bug#6177: 23.2; emacs crashes when reverting a file

[Eli Zaretskii <eliz@gnu.org>]

> Date: Wed, 12 May 2010 08:13:41 -0500
> From: "Roland Winkler" <Roland.Winkler@physik.uni-erlangen.de>
> Cc: 6177@debbugs.gnu.org
> 
> Any hints on what these crashes are possibly be related with
> according to the backtrace are greatly appreciated.

Let me try to give you some insights, by walking the call-stack
frames, telling what I see, and asking questions.

  #1  0x081deb85 in temp_set_point_both (buffer=0x98411c8, charpos=92, bytepos=92) at intervals.c:1950

This frame causes the crash here:

  if (charpos > BUF_ZV (buffer) || charpos < BUF_BEGV (buffer))
    abort ();

BUF_ZV and BUF_BEGV are, respectively (point-max) and (point-min) of
the buffer.  Since we see that charpos is 92, I'm guessing that the
first comparison is the culprit, i.e. (point-max) is less than or
equal to 92.

What do the following GDB commands display in frame #1?

  (gdb) print buffer->zv
  (gdb) print *buffer->text->beg@N

Here N is the value of buffer->zv displayed by the first command.

  #2  0x08091754 in redisplay_window (window=159032549, just_this_one_p=0) at xdisp.c:13940

This frame calls temp_set_point_both here:

  /* Restore current_buffer and value of point in it.  */
  TEMP_SET_PT_BOTH (CHARPOS (opoint), BYTEPOS (opoint));

opoint is initialized at the beginning of the function to the value of
point:

  SET_TEXT_POS (lpoint, PT, PT_BYTE);
  opoint = lpoint;

So it looks like the value of point that was valid before redisplaying
the window somehow became invalid during redisplaying it.  Hmm...
What kind of buffer is this?  Type these commands to find out:

  (gdb) print buffer->name
  (gdb) xstring

Also, what window are we redisplaying?  Type these commands:

  (gdb) print w->mini_p
  (gdb) xsymbol

TIA