bug#580: 23.0.60; OSX: Crash in show-paren-mode

[Markus Triska <markus.triska@gmx.at>]

Let c6.el consist of the following form:

   (while t
     (insert "(when t (if t t 'hi))\n"))

There must not be any blank lines at the start of the file; the file
is also available from: http://www.logic.at/prolog/c6.el .

When I do:

   $ emacs -Q c6.el -f show-paren-mode

and then repeatedly:

   C-M-x C-g C-_

Emacs crashes within a few iterations with the following backtrace:

GNU gdb 6.3.50-20050815 (Apple version gdb-573) (Fri Oct 20 15:50:43 GMT 2006)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-apple-darwin"...Reading symbols for shared libraries .................................... done

DISPLAY = :0.0
TERM = xterm-color
Breakpoint 1 at 0x9010d3db
Breakpoint 2 at 0xeeff5: file sysdep.c, line 1248.
(gdb) r -Q ~/c6.el -f show-paren-mode
Starting program: /Users/mt/emacs/src/emacs -Q ~/c6.el -f show-paren-mode
Reading symbols for shared libraries ....................................................................+++..+.++.+..++.+.++.++++++++++.++++.....+++ done

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x02dc6fff
0x0016b0f5 in char_quoted (charpos=1, bytepos=48001023) at syntax.c:312
312       DEC_BOTH (charpos, bytepos);
(gdb) bt
#0  0x0016b0f5 in char_quoted (charpos=1, bytepos=48001023) at syntax.c:312
#1  0x0017391d in back_comment (from=9, from_byte=9, stop=1, comnested=0, comstyle=0, charpos_ptr=0xbfffe468, bytepos_ptr=0xbfffe46c) at syntax.c:597
#2  0x001767f4 in scan_lists (from=10, count=-1, depth=1, sexpflag=1) at syntax.c:2754
#3  0x00145450 in Ffuncall (nargs=3, args=0xbfffe514) at eval.c:3052
#4  0x0017e99f in Fbyte_code (bytestr=67094347, vector=34919012, maxdepth=4) at bytecode.c:678
#5  0x001448fe in Feval (form=40297877) at eval.c:2383
#6  0x00146ee7 in internal_lisp_condition_case (var=58721289, bodyform=40297877, handlers=40297781) at eval.c:1456
#7  0x0017d8d5 in Fbyte_code (bytestr=67093035, vector=35118900, maxdepth=5) at bytecode.c:868
#8  0x00144d33 in funcall_lambda (fun=34935236, nargs=0, arg_vector=0xbfffe998) at eval.c:3229
#9  0x00145216 in Ffuncall (nargs=1, args=0xbfffe994) at eval.c:3099
#10 0x00146a53 in Fapply (nargs=2, args=0xbfffe994) at eval.c:2471
#11 0x001453bb in Ffuncall (nargs=3, args=0xbfffe990) at eval.c:3023
#12 0x0017e99f in Fbyte_code (bytestr=2402283, vector=2402308, maxdepth=4) at bytecode.c:678
#13 0x001448fe in Feval (form=2402269) at eval.c:2383
#14 0x00146ee7 in internal_lisp_condition_case (var=58721289, bodyform=2402269, handlers=2402341) at eval.c:1456
#15 0x0017d8d5 in Fbyte_code (bytestr=2402139, vector=2402156, maxdepth=5) at bytecode.c:868
#16 0x00144d33 in funcall_lambda (fun=2402100, nargs=1, arg_vector=0xbfffed54) at eval.c:3229
#17 0x00145216 in Ffuncall (nargs=2, args=0xbfffed50) at eval.c:3099
#18 0x0014662b in call1 (fn=58751321, arg1=34898660) at eval.c:2827
#19 0x000d7818 in timer_check (do_it_now=1) at keyboard.c:4660
#20 0x000d79c7 in readable_events (flags=1) at keyboard.c:3648
#21 0x000de46b in get_input_pending (addr=0x325800, flags=1) at keyboard.c:6953
#22 0x000de58b in detect_input_pending_run_timers (do_display=1) at keyboard.c:10622
#23 0x001880be in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=58721289, wait_proc=0x0, just_wait_proc=0) at process.c:4954
#24 0x0000c32a in sit_for (timeout=240, reading=1, do_display=1) at dispnew.c:6623
#25 0x000e0363 in read_char (commandflag=1, nmaps=2, maps=0xbffff3d0, prev_event=58721289, used_mouse_menu=0xbffff4c8, end_time=0x0) at keyboard.c:2932
#26 0x000e1e66 in read_key_sequence (keybuf=0xbffff588, bufsize=30, prompt=58721289, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9431
#27 0x000e4230 in command_loop_1 () at keyboard.c:1653
#28 0x001435a8 in internal_condition_case (bfun=0xe4012 <command_loop_1>, handlers=58760953, hfun=0xdce6d <cmd_error>) at eval.c:1511
#29 0x000d6054 in command_loop_2 () at keyboard.c:1369
#30 0x001431fa in internal_catch (tag=58757025, func=0xd6010 <command_loop_2>, arg=58721289) at eval.c:1247
#31 0x000d5df6 in command_loop () at keyboard.c:1348
#32 0x000d5eaf in recursive_edit_1 () at keyboard.c:957
#33 0x000d5ff7 in Frecursive_edit () at keyboard.c:1019
#34 0x000d5035 in main (argc=5, argv=0xbffff9c0) at emacs.c:1796

