.c:1060
#26 0x00000000004e29b3 in command_loop () at keyboard.c:1139
#27 recursive_edit_1 () at keyboard.c:779
#28 0x00000000004e2d45 in Frecursive_edit () at keyboard.c:843
#29 0x000000000055447a in Ffuncall (nargs=<optimized out>, args=<optimized 
out>) at eval.c:2772
#30 0x00000000005895a3 in exec_byte_code (bytestr=12230933, vector=83, 
maxdepth=4611686018695757824,
    args_template=4611686018695757824, nargs=4611686018430533632, 
args=0x400310, address@hidden) at bytecode.c:900
#31 0x0000000000553fc1 in funcall_lambda (fun=17644901, address@hidden, 
address@hidden)
    at eval.c:3007
#32 0x00000000005542db in Ffuncall (address@hidden, address@hidden) at 
eval.c:2836
#33 0x00000000005552ad in Fapply (address@hidden, address@hidden) at eval.c:2309
#34 0x00000000005547c0 in apply1 (fn=12196898, address@hidden) at eval.c:2543
#35 0x0000000000554976 in call_debugger (arg=19184070) at eval.c:223
#36 0x0000000000554d98 in maybe_call_debugger (data=19184118, sig=12131330, 
conditions=8596294) at eval.c:1707
#37 Fsignal (address@hidden, data=19184118) at eval.c:1527
#38 0x0000000000554f59 in xsignal (address@hidden, data=<optimized out>) at 
eval.c:1562
#39 0x0000000000555647 in xsignal1 (error_symbol=12131330, address@hidden) at 
eval.c:1577
#40 0x00000000005556b9 in verror (m=<optimized out>, address@hidden) at 
eval.c:1776
#41 0x000000000055574c in error (address@hidden "IO error reading %s: %s") at 
eval.c:1788
#42 0x0000000000513b8f in Finsert_file_contents (filename=14436673, 
visit=12079650, beg=12079650, end=12079650,
    replace=<optimized out>) at fileio.c:3768
#43 0x0000000000553925 in eval_sub (address@hidden) at eval.c:2154
#44 0x0000000000555a25 in Feval (form=19187158, lexical=<optimized out>) at 
eval.c:2005
#45 0x0000000000554461 in Ffuncall (nargs=<optimized out>, args=<optimized 
out>) at eval.c:2778
#46 0x00000000005895a3 in exec_byte_code (bytestr=12230933, vector=0, 
maxdepth=4611686018695757824,
    args_template=4611686018695757824, nargs=4611686018430533632, 
args=0x400310, address@hidden) at bytecode.c:900
#47 0x0000000000553fc1 in funcall_lambda (fun=9492837, address@hidden, 
address@hidden)
    at eval.c:3007
#48 0x00000000005542db in Ffuncall (address@hidden, address@hidden) at 
eval.c:2836
#49 0x00000000005552ad in Fapply (address@hidden, address@hidden) at eval.c:2309
#50 0x00000000005547c0 in apply1 (address@hidden, address@hidden) at eval.c:2543
#51 0x00000000005503ac in Fcall_interactively (function=15603250, 
record_flag=12079650, keys=12114869) at callint.c:377
#52 0x000000000055444f in Ffuncall (address@hidden, address@hidden) at 
eval.c:2782
#53 0x0000000000554684 in call3 (fn=<optimized out>, arg1=<optimized out>, 
arg2=<optimized out>, arg3=<optimized out>) at eval.c:2600
#54 0x00000000004e0c8d in Fcommand_execute (cmd=<optimized out>, record_flag=<optimized 
out>, keys=<optimized out>,
    special=<optimized out>) at keyboard.c:10241
#55 0x00000000004eda7a in command_loop_1 () at keyboard.c:1587
#56 0x00000000005528d3 in internal_condition_case (address@hidden 
<command_loop_1>, handlers=12131330,
    address@hidden <cmd_error>) at eval.c:1289
#57 0x00000000004e16de in command_loop_2 (address@hidden) at keyboard.c:1168
#58 0x00000000005527b0 in internal_catch (tag=202662897254400, address@hidden 
<command_loop_2>, arg=12079650)
    at eval.c:1060
#59 0x00000000004e2a27 in command_loop () at keyboard.c:1147
#60 recursive_edit_1 () at keyboard.c:779
#61 0x00000000004e2d45 in Frecursive_edit () at keyboard.c:843
#62 0x0000000000416f2f in main (argc=2, argv=<optimized out>) at emacs.c:1547

Dmitry