abort() in query-replace

[Robert Mecklenburg]

On 7/23 I mailed in a bug report on an abort while executing
query-replace.  At the time I sent a stack trace but forgot the
xbacktrace.  Now I explain how to reproduce it.

To reproduce:

1. Install cedet-1.0beta2b
(http://prdownloads.sourceforge.net/cedet/cedet-1.0beta2b.tar.gz?download)
and jde-2.3.4beta5 (http://jdee.sunsite.dk/jde-beta.tar.gz)

2. Create a file "Foo.java" containing:

public class Foo
{
  public Foo()
  {
  }
}

3. Start emacs using:

emacs -q --no-site-file

4. execute:

(setq semantic-load-turn-useful-things-on t)
(load-file "/usr/local/share/emacs/site-lisp/cedet-1.0beta2b/common/cedet.el")
(add-to-list 'load-path "/usr/local/share/emacs/site-lisp/jde-2.3.4beta5/lisp")
(require 'jde "jde" t)

5. find-file Foo.java and run query-replace

M-% Foo <ret> <ret> <space>


This sequence causes the crash every time for me.  Here is the data
from the last crash I investigated:


Breakpoint 1, abort () at emacs.c:428
428       kill (getpid (), SIGABRT);
(gdb) where
#0  abort () at emacs.c:428
#1  0x08147992 in buf_charpos_to_bytepos (b=0xa2c4f80, charpos=0) at 
marker.c:141
#2  0x081c6d94 in set_point (buffer=0xa2c4f80, charpos=0) at intervals.c:1957
#3  0x081c7601 in move_if_not_intangible (position=0) at intervals.c:2284
#4  0x081631ae in Freplace_match (newtext=153507224, fixedcase=138494017, 
literal=138494017, string=138493969,
    subexp=138493969) at search.c:2617
#5  0x08189153 in Ffuncall (nargs=4, args=0xbfffe540) at eval.c:2758
#6  0x081b4639 in Fbyte_code (bytestr=137145987, vector=137146060, maxdepth=64) 
at bytecode.c:689
#7  0x08189510 in funcall_lambda (fun=137145916, nargs=5, 
arg_vector=0xbfffe664) at eval.c:2912
#8  0x08188ff3 in Ffuncall (nargs=6, args=0xbfffe660) at eval.c:2782
#9  0x081b4639 in Fbyte_code (bytestr=137146883, vector=137148028, 
maxdepth=136) at bytecode.c:689
#10 0x08189510 in funcall_lambda (fun=137146772, nargs=9, 
arg_vector=0xbfffe7b4) at eval.c:2912
#11 0x08188ff3 in Ffuncall (nargs=10, args=0xbfffe7b0) at eval.c:2782
#12 0x081b4639 in Fbyte_code (bytestr=137129963, vector=137129996, maxdepth=80) 
at bytecode.c:689
#13 0x08189510 in funcall_lambda (fun=137129884, nargs=5, 
arg_vector=0xbfffe8e4) at eval.c:2912
#14 0x08188ff3 in Ffuncall (nargs=6, args=0xbfffe8e0) at eval.c:2782
#15 0x0818891c in Fapply (nargs=2, args=0xbfffe970) at eval.c:2178
#16 0x08188d4c in apply1 (fn=140547529, arg=162926709) at eval.c:2486
#17 0x081848e5 in Fcall_interactively (function=140547529, 
record_flag=138493969, keys=154658844) at callint.c:406
#18 0x0813094e in Fcommand_execute (cmd=140547529, record_flag=138493969, 
keys=138493969, special=138493969)
    at keyboard.c:9724
#19 0x08124fe3 in command_loop_1 () at keyboard.c:1776
#20 0x0818741d in internal_condition_case (bfun=0x8124bf0 <command_loop_1>, 
handlers=138554897,
    hfun=0x81246f0 <cmd_error>) at eval.c:1335
#21 0x08124a1b in command_loop_2 () at keyboard.c:1306
#22 0x08186f5a in internal_catch (tag=138548905, func=0x8124a00 
<command_loop_2>, arg=138493969) at eval.c:1096
#23 0x081249d7 in command_loop () at keyboard.c:1285
#24 0x08124422 in recursive_edit_1 () at keyboard.c:978
#25 0x0812456f in Frecursive_edit () at keyboard.c:1039
#26 0x08122caf in main (argc=3, argv=0xbffff154) at emacs.c:1687
(gdb) list
136       struct Lisp_Marker *tail;
137       int best_above, best_above_byte;
138       int best_below, best_below_byte;
139
140       if (charpos < BUF_BEG (b) || charpos > BUF_Z (b))
141         abort ();
142
143       best_above = BUF_Z (b);
144       best_above_byte = BUF_Z_BYTE (b);
145
(gdb) p b
$1 = (struct buffer *) 0xa2c4f80
(gdb) p *b
$2 = {
  size = 1073873011,
  next = 0xa14bea8,
  own_text = {
    beg = 0xaa328e8 "//\n// GroupManager\n//\n// Realm Systems, Inc. 
Unpublished (c) All rights reserved.\n//\n\npackage 
com.realmsys.wsr.server.user;\n\nimport 
com.realmsys.wsr.lib.exceptions.ConfigurationException;\nimport com.r"...,
    gpt = 3541,
    z = 6463,
    gpt_byte = 3541,
    z_byte = 6463,
    gap_size = 657,
    modiff = 29368,
