bug#23869: 25.0.95; replace-match can crash emacs

[Eli Zaretskii <eliz@gnu.org>]

> From: Leo Liu <sdl.web@gmail.com>
> Date: Wed, 29 Jun 2016 22:17:20 +0800
> 
> Under some circumstances replace-match can crash emacs. It takes a lot
> to reproduce the crash and I haven't been able to find a minimal
> example. But I wonder if the backtrace that I captured in LLDB can give
> any clue to the clause? I can't reproduce the same crash in emacs24.

Do you still have this crashed session in a debugger?  Because some of
the values involved in this crash are not clear or not shown.

>     frame #1: 0x000000010028356a emacs`set_point_both(charpos=-1, bytepos=-1) + 234 at intervals.c:1921
>     frame #2: 0x0000000100283476 emacs`set_point(charpos=-1) + 54 at intervals.c:1816
>     frame #3: 0x0000000100284597 emacs`move_if_not_intangible(position=-1) + 855 at intervals.c:2157

The immediate reason is obviously the POSITION = -1 above, but the
question is: how did replace-match allow that to happen?  It's a large
function, so it's hard to tell how this could happen without seeing
some of the variables there.

Do you perhaps remember or know what text was replaced by what when
this happened?