bug#14280: 24.3.50; Reading from a killed buffer segfaults

[Andreas Politz]

(read (with-temp-buffer
        (save-excursion (insert "42"))
        (current-buffer)))

This results in a SIGSEGV signal.  

#0  0x0000000000575f1b in readchar (readcharfun=<value optimized out>, 
multibyte=0x7fffffffd38f) at lread.c:211
#1  0x000000000057717d in read1 (readcharfun=21255173, pch=0x7fffffffd3dc, 
first_in_list=false) at lread.c:2408
#2  0x0000000000578690 in read0 (readcharfun=0) at lread.c:2077
#3  0x000000000057872c in read_internal_start (stream=21255173, 
start=140737488343951, end=21255728) at lread.c:2050
#4  0x0000000000555de2 in eval_sub (form=<value optimized out>) at eval.c:2039
#5  0x0000000000557860 in Feval (form=19112998, lexical=<value optimized out>) 
at eval.c:1901
#6  0x00000000005568ba in Ffuncall (nargs=<value optimized out>, args=<value 
optimized out>) at eval.c:2677
#7  0x000000000058ceed in exec_byte_code (bytestr=<value optimized out>, 
vector=<value optimized out>, maxdepth=<value optimized out>, args_template=0, 
nargs=0, args=0xb6d982) at bytecode.c:900
#8  0x00000000005563f6 in funcall_lambda (fun=10053205, nargs=<value optimized 
out>, arg_vector=<value optimized out>) at eval.c:2906
#9  0x00000000005566ed in Ffuncall (nargs=<value optimized out>, args=0x996650) 
at eval.c:2735
#10 0x000000000058ceed in exec_byte_code (bytestr=<value optimized out>, 
vector=<value optimized out>, maxdepth=<value optimized out>, args_template=0, 
nargs=0, args=0xb6d982) at bytecode.c:900
#11 0x00000000005563f6 in funcall_lambda (fun=10054037, nargs=<value optimized 
out>, arg_vector=<value optimized out>) at eval.c:2906
#12 0x00000000005566ed in Ffuncall (nargs=<value optimized out>, args=0x996990) 
at eval.c:2735
#13 0x0000000000553758 in Fcall_interactively (function=<value optimized out>, 
record_flag=<value optimized out>, keys=<value optimized out>) at callint.c:852
#14 0x00000000005568a9 in Ffuncall (nargs=<value optimized out>, args=<value 
optimized out>) at eval.c:2681
#15 0x000000000058ceed in exec_byte_code (bytestr=<value optimized out>, 
vector=<value optimized out>, maxdepth=<value optimized out>, args_template=0, 
nargs=0, args=0xb6d982) at bytecode.c:900
#16 0x00000000005566ed in Ffuncall (nargs=<value optimized out>, args=0x9067d0) 
at eval.c:2735
#17 0x000000000055800a in call1 (fn=<value optimized out>, arg1=<value 
optimized out>) at eval.c:2468
#18 0x00000000004f0e48 in command_loop_1 () at keyboard.c:1578
#19 0x0000000000555393 in internal_condition_case (bfun=<value optimized out>, 
handlers=<value optimized out>, hfun=<value optimized out>) at eval.c:1193
#20 0x00000000004e9fce in command_loop_2 (ignore=<value optimized out>) at 
keyboard.c:1167
#21 0x00000000005554aa in internal_catch (tag=<value optimized out>, 
func=<value optimized out>, arg=<value optimized out>) at eval.c:964
#22 0x00000000004ea6ea in command_loop () at keyboard.c:1146
#23 recursive_edit_1 () at keyboard.c:779
#24 0x00000000004ea804 in Frecursive_edit () at keyboard.c:843
#25 0x00000000004dfea7 in main (argc=2, argv=0x7fffffffe308) at emacs.c:1531

Lisp Backtrace:
"read" (0xffffd440)
"eval" (0xffffd5c8)
"eval-last-sexp-1" (0xffffd780)
"eval-last-sexp" (0xffffd978)
"call-interactively" (0xffffdb70)
"command-execute" (0xffffdcc8)




In GNU Emacs 24.3.50.1 (x86_64-unknown-linux-gnu, GTK+ Version 2.20.1)
 of 2013-04-15 on luca
Bzr revision: 112294 acm@muc.de-20130415143220-6jgvlzg62u9jyo3p
Windowing system distributor `The X.Org Foundation', version 11.0.10707000
System Description:     Debian GNU/Linux 6.0.7 (squeeze)

Important settings:
  value of $LC_COLLATE: C
  value of $LC_MESSAGES: C
  value of $LANG: de_DE.UTF-8
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Anticus