    save_modiff = 0,
    overlay_modiff = 13921,
    beg_unchanged = 3531,
    end_unchanged = 2085,
    unchanged_modified = 29366,
    overlay_unchanged_modified = 13920,
    intervals = 0x9ae11a0,
    markers = 0x9b5d3b8
  },
  text = 0xa2c4f88,
  pt = 3541,
  pt_byte = 3541,
  begv = 1,
  begv_byte = 1,
  zv = 6463,
  zv_byte = 6463,
  base_buffer = 0x0,
  local_flags = 
"\000\001\001\000\001\000\000\000\001\000\000\001\000\001\000\001\000\000\000\001",
 '\0' <repeats 11 times>, "\001\000\000\000\000\220\000\000\000 
\000\000\000\000\000\000\000sc",
  modtime = 1090621445,
  auto_save_modified = 29185,
  display_error_modiff = 0,
  auto_save_failure_time = -1,
  last_window_start = 3143,
  clip_changed = 0,
  newline_cache = 0x0,
  width_run_cache = 0x0,
  prevent_redisplay_optimizations_p = 1,
  overlays_before = 0xa5a95c0,
  overlays_after = 0x94bdb58,
  overlay_center = 4958,
  name = 156027219,
  filename = 156027203,
  directory = 143819779,
  backed_up = 138493969,
  save_length = 51776,
  auto_save_file_name = 157869251,
  read_only = 138493969,
  mark = 175833082,
  local_var_alist = 169251141,
---Type <return> to continue, or q <return> to quit---
  major_mode = 146188473,
  mode_name = 148730627,
  mode_line_format = 148529685,
  undo_list = 177456133,
  header_line_format = 141270069,
  keymap = 160166413,
  abbrev_table = 174805356,
  syntax_table = 148732140,
  category_table = 138532100,
  case_fold_search = 138493969,
  tab_width = 64,
  fill_column = 720,
  left_margin = 0,
  auto_fill_function = 138493969,
  buffer_file_type = 138493969,
  downcase_table = 138534196,
  upcase_table = 140085532,
  case_canon_table = 140172212,
  case_eqv_table = 140193700,
  truncate_lines = 138493969,
  ctl_arrow = 138494017,
  direction_reversed = 138493969,
  selective_display = 138493969,
  selective_display_ellipses = 138494017,
  minor_modes = 138493969,
  overwrite_mode = 138493969,
  abbrev_mode = 138494017,
  display_table = 138493969,
  mark_active = 138493969,
  enable_multibyte_characters = 138494017,
  buffer_file_coding_system = 138598425,
  file_format = 138493969,
  cache_long_line_scans = 138493969,
  width_table = 138493969,
  pt_marker = 138493969,
  begv_marker = 138493969,
  zv_marker = 138493969,
  point_before_scroll = 138493969,
  file_truename = 157941467,
  invisibility_spec = 138494017,
  last_selected_window = 175420892,
  display_count = 80,
  left_margin_cols = 0,
  right_margin_cols = 0,
  left_fringe_width = 138493969,
  right_fringe_width = 138493969,
  fringes_outside_margins = 138493969,
  scroll_bar_width = 138493969,
  vertical_scroll_bar_type = 138494017,
  indicate_empty_lines = 138494017,
  indicate_buffer_boundaries = 138493969,
  display_time = 164637085,
---Type <return> to continue, or q <return> to quit---
  scroll_up_aggressively = 138493969,
  scroll_down_aggressively = 138493969,
  cursor_type = 138494017,
  extra_line_spacing = 138493969
}
(gdb)(gdb) up
#2  0x081c6d94 in set_point (buffer=0x87f4700, charpos=0) at intervals.c:1957
1957      set_point_both (buffer, charpos, buf_charpos_to_bytepos (buffer, 
charpos));
(gdb) up
#3  0x081c7601 in move_if_not_intangible (position=0) at intervals.c:2284
2284        SET_PT (position);
(gdb) up
#4  0x081631ae in Freplace_match (newtext=142420952, fixedcase=138494017, 
literal=138494017, string=138493969,
    subexp=138493969) at search.c:2617
2617      move_if_not_intangible (newpoint);
(gdb) up
#5  0x08189153 in Ffuncall (nargs=4, args=0xbfffe540) at eval.c:2758
2758              val = (*XSUBR (fun)->function) (internal_args[0], 
internal_args[1],
(gdb) up
#6  0x081b4639 in Fbyte_code (bytestr=137145987, vector=137146060, maxdepth=64) 
at bytecode.c:689
689                 TOP = Ffuncall (op + 1, &TOP);
(gdb) up
#7  0x08189510 in funcall_lambda (fun=137145916, nargs=5, 
arg_vector=0xbfffe664) at eval.c:2912
2912          val = Fbyte_code (AREF (fun, COMPILED_BYTECODE),
(gdb) p fun
$1 = 137145916
(gdb) pr
#[(newtext fixedcase literal noedit match-data) +       +ÅÆÇ
\"+ÈÉÊËÅ
Ì%ÌTBÍÎ
       #\"Î
Ï
 !Ê

