bug#1296: Segfault with `M-- M-r' when `scroll-margin' is higher than zero

[Teemu Likonen <tlikonen@iki.fi>]

Emacs crashes with segmentation fault when I type command `M-- M-r'
while variable `scroll-margin' has value 1 more more.

Steps to reproduce:

 1. Start Emacs from text terminal:

        $ emacs -Q

 2. Move to Emacs reference manual buffer:

        C-h r

 3. Don't move the cursor. Set the `scroll-margin' variable:

        M-x set-variable RET scroll-margin RET 4 RET

 4. Run command `move-to-window-line' with negative argument:

        M-- M-r

 5. You should see the Emacs frame disappearing and the following error
    message in terminal:

        Fatal error (11)Segmentation fault

I have tried with Emacs version

    GNU Emacs 22.2.1 (i486-pc-linux-gnu, GTK+ Version 2.12.11) of
    2008-10-17 on raven, modified by Debian

and development snapshot version

    GNU Emacs 23.0.60.1 (i486-pc-linux-gnu, GTK+ Version 2.12.11) of
    2008-10-18 on elegiac, modified by Debian


(I'm writing this bug report with 22.2.1 as you can see from the
following automatically inserted information.)


In GNU Emacs 22.2.1 (i486-pc-linux-gnu, GTK+ Version 2.12.11)
 of 2008-10-17 on raven, modified by Debian
Windowing system distributor `The X.Org Foundation', version 11.0.10402000
configured using `configure  '--build=i486-linux-gnu' '--host=i486-linux-gnu' '--prefix=/usr' '--sharedstatedir=/var/lib' '--libexecdir=/usr/lib' '--localstatedir=/var/lib' '--infodir=/usr/share/info' '--mandir=/usr/share/man' '--with-pop=yes' '--enable-locallisppath=/etc/emacs22:/etc/emacs:/usr/local/share/emacs/22.2/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/22.2/site-lisp:/usr/share/emacs/site-lisp:/usr/share/emacs/22.2/leim' '--with-x=yes' '--with-x-toolkit=gtk' '--with-toolkit-scroll-bars' 'build_alias=i486-linux-gnu' 'host_alias=i486-linux-gnu' 'CFLAGS=-DDEBIAN -g -O2' 'LDFLAGS=-g' 'CPPFLAGS=''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: en_US.UTF-8
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: fi_FI.UTF-8
  locale-coding-system: utf-8
  default-enable-multibyte-characters: t

Major mode: Info

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
C-h r C-s r e p o <return> <S-iso-lefttab> <return> 
<tab> <tab> <return> <down-mouse-5> <mouse-5> <down-mouse-5> 
<mouse-5> <double-down-mouse-5> <double-mouse-5> u 
<tab> <return> <down-mouse-5> <mouse-5> <double-down-mouse-5> 
<double-mouse-5> <triple-down-mouse-5> <triple-mouse-5> 
<down-mouse-4> <mouse-4> <double-down-mouse-4> <double-mouse-4> 
<down-mouse-4> <mouse-4> <down-mouse-1> <mouse-1> <down-mouse-5> 
<mouse-5> <down-mouse-5> <mouse-5> <double-down-mouse-5> 
<double-mouse-5> <down-mouse-4> <mouse-4> <double-down-mouse-4> 
<double-mouse-4> <triple-down-mouse-4> <triple-mouse-4> 
<triple-down-mouse-4> <triple-mouse-4> <triple-down-mouse-4> 
<triple-mouse-4> <triple-down-mouse-4> <triple-mouse-4> 
<triple-down-mouse-4> <triple-mouse-4> <triple-down-mouse-4> 
<triple-mouse-4> <triple-down-mouse-4> <triple-mouse-4> 
u <tab> <return> <help-echo> <down-mouse-5> <mouse-5> 
<down-mouse-5> <mouse-5> <down-mouse-5> <mouse-5> M-x 
m <backspace> e m a c s - v e r s i o n <return> <down-mouse-5> 
<mouse-5> <down-mouse-5> <mouse-5> <down-mouse-5> <mouse-5> 
<down-mouse-5> <mouse-5> <down-mouse-5> <mouse-5> <down-mouse-5> 
<mouse-5> <down-mouse-5> <mouse-5> <double-down-mouse-5> 
<double-mouse-5> <triple-down-mouse-5> <triple-mouse-5> 
<down-mouse-5> <mouse-5> <down-mouse-4> <mouse-4> <double-down-mouse-4> 
<double-mouse-4> <triple-down-mouse-4> <triple-mouse-4> 
M-x C-g C-x 5 2 <switch-frame> M-x r e p o r t - b 
<tab> u <tab> <tab> <tab> <tab> <switch-frame> <switch-frame> 
<switch-frame> <switch-frame> <switch-frame> <down-mouse-4> 
<mouse-4> <down-mouse-5> <mouse-5> <down-mouse-4> <mouse-4> 
<double-down-mouse-4> <double-mouse-4> <triple-down-mouse-4> 
<triple-mouse-4> <triple-down-mouse-4> <triple-mouse-4> 
<switch-frame> <down-mouse-1> <mouse-movement> <mouse-1> 
<help-echo> <down-mouse-1> <mouse-1> <M-backspace> 
e m a <tab> <return>

Recent messages:
Loading info...done
Loading jka-compr...done
uncompressing emacs.gz...done
uncompressing emacs-1.gz...done
Mark saved where search started
uncompressing emacs-5.gz...done
byte-code: Beginning of buffer [6 times]
GNU Emacs 22.2.1 (i486-pc-linux-gnu, GTK+ Version 2.12.11) of 2008-10-17 on raven, modified by Debian
Quit
Loading emacsbug...done