Crash calling md5 for a list of buffers

[Dmitry Antipov <dmitry.antipov@mail.ru>]

Hello,

Calling 'md5' can cause the crash with 'Fatal error (6).Aborted (core 
dumped)'.
To reproduce, do:
1. Run emacs with a lot of buffers (for example, go to the source directory
    of some project and do 'emacs *.c'.
2. Eval one of:
    - (mapcar 'md5 (buffer-list)) or
    - (mapcar '(lambda (b) (md5 b nil nil 'raw-text)) (buffer-list))

My post-mortem backtrace is:
----
#0  0x40326671 in kill () from /lib/i686/libc.so.6
#1  0x080cf84c in fatal_error_signal (sig=27993) at emacs.c:354
#2  <signal handler called>
#3  0x40326671 in kill () from /lib/i686/libc.so.6
#4  0x080cf88a in abort () at emacs.c:387
#5  0x080f0498 in buf_charpos_to_bytepos (b=0x8805980, charpos=459097) 
at marker.c:141
#6  0x0811f1df in make_buffer_string (start=1, end=27993, props=0) at 
editfns.c:2151
#7  0x08131a9d in Fmd5 (object=1216014040, start=405215452, 
end=405215452, coding_system=405385700,
    noerror=405215452) at fns.c:5169
#8  0x08126510 in Feval (form=136526776) at eval.c:2027
#9  0x0812427d in Fprogn (args=1484879300) at eval.c:431
#10 0x0812721f in funcall_lambda (fun=142702100, nargs=1, 
arg_vector=0xbfffe554) at eval.c:2844
#11 0x08126dfe in Ffuncall (nargs=2, args=0xbfffe550) at eval.c:2716
#12 0x08126bc4 in call1 (fn=1484879380, arg1=1216014040) at eval.c:2456
#13 0x0812ecd0 in mapcar1 (leni=117, vals=0xbfffe5d0, fn=1484879380, 
seq=-1073750316) at fns.c:2713
#14 0x0812eef0 in Fmapcar (function=1484879380, sequence=1484918916) at 
fns.c:2773
#15 0x081264c2 in Feval (form=136525648) at eval.c:2013
#16 0x08126ede in Ffuncall (nargs=2, args=0xbfffe904) at eval.c:2659
#17 0x0814e340 in Fbyte_code (bytestr=135968312, vector=1, 
maxdepth=-1073747712) at bytecode.c:716
#18 0x081271e0 in funcall_lambda (fun=1209710080, nargs=2, 
arg_vector=0xbfffea14) at eval.c:2851
#19 0x08126dfe in Ffuncall (nargs=3, args=0xbfffea10) at eval.c:2716
#20 0x08126796 in Fapply (nargs=2, args=0xbfffeaa0) at eval.c:2169
#21 0x08126b85 in apply1 (fn=405374140, arg=1484879044) at eval.c:2423
#22 0x0812390c in Fcall_interactively (function=405374140, 
record_flag=405215452, keys=1210580568)
    at callint.c:367
#23 0x080dbeba in Fcommand_execute (cmd=405374140, 
record_flag=405215452, keys=405215452, special=405215452)
    at keyboard.c:9250
#24 0x080d22aa in command_loop_1 () at keyboard.c:1661
#25 0x0812537a in internal_condition_case (bfun=0x80d1f2c 
<command_loop_1>, handlers=405311796,
    hfun=0x80d1b54 <cmd_error>) at eval.c:1267
#26 0x080d1e06 in command_loop_2 () at keyboard.c:1245
#27 0x08124f35 in internal_catch (tag=0, func=0x80d1de8 
<command_loop_2>, arg=405215452) at eval.c:1030
#28 0x080d1dbc in command_loop () at keyboard.c:1224
#29 0x080d1924 in recursive_edit_1 () at keyboard.c:950
#30 0x080d1a40 in Frecursive_edit () at keyboard.c:1006
#31 0x080d04d3 in main (argc=111, argv=0xbffff234, envp=0xbffff3f4) at 
emacs.c:1547
#32 0x40313a67 in __libc_start_main () from /lib/i686/libc.so.6
---
  This bug is founded on Emacs 21.3 (GNU Emacs 21.3.1 
(i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars))
on custom RedHat 9.0-based system (kernel version 2.4.24, gcc version 
3.2.2, libc version 2.3.2-27.9.7 (comes
from RedHat package)). Compilation flags are default '-g -O2'.
  I've also got exactly the same results with CVS shapshot (2004-01-20).

Dmitry.