Lisp Backtrace:
"scan-sexps" (0xbfffe518)
"byte-code" (0xbfffe604)
"show-paren-function" (0xbfffe998)
"apply" (0xbfffe994)
"byte-code" (0xbfffea84)
"timer-event-handler" (0xbfffed54)
(gdb) bt full
#0  0x0016b0f5 in char_quoted (charpos=1, bytepos=48001023) at syntax.c:312
        p = (unsigned char *) 0x2dc6fff <Address 0x2dc6fff out of bounds>
        beg = 1
        quoted = 0
#1  0x0017391d in back_comment (from=9, from_byte=9, stop=1, comnested=0, comstyle=0, charpos_ptr=0xbfffe468, bytepos_ptr=0xbfffe46c) at syntax.c:597
        temp_byte = 0
        com2start = 0
        com2end = 0
        string_style = -1
        string_lossage = 0
        comment_lossage = 0
        comstart_pos = 0
        comstart_byte = 112
        defun_start = 0
        defun_start_byte = 35186192
        code = Sopen
        nesting = 1
        c = 40
        syntax = 2
        charpos_ptr = (int *) 0x2dc7000
        bytepos_ptr = (int *) 0x2dc7000
#2  0x001767f4 in scan_lists (from=10, count=-1, depth=1, sexpflag=1) at syntax.c:2754
        val = 48001024
        stop = 1
        c = 10
        c1 = 3321936
        stringterm = 34
        quoted = -1073748824
        mathexit = 0
        code = Sclose
        temp_code = 48001024
        min_depth = 0
        comstyle = 0
        comnested = 0
        temp_pos = 10
        last_good = 46
        found = 48001024
        from_byte = 9
        out_bytepos = 1539914
        out_charpos = 65505
        dummy = -1073748824
        multibyte_symbol_p = 1
#3  0x00145450 in Ffuncall (nargs=3, args=0xbfffe514) at eval.c:3052
        fun = -1073748712
        original_fun = 3082896
        funcar = 48001023
        numargs = 2
        val = 35186192
        backtrace = {
  next = 0xbfffe624, 
  function = 0xbfffe514, 
  args = 0xbfffe518, 
  nargs = 2, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0xbfffe518
        i = 48001023
        args = (Lisp_Object *) 0x2f0a90
#4  0x0017e99f in Fbyte_code (bytestr=67094347, vector=34919012, maxdepth=4) at bytecode.c:678
        op = 48001024
        vectorp = (Lisp_Object *) 0x214d268
        stack = {
  pc = 0x597d06e "=\207", 
  top = 0xbfffe51c, 
  bottom = 0xbfffe510, 
  byte_string = 67094347, 
  byte_string_start = 0x597d068 "`\302\b\t[\"=\207", 
  constants = 34919012, 
  next = 0xbfffe7b4
}
        result = 35186192
        bytestr = 48001023
#5  0x001448fe in Feval (form=40297877) at eval.c:2383
        numargs = 48001023
        argvals = {67094347, 34919012, 32, 2397955, 37, 58721289, 1325787, 34757776}
        args_left = 58721289
        i = 3
        fun = 35186192
        val = 35186192
        original_fun = 58832209
        original_args = 40297861
        funcar = 48001023
        backtrace = {
  next = 0xbfffe87c, 
  function = 0xbfffe63c, 
  args = 0xbfffe604, 
  nargs = 3, 
  evalargs = 1 '\001', 
  debug_on_exit = 0 '\0'
}
        form = 58721289
#6  0x00146ee7 in internal_lisp_condition_case (var=58721289, bodyform=40297877, handlers=40297781) at eval.c:1456
        val = 48001023
        c = {
  tag = 58721289, 
  val = 58721289, 
  next = 0xbfffeaf8, 
  gcpro = 0x0, 
  jmp = {895, 35186192, 8096, 1338696, -1073748312, 1276397, 93834942, 58721289, -1073748200, -1073748384, 31, 662, 1338862, 1245207, 31, 31, 3014656, 1245239}, 
