bug#12360: 24.2.50; Crash in set_buffer_internal_1

[Werner LEMBERG <wl@gnu.org>]

[rev 109796 + windowp.diff from

 http://debbugs.gnu.org/cgi/bugreport.cgi?msg=14;filename=windowp.diff;att=1;bug=12310]


The crash happened after composing an email with mew, then trying to
send it with C-c C-c.


    Werner


======================================================================


Program received signal SIGSEGV, Segmentation fault.
set_buffer_internal_1 (b=0x846958d) at buffer.c:2154
2154        bset_undo_list (b, BVAR (b->base_buffer, undo_list));

(gdb) p b
$1 = (struct buffer *) 0x846958d

(gdb) p b->base_buffer
$2 = (struct buffer *) 0x98000000

(gdb) p *b->base_buffer
Cannot access memory at address 0x98000000

(gdb) p undo_list
No symbol "undo_list" in current context.

(gdb) bt full
#0  set_buffer_internal_1 (b=0x846958d) at buffer.c:2154
        old_buf = 0x8480af8
        tail = <optimized out>
#1  0x08147c06 in command_loop_1 () at keyboard.c:1438
        cmd = <optimized out>
        keybuf = {12, -1073747977, 159382230, 40, -1073746568, 134626714, 141443984, 138843538, 
    -1073747977, -1073747977, 159382230, 40, -1073746568, 135518707, 159382230, 138843562, -1073747977, 
    140927362, -1073747977, 40, 40, 135518989, 159382230, -1073747977, -1073746568, 135978019, 140497734, 
    4625810, -1207960904, 0}
        i = <optimized out>
        prev_modiff = 0
        prev_buffer = 0x0
#2  0x081aa67d in internal_condition_case (bfun=0x8147b30 <command_loop_1>, handlers=138877346, hfun=
    0x813da40 <cmd_error>) at eval.c:1322
        val = <optimized out>
        c = {
          tag = 138843538, 
          val = 138843538, 
          next = 0xbfffe968, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {0, 142791432, 142791448, -1073746568, 1781480335, -1598877472}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {134553001, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3062816632, 3065862960, 0, 0, 0, 0, 
    4294967295, 3221219536, 3221219824, 135609939, 2, 3087003588, 3087005952, 1, 0, 3086922907, 3087006392, 
    3058843712, 1, 1, 0, 1}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
        h = {
          handler = 138877346, 
          var = 138843538, 
          chosen_clause = 138843562, 
          tag = 0xbfffe844, 
          next = 0x0
        }
#3  0x0813c375 in command_loop_2 (ignore=138843538) at keyboard.c:1204
        val = 138843538
#4  0x081aa599 in internal_catch (tag=138875290, func=0x813c350 <command_loop_2>, arg=138843538)
    at eval.c:1079
        c = {
          tag = 138875290, 
          val = 138843538, 
          next = 0x0, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {0, 142791432, 142791448, -1073746568, 1781398415, -1598716192}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {0, 177, 23, 3063290583, 140685641, 140685640, 136248496, 142668888, 136562658, 14, 
    58, 142668888, 14, 136562658, 3221219912, 0, 0, 0, 3221219912, 400, 3221221571, 136562658, 138967378, 
    138967376, 138843538, 3221220728, 135976258, 138967378, 138843538, 138843538, 1, 0}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
#5  0x0813d58a in command_loop () at keyboard.c:1183
No locals.
#6  recursive_edit_1 () at keyboard.c:804
        count = 1
        val = 0
#7  0x0813d87f in Frecursive_edit () at keyboard.c:868
        count = <optimized out>
        buffer = 138843538
#8  0x080599d0 in main (argc=2, argv=Cannot access memory at address 0xa0b310e4
) at emacs.c:1654
        dummy = 136470960
        stack_bottom_variable = 8 '\b'
        do_initial_setlocale = <optimized out>
        skip_args = 0
        rlim = {
          rlim_cur = 8388608, 
          rlim_max = 18446744073709551615
        }
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0xb6a873c4 "\300\201\250\266\340\203\250\266\300p\250\266\264p\250\266dp\250\266\003"