bug#15907: 24.3; Emacs crash due to substitute-command-keys and after-change-functions

[Eli Zaretskii <eliz@gnu.org>]

> Date: Sat, 16 Nov 2013 11:46:21 +0000
> From: Bruce Connor <bruce.connor.am@gmail.com>
> 
> The real life use case was that having smart-mode-line active meant emacs
> would crash everytime I hit "C-h m".
> 
> However, I patched smart-mode-line with a work around for this yesterday,
> so it's not a use case anymore. I just figured "format" was such a basic
> function that it was good to report it anyway.

You may wish patching your Emacs with the patch below instead.

The problem was not in 'format', but in substitute-command-keys, btw.

Here's how I fixed that:

=== modified file 'src/doc.c'
--- src/doc.c	2013-08-11 01:30:20 +0000
+++ src/doc.c	2013-11-16 10:20:32 +0000
@@ -850,6 +850,7 @@ Otherwise, return a new string, without 
 	  /* This is for computing the SHADOWS arg for describe_map_tree.  */
 	  Lisp_Object active_maps = Fcurrent_active_maps (Qnil, Qnil);
 	  Lisp_Object earlier_maps;
+	  ptrdiff_t count = SPECPDL_INDEX ();
 
 	  changed = 1;
 	  strp += 2;		/* skip \{ or \< */
@@ -886,6 +887,10 @@ Otherwise, return a new string, without 
 	  /* Now switch to a temp buffer.  */
 	  oldbuf = current_buffer;
 	  set_buffer_internal (XBUFFER (Vprin1_to_string_buffer));
+	  /* This is for an unusual case where some after-change
+	     function uses 'format' or 'prin1' or something else that
+	     will thrash Vprin1_to_string_buffer we are using.  */
+	  specbind (Qinhibit_modification_hooks, Qt);
 
 	  if (NILP (tem))
 	    {
@@ -910,6 +915,7 @@ Otherwise, return a new string, without 
 	  tem = Fbuffer_string ();
 	  Ferase_buffer ();
 	  set_buffer_internal (oldbuf);
+	  unbind_to (count, Qnil);
 
 	subst_string:
 	  start = SDATA (tem);

=== modified file 'src/keymap.c'
--- src/keymap.c	2013-08-11 01:30:20 +0000
+++ src/keymap.c	2013-11-16 09:24:19 +0000
@@ -3383,9 +3383,12 @@ describe_map (Lisp_Object map, Lisp_Obje
 
       if (vect[i].shadowed)
 	{
-	  SET_PT (PT - 1);
+	  ptrdiff_t pt = max (PT - 1, BEG);
+
+	  SET_PT (pt);
 	  insert_string ("\n  (that binding is currently shadowed by another mode)");
-	  SET_PT (PT + 1);
+	  pt = min (PT + 1, Z);
+	  SET_PT (pt);
 	}
     }