Re: emacs crashes at search-backward

[Richard Stallman]

    #3  0x08124ae7 in simple_search (n=180836955, pat=0x92294 <Address 0x92294 
out of bounds>, len=598820, len_byte=1, trt=1, pos=-1, pos_byte=0, 
lim=139377756, lim_byte=139470164) at search.c:1487

That appears to be in the following line:

                buf_ch = STRING_CHAR_AND_LENGTH (BYTE_POS_ADDR (this_pos_byte),
                                                 ZV_BYTE - this_pos_byte,
                                                 buf_charlen);

(Please check your sources and verify that.)

Can you please examine these data and see what is invalid?
Also, what does BYTE_POS_ADDR (this_pos_byte)?
(If you need to expand macros by hand, please do it!)

What is really the value of n?
What is really the value of lim?
The values shown in the stack frame arg list seem nonsensical,
so I suspect they are not the real values.
Can you look at frame 4 and evaluate the args that will
have been passed to simple_search for  N and LIM?