  backlist = 0xbfffe87c, 
  handlerlist = 0xbfffeb6c, 
  lisp_eval_depth = 4, 
  pdlcount = 15, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0xbfffe7b4
}
        h = {
  handler = 40297781, 
  var = 58721289, 
  chosen_clause = 93834926, 
  tag = 0xbfffe678, 
  next = 0xbfffeb6c
}
#7  0x0017d8d5 in Fbyte_code (bytestr=67093035, vector=35118900, maxdepth=5) at bytecode.c:868
        handlers = 48001024
        body = 48001023
        op = 48001024
        vectorp = (Lisp_Object *) 0x217df38
        stack = {
  pc = 0x597cebe "\204S", 
  top = 0xbfffe730, 
  bottom = 0xbfffe730, 
  byte_string = 67093035, 
  byte_string_start = 0x597ce70 "\b\203\265\001`\306\307`S!!\310=\203\024", 
  constants = 35118900, 
  next = 0xbfffea04
}
        result = 35186192
        bytestr = 48001023
#8  0x00144d33 in funcall_lambda (fun=34935236, nargs=0, arg_vector=0xbfffe998) at eval.c:3229
        val = 48001024
        syms_left = 34935232
        next = 34935232
        i = 0
        optional = -1073747832
        rest = 1257313
#9  0x00145216 in Ffuncall (nargs=1, args=0xbfffe994) at eval.c:3099
        fun = 34935236
        original_fun = 93332345
        funcar = 48001023
        numargs = 0
        val = 35186192
        backtrace = {
  next = 0xbfffe94c, 
  function = 0xbfffe994, 
  args = 0xbfffe998, 
  nargs = 0, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x21511c4
        i = 48001023
        args = (Lisp_Object *) 0x5902379
#10 0x00146a53 in Fapply (nargs=2, args=0xbfffe994) at eval.c:2471
        i = 2694345
        numargs = 48001024
        spread_arg = 58721289
        funcall_args = (Lisp_Object *) 0x0
        fun = 93332345
#11 0x001453bb in Ffuncall (nargs=3, args=0xbfffe990) at eval.c:3023
        fun = 3077284
        original_fun = -1073747564
        funcar = 48001023
        numargs = 2
        val = 35186192
        backtrace = {
  next = 0xbfffeaa4, 
  function = 0xbfffe990, 
  args = 0xbfffe994, 
  nargs = 2, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x2ef4a4
        i = 48001023
        args = (Lisp_Object *) 0xbfffe994
#12 0x0017e99f in Fbyte_code (bytestr=2402283, vector=2402308, maxdepth=4) at bytecode.c:678
        op = 48001024
        vectorp = (Lisp_Object *) 0x24a808
        stack = {
  pc = 0x291a2c "\207", 
  top = 0xbfffe998, 
  bottom = 0xbfffe990, 
  byte_string = 2402283, 
  byte_string_start = 0x291a24 "\301\b\302H\b\303H\"\207", 
  constants = 2402308, 
  next = 0xbfffec34
}
        result = 35186192
        bytestr = 48001023
#13 0x001448fe in Feval (form=2402269) at eval.c:2383
        numargs = 48001023
        argvals = {2402283, 2402308, 32, 1, 31, 0, 1325787, 0}
        args_left = 58721289
        i = 3
        fun = 35186192
        val = 35186192
        original_fun = 58832209
        original_args = 2402277
        funcar = 48001023
        backtrace = {
  next = 0xbfffecfc, 
  function = 0xbfffeabc, 
  args = 0xbfffea84, 
  nargs = 3, 
  evalargs = 1 '\001', 
  debug_on_exit = 0 '\0'
}
        form = 58721289
#14 0x00146ee7 in internal_lisp_condition_case (var=58721289, bodyform=2402269, handlers=2402341) at eval.c:1456
        val = 48001023