Minor modes in effect:
  outline-yank-mode: t
  desktop-save-mode: t
  workgroups-mode: t
  ispell-track-input-method: t
  recentf-mode: t
  show-paren-mode: t
  yas-global-mode: t
  yas-minor-mode: t
  window-numbering-mode: t
  shell-dirtrack-mode: t
  scroll-other-window-mode: t
  savehist-mode: t
  outline-minor-mode: t
  TeX-PDF-mode: t
  ekey-mode: t
  winner-mode: t
  eldoc-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
y C-x C-g C-x m C-x k <return> M-x r e p o r t - e 
m a <tab> b u <tab> <return>

Recent messages:
File mode specification error: (void-function nil)
View mode: type C-h for help, h for commands, q to quit.
[yas] Loading for `c-mode', just-in-time: (yas--load-directory-1 
/home/politza/.emacs.d/elpa/yasnippet-0.8.0/snippets/c-mode (quote c-mode) 
(quote (cc-mode)))!
[yas] Loading compiled snippets from 
/home/politza/.emacs.d/elpa/yasnippet-0.8.0/snippets/c-mode
[yas] Loading for `cc-mode', just-in-time: (yas--load-directory-1 
/home/politza/.emacs.d/yasnippets/cc-mode (quote cc-mode) (quote nil))!
[yas] Loading compiled snippets from /home/politza/.emacs.d/yasnippets/cc-mode
[yas] Loading for `cc-mode', just-in-time: (yas--load-directory-1 
/home/politza/.emacs.d/elpa/yasnippet-0.8.0/snippets/cc-mode (quote cc-mode) 
(quote (text-mode)))!
[yas] Loading compiled snippets from 
/home/politza/.emacs.d/elpa/yasnippet-0.8.0/snippets/cc-mode
Desktop: 33 buffers restored.
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
/home/politza/.emacs.d/elpa/yasnippet-0.8.0/dropdown-list hides 
/home/politza/.emacs.d/plugins/yasnippet-0.6.1c/dropdown-list
/home/politza/.emacs.d/elpa/yasnippet-0.8.0/yasnippet hides 
/home/politza/.emacs.d/plugins/yasnippet-0.6.1c/yasnippet
/home/politza/.emacs.d/plugins/haskell-mode/haskell-cabal hides 
/home/politza/.emacs.d/plugins/haskell/haskell-cabal
/home/politza/.emacs.d/plugins/haskell-mode/haskell-decl-scan hides 
/home/politza/.emacs.d/plugins/haskell/haskell-decl-scan
/home/politza/.emacs.d/plugins/haskell-mode/haskell-doc hides 
/home/politza/.emacs.d/plugins/haskell/haskell-doc
/home/politza/.emacs.d/plugins/haskell-mode/ghc-core hides 
/home/politza/.emacs.d/plugins/haskell/ghc-core
/home/politza/.emacs.d/plugins/haskell-mode/haskell-mode hides 
/home/politza/.emacs.d/plugins/haskell/haskell-mode
/home/politza/.emacs.d/plugins/haskell-mode/haskell-c hides 
/home/politza/.emacs.d/plugins/haskell/haskell-c
/home/politza/.emacs.d/plugins/haskell-mode/haskell-indentation hides 
/home/politza/.emacs.d/plugins/haskell/haskell-indentation
/home/politza/.emacs.d/plugins/haskell-mode/haskell-site-file hides 
/home/politza/.emacs.d/plugins/haskell/haskell-site-file
/home/politza/.emacs.d/plugins/haskell-mode/haskell-ghci hides 
/home/politza/.emacs.d/plugins/haskell/haskell-ghci
/home/politza/.emacs.d/plugins/haskell-mode/inf-haskell hides 
/home/politza/.emacs.d/plugins/haskell/inf-haskell
/home/politza/.emacs.d/plugins/haskell-mode/haskell-indent hides 
/home/politza/.emacs.d/plugins/haskell/haskell-indent
/home/politza/.emacs.d/plugins/haskell-mode/haskell-hugs hides 
