bug#2622: Segfault with org-mode

[<skampi@gmx.net>]

Using an org-file I can cause a segfault in Gnu Emacs performing the
following steps:

shell> emacs -q

M-x load-file RET segfault_init.el RET
- segfault_init.el ---------------------------------------------------
(setq load-path
     (append
      (list
       "~/.emacs.d/lisp" ;; contains linum.el
       )
      load-path))


(require 'org)
;; basic setup
(add-to-list 'auto-mode-alist '("\\.org$" . org-mode))
(define-key global-map "\C-cl" 'org-store-link)
(define-key global-map "\C-ca" 'org-agenda)
(setq org-log-done t)
(setq org-hide-leading-stars t)
(setq org-startup-folded nil)
(setq org-export-with-sub-superscripts (quote {}))
(setq org-default-notes-file nil)

(require 'linum)
(global-linum-mode)
----------------------------------------------------------------------

M-x load-library RET org RET

C-x C-f segfault.org RET
- segfault.org -------------------------------------------------------
DEFAULT TODO FILE 

* Tasks
#+CATEGORY: Tasks	

** TODO Do something very important
  [2007-10-24 Wed]

** DONE This is really finished
   CLOSED: [2007-10-30 Tue 17:33]
  [2007-10-24 Wed]
----------------------------------------------------------------------

M-x goto-line RET 3 RET

TAB TAB

shell> 
Fatal error (11)Segmentation fault (core dumped)


linnum.el is (defconst linum-version "0.9wza") by  Markus Triska taken
from http://stud4.tuwien.ac.at/~e0225855/linum/linum.html

While I understand that libraries from the net might cause problems, a
/segfault// should probably not be caused by elisp-code.


Please note: I write this bug report from a fully loaded Emacs not
from the minimal example provided above.  So all those minor-modes 
and loaded libraries down there are not necessary. 

Cheers,
Stefan Kamphausen


(gdb) bt full
#0  0xffffe424 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb74df406 in kill () from /lib/libc.so.6
No symbol table info available.
#2  0x080f7cec in fatal_error_signal ()
No symbol table info available.
#3  <signal handler called>
No symbol table info available.
#4  0x0807b277 in next_element_from_display_vector ()
No symbol table info available.
#5  0x08077ddf in get_next_display_element ()
No symbol table info available.
#6  0x08078c38 in move_it_in_display_line_to ()
No symbol table info available.
#7  0x0807b227 in move_it_to ()
No symbol table info available.
#8  0x0808ba60 in pos_visible_p ()
No symbol table info available.
#9  0x08099deb in Fpos_visible_in_window_p ()
No symbol table info available.
#10 0x0815f010 in Ffuncall ()
No symbol table info available.
#11 0x08189a46 in Fbyte_code ()
No symbol table info available.
#12 0x0815ea74 in funcall_lambda ()
No symbol table info available.
#13 0x0815ee8b in Ffuncall ()
No symbol table info available.
#14 0x08189a46 in Fbyte_code ()
No symbol table info available.
#15 0x0815ea74 in funcall_lambda ()
No symbol table info available.
#16 0x0815ee8b in Ffuncall ()
No symbol table info available.
#17 0x08160421 in run_hook_with_args ()
No symbol table info available.
#18 0x0815f1a3 in Ffuncall ()
No symbol table info available.
#19 0x08189a46 in Fbyte_code ()
No symbol table info available.
#20 0x0815ea74 in funcall_lambda ()
No symbol table info available.
#21 0x0815ee8b in Ffuncall ()
No symbol table info available.
#22 0x0815c250 in Fcall_interactively ()
No symbol table info available.
#23 0x080fae53 in Fcommand_execute ()
No symbol table info available.
#24 0x0810694a in command_loop_1 ()
No symbol table info available.
#25 0x0815daab in internal_condition_case ()
No symbol table info available.
#26 0x081003ae in command_loop_2 ()
No symbol table info available.
#27 0x0815db6c in internal_catch ()
No symbol table info available.
#28 0x08100d5e in command_loop ()
No symbol table info available.
#29 0x081010e7 in recursive_edit_1 ()
No symbol table info available.
#30 0x081011da in Frecursive_edit ()
No symbol table info available.
#31 0x080f7082 in main ()
No symbol table info available.

(gdb) xbacktrace
Undefined command: "xbacktrace".  Try "help".


In GNU Emacs 22.3.1 (i686-pc-linux-gnu, GTK+ Version 2.12.11)
 of 2009-02-24 on localhost
Windowing system distributor `The X.Org Foundation', version 11.0.10300000
configured using `configure  '--prefix=/usr' '--host=i686-pc-linux-gnu' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--datadir=/usr/share' '--sysconfdir=/etc' '--localstatedir=/var/lib' '--program-suffix=-emacs-22' '--infodir=/usr/share/info/emacs-22' '--without-carbon' '--with-sound' '--with-x' '--with-toolkit-scroll-bars' '--with-jpeg' '--with-tiff' '--with-gif' '--with-png' '--with-xpm' '--with-x-toolkit=gtk' '--without-hesiod' '--with-kerberos' '--with-kerberos5' '--build=i686-pc-linux-gnu' 'build_alias=i686-pc-linux-gnu' 'host_alias=i686-pc-linux-gnu' 'CFLAGS=-O2 -march=i686 -pipe' 'LDFLAGS=-Wl,-O1''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  locale-coding-system: nil
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  shell-dirtrack-mode: t
  global-linum-mode: t
  linum-mode: t
  iswitchb-mode: t
  global-highline-mode: t
  recentf-mode: t
  eldoc-mode: t
  show-paren-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x b u g <tab> <tab> <backspace> <backspace> <backspace> 
r e p o <tab> r <tab> <return>

Recent messages:
Loading cl-seq...done
Loading cl-extra...done
!! File slime-package-fu uses old-style backquotes !!
Loading cl-indent...done
Loading /home/ska/.emacs.d/init.el (source)...done
Loading semantic-el...done
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list...
Loading eieio-opt...done
Loading emacsbug...done