#       " [literal noedit newtext match-data fixedcase t string-match 
"\\(\\`\\|[^\\]\\)\\(\\\\\\\\\\)*\\(\\\\\\?\\)" read-input "Edit replacement 
string: " replace-match "" 3 replace-match-data nil set-match-data] 8 1641096]
(gdb) xbacktrace
"replace-match"
"replace-match-maybe-edit"
"perform-replace"
"query-replace"
"call-interactively"






In GNU Emacs 21.3.50.2 (i686-pc-linux-gnu, GTK+ Version 2.2.4)
 of 2004-07-26 on oops.realmsys.com
configured using `configure '--with-x11' '--with-x-toolkit=gtk''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: en_US
  value of $LC_CTYPE: en_US
  value of $LC_MESSAGES: en_US
  value of $LC_MONETARY: en_US
  value of $LC_NUMERIC: en_US
  value of $LC_TIME: en_US
  value of $LANG: en_US
  locale-coding-system: iso-latin-1
  default-enable-multibyte-characters: t

Major mode: Fundamental

Minor modes in effect:
  show-paren-mode: t
  auto-image-file-mode: t
  recentf-mode: t
  auto-compression-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  global-font-lock-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
a v e SPC n o SPC f u t h e r SPC <backspace> <backspace> 
<backspace> <backspace> <backspace> r t h e r SPC i 
n f r <backspace> o r m a t i o n . C-n C-j T h a n 
k s , C-a C-p C-p C-p C-p C-p C-p C-p C-p C-p C-p C-p 
C-p C-p C-p C-p C-p C-k C-k C-c C-c <switch-frame> 
C-g p p p p n n n n n n SPC n SPC <switch-frame> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <menu-bar> <help-menu> <report-emacs-b
ug>

Recent messages:
Added to /home/mecklen/Mail/record
Loading netrc...done
Sending...done
Quit
End of message 162 from Stefan Monnier
End of message 161 from Kim F. Storm [2 times]
End of message 162 from Stefan Monnier
End of message 164 from Richard Stallman
End of message 165 from Richard Stallman
End of message 167 from Dan Reading [2 times]


-- 
Robert