/home/politza/.emacs.d/plugins/haskell/haskell-hugs
/home/politza/.emacs.d/plugins/haskell-mode/haskell-font-lock hides 
/home/politza/.emacs.d/plugins/haskell/haskell-font-lock
/home/politza/.emacs.d/plugins/haskell-mode/haskell-simple-indent hides 
/home/politza/.emacs.d/plugins/haskell/haskell-simple-indent
/home/politza/.emacs.d/plugins/jedi/scratch hides 
/home/politza/.emacs.d/plugins/ewm/scratch
/home/politza/.emacs.d/elpa/company-0.6.7/.dir-locals hides 
/home/politza/.emacs.d/plugins/el-get/.dir-locals
/home/politza/.emacs.d/plugins/tblc/tblc hides 
/home/politza/.emacs.d/plugins/tblc
/home/politza/.emacs.d/plugins/imenu hides 
/home/politza/src/emacs/trunk/lisp/imenu
/home/politza/.emacs.d/plugins/term hides 
/home/politza/src/emacs/trunk/lisp/term
/home/politza/.emacs.d/plugins/python/python/python hides 
/home/politza/src/emacs/trunk/lisp/progmodes/python
/home/politza/.emacs.d/elpa/company-0.6.7/.dir-locals hides 
/home/politza/src/emacs/trunk/lisp/gnus/.dir-locals
/home/politza/.emacs.d/plugins/python/python/sym-comp hides 
/home/politza/src/emacs/trunk/lisp/obsolete/sym-comp
/home/politza/.emacs.d/plugins/matlab/matlab hides 
/usr/share/emacs-snapshot/site-lisp/emacs-goodies-el/matlab
/home/politza/.emacs.d/plugins/boxquote hides 
/usr/share/emacs-snapshot/site-lisp/emacs-goodies-el/boxquote
/home/politza/.emacs.d/plugins/bm hides 
/usr/share/emacs-snapshot/site-lisp/emacs-goodies-el/bm
/home/politza/.emacs.d/plugins/haskell-mode/haskell-decl-scan hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-decl-scan
/home/politza/.emacs.d/plugins/haskell-mode/haskell-c hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-c
/home/politza/.emacs.d/plugins/haskell-mode/haskell-ghci hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-ghci
/home/politza/.emacs.d/plugins/haskell-mode/haskell-doc hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-doc
/home/politza/.emacs.d/plugins/haskell-mode/haskell-indent hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-indent
/home/politza/.emacs.d/plugins/haskell-mode/haskell-mode hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-mode
/home/politza/.emacs.d/plugins/haskell-mode/haskell-hugs hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-hugs
/home/politza/.emacs.d/plugins/haskell-mode/haskell-site-file hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-site-file
/home/politza/.emacs.d/plugins/haskell-mode/haskell-cabal hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-cabal
/home/politza/.emacs.d/plugins/haskell-mode/inf-haskell hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/inf-haskell
/home/politza/.emacs.d/plugins/haskell-mode/haskell-font-lock hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-font-lock
/home/politza/.emacs.d/plugins/haskell-mode/haskell-simple-indent hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-simple-indent
/home/politza/.emacs.d/plugins/haskell-mode/haskell-indentation hides 
/usr/share/emacs-snapshot/site-lisp/haskell-mode/haskell-indentation

