Re: Segfault in vertical-motion

[Eli Zaretskii <eliz@gnu.org>]

> Date: Tue, 06 Sep 2011 20:47:02 +0200
> From: martin rudalics <rudalics@gmx.at>
> CC: emacs-devel@gnu.org
> 
>  > What is it->method at this point?  It should be between 0 and 5 (see
>  > enum it_method on dispextern.h).
> 
> (gdb) p it->method
> $1 = 50116946

Garbage (I think this is Qnil, btw, but it->method cannot be a Lisp
object).  And I see that this garbage goes all the way from
Fvertical_motion, as your original backtrace shows:

 #4  0x010c2108 in Fvertical_motion (lines=4, window=56154629) at indent.c:2099
	 it_start = 81
	 first_x = 0
	 it_overshoot_expected = 0
	 it = {
    window = 0,
    w = 0x2c,
    f = 0x35a0000,
    method = 50116946,  <<<<<<<<<<<<<<<<<<<<<<<<<<<<

So I think it would be good if you step through Fvertical_motion
(without stepping into the function it calls) after setting a
watchpoint on it.method, and see which call(s) change it.  We can then
take it from there.

>  > Also, what is it->current?
> 
> (gdb) p it->current
> $2 = {
>    pos = {
>      charpos = 10,
>      bytepos = 0
>    },

Also garbage (bytepos cannot be zero, its minimum value is 1, and it
certainly cannot be smaller than charpos).

> I have to bisect my customizations first to know what's really
> causing it.  This will take some time :-(

It may be a better idea to step through Fvertical_motion and see who
garbles the iterator object.  It could lead us to solution faster and
more reliably, since you say the crash is 100% reproducible with your
~/.emacs.