Features:
(shadow sort mail-extr emacsbug bbdb-message sendmail message rfc822 mml
mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231 rfc2047 rfc2045
ietf-drums mail-utils gmm-utils mailheader cc-langs cc-mode cc-fonts
cc-guess cc-menus cc-cmds cc-styles cc-align cc-engine cc-vars cc-defs
vc-dir ewoc vc dired-eshell pdftk-outline vc-git vc-bzr vc-dispatcher
vc-svn emacs-customizations nogroup-customizations wp-customizations
view-customizations tex-customizations reftex-customizations
reftex-miscellaneous-configurations-customizations
reftex-label-support-customizations
reftex-referencing-labels-customizations
reftex-defining-label-environments-customizations AUCTeX-customizations
preview-customizations preview-latex-customizations
preview-appearance-customizations TeX-parse-customizations
TeX-file-customizations TeX-command-customizations
TeX-view-customizations LaTeX-customizations LaTeX-macro-customizations
LaTeX-math-customizations LaTeX-indentation-customizations
table-customizations table-hooks-customizations outlines-customizations
programming-customizations tools-customizations vc-customizations
log-edit-customizations semantic-customizations makefile-customizations
etags-customizations ediff-customizations diff-mode-customizations
languages-customizations elpy-customizations matlab-customizations
sh-customizations python-customizations rx haskell-customizations
c-customizations asm-customizations multimedia-customizations
image-customizations pcase help-customizations ekey-customizations
info-lookup-customizations info-customizations customize-customizations
custom-buffer-customizations apropos-customizations files-customizations
uniquify-customizations uniquify sunrise-customizations
recentf-customizations find-file-customizations backup-customizations
faces-customizations highlight-symbol-customizations
font-lock-customizations hi-lock-customizations facemenu-customizations
external-customizations server-customizations processes-customizations
shell-customizations proced-customizations gud-customizations
tooltip-customizations grep-customizations compilation-customizations
next-error-customizations comint-customizations SQL-customizations
man-customizations environment-customizations windows-customizations
minibuffer-customizations savehist-customizations completion-spelling
lib-string menu-customizations keyboard-customizations
chistory-customizations initialization-customizations
frames-customizations ediff-window-customizations desktop-customizations
desktop dired-customizations dired-x-customizations dired-x
dired-details-customizations editing-customizations
yasnippet-customizations paragraphs-customizations
matching-customizations paren-matching-customizations
paren-showing-customizations isearch-customizations
bookmark-customizations killing-customizations indent-customizations
fill-customizations emulations-customizations
editing-basics-customizations development-customizations
lisp-customizations re-builder-customizations
inferior-lisp-customizations ielm-customizations ert-customizations
edebug-customizations bytecomp-customizations advice-customizations
internal-customizations alloc-customizations extensions-customizations
eldoc-customizations cust-print-customizations data-customizations
save-place-customizations convenience-customizations
iedit-customizations imenu-tree-customizations tags-tree-customizations
company-customizations workgroups-customizations workgroups bookmark pp
window-numbering-customizations pabbrev-customizations
kmacro-customizations imenu-customizations ibuffer-customizations
ibuf-macs hl-line-customizations hippie-expand-customizations
file-cache-customizations ffap-customizations completion-customizations
iswitchb-customizations browse-kill-ring-customizations
auto-revert-customizations auto-insert-customizations
Buffer-menu-customizations comm-customizations tramp-customizations
browse-url-customizations applications-customizations
mediawiki-customizations w3m-customizations package-customizations
mail-customizations bbdb-customizations bbdb-sendmail-customizations
bbdb-mua-customizations bbdb-mua bbdb-com crm mailabbrev bbdb
smtpmail-customizations sendmail-customizations gnus-customizations
gnus-summary-customizations gnus-summary-various-customizations
gnus-summary-exit-customizations gnus-start-customizations
gnus-server-customizations gnus-message-customizations
message-customizations message-various-customizations
gnus-group-customizations gnus-exit-customizations ispell-customizations
eshell-customizations eshell-module-customizations
eshell-smart-customizations eshell-hist-customizations
eshell-mode-customizations edebug doc-view-customizations
pdf-tools-customizations pdf-links-customizations
pdf-isearch-customizations pdf-annot pdf-occur pdf-history pdf-outline
pdf-links pdf-render pdf-isearch pdf-misc imenu pdf-info tq pdf-tools
pdf-util gnus-range doc-view jka-compr image-mode
calendar-customizations org-customizations org-structure-customizations
org-plain-lists-customizations org-edit-structure-customizations
org-startup-customizations org-link-customizations
org-latex-customizations org-appearance-customizations
holidays-customizations calculator-customizations calc-customizations
server recentf tree-widget .autoload paren yasnippet dropdown-list
help-mode window-numbering w3m browse-url timezone w3m-hist w3m-e23
w3m-ccl ccl w3m-fsf w3m-favicon w3m-image w3m-proc w3m-util view tramp
tramp-compat tramp-loaddefs trampver shell track-last-window
scroll-other-window saveplace savehist reftex reftex-vars pabbrev org
ob-tangle ob-ref ob-lob ob-table org-footnote org-src ob-comint ob-keys
org-pcomplete pcomplete org-list org-faces org-entities noutline outline
org-version ob-emacs-lisp ob org-compat org-macs ob-eval org-loaddefs
format-spec find-func cal-menu calendar cal-loaddefs lib-edit lib-window
lib-isearch lib-buffer reveal iswitchb lib-basic lib-lispext latex
easy-mmode tex-style tex info-look ibuffer hippie-exp grep compile
filladapt filecache edit-minibuffer eldoc-eval esh-var esh-io esh-cmd
esh-opt esh-ext esh-proc esh-arg esh-groups eshell esh-module esh-mode
esh-util ekey assoc dired-details+ warnings dired dired-details
cool-prefix-bindings winner lib-kbd comint-history comint ansi-color
ring browse-kill-ring advice anticus edmacro kmacro derived cl-macs gv
ffap thingatpt url-parse auth-source eieio byte-opt bytecomp
byte-compile cconv gnus-util mm-util mail-prsvr password-cache url-vars
eldoc help-fns cus-edit cus-start cus-load wid-edit cl nadvice cl-lib
bbdb-loaddefs auctex-autoloads tex-site info easymenu company-autoloads
eldoc-eval-autoloads yasnippet-autoloads package time-date tooltip
ediff-hook vc-hooks lisp-float-type mwheel x-win x-dnd tool-bar dnd
fontset image regexp-opt fringe tabulated-list newcomment lisp-mode
register page menu-bar rfn-eshadow timer select scroll-bar mouse
jit-lock font-lock syntax facemenu font-core frame cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese case-table epa-hook jka-cmpr-hook help simple abbrev
minibuffer loaddefs button faces cus-face macroexp files text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote make-network-process dbusbind inotify
dynamic-setting system-font-setting font-render-setting move-toolbar gtk
x-toolkit x multi-tty emacs)