        c = {
  tag = 58721289, 
  val = 58721289, 
  next = 0xbffff638, 
  gcpro = 0x0, 
  jmp = {895, 0, 8096, 1338696, -1073747112, 1331296, 2693788, 58721289, -1073747048, -1073747232, 31, 658, 1338862, 1245207, 31, 31, 0, 1310775}, 
  backlist = 0xbfffecfc, 
  handlerlist = 0xbffff6ac, 
  lisp_eval_depth = 1, 
  pdlcount = 8, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0xbfffec34
}
        h = {
  handler = 2402341, 
  var = 58721289, 
  chosen_clause = -1073747020, 
  tag = 0xbfffeaf8, 
  next = 0xbffff6ac
}
#15 0x0017d8d5 in Fbyte_code (bytestr=2402139, vector=2402156, maxdepth=5) at bytecode.c:868
        handlers = 48001024
        body = 48001023
        op = 48001024
        vectorp = (Lisp_Object *) 0x24a770
        stack = {
  pc = 0x291a9c "\210\016\026\205x", 
  top = 0xbfffebb0, 
  bottom = 0xbfffebb0, 
  byte_string = 2402139, 
  byte_string_start = 0x291a2e "\b\021\n\020\v\022\306\034\307\v!\203|", 
  constants = 2402156, 
  next = 0x0
}
        result = 35186192
        bytestr = 48001023
#16 0x00144d33 in funcall_lambda (fun=2402100, nargs=1, arg_vector=0xbfffed54) at eval.c:3229
        val = 48001024
        syms_left = 2402096
        next = 2402096
        i = 1
        optional = 0
        rest = 0
#17 0x00145216 in Ffuncall (nargs=2, args=0xbfffed50) at eval.c:3099
        fun = 2402100
        original_fun = 58751321
        funcar = 48001023
        numargs = 1
        val = 35186192
        backtrace = {
  next = 0x0, 
  function = 0xbfffed50, 
  args = 0xbfffed54, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x24a734
        i = 48001023
        args = (Lisp_Object *) 0x3807959
#18 0x0014662b in call1 (fn=58751321, arg1=34898660) at eval.c:2827
        ret_ungc_val = 48001024
#19 0x000d7818 in timer_check (do_it_now=1) at keyboard.c:4660
        old_deactivate_mark = 58721289
        vector = (Lisp_Object *) 0x21482e8
        timer = 35186192
        idle_timer = 3
        now = {
  tv_sec = 1216572694, 
  tv_usec = 525719
}
        timers = 58721289
        idle_timers = 40289645
        chosen_timer = 34898660
#20 0x000d79c7 in readable_events (flags=1) at keyboard.c:3648
        event = (struct input_event *) 0x2dc6fff
#21 0x000de46b in get_input_pending (addr=0x325800, flags=1) at keyboard.c:6953
No locals.
#22 0x000de58b in detect_input_pending_run_timers (do_display=1) at keyboard.c:10622
        old_timers_run = 16
#23 0x001880be in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=58721289, wait_proc=0x0, just_wait_proc=0) at process.c:4954
        old_timers_run = 16
        old_buffer = (struct buffer *) 0x218e610
        old_window = 34927684
        leave = 1
        timeout_reduced_for_timers = 1
        channel = -1073746808
        nfds = 0
        Available = {
  fds_bits = {0 <repeats 32 times>}
}
        Connecting = {
  fds_bits = {0 <repeats 32 times>}
}
        check_connect = 0
        check_delay = 0
        no_avail = 0
        xerrno = 0
        proc = 1
        timeout = {
  tv_sec = 0, 
  tv_usec = 85305
}
        end_time = {
  tv_sec = 1216572724, 
  tv_usec = 403129
}
        wait_channel = -1
        got_some_input = 0
#24 0x0000c32a in sit_for (timeout=240, reading=1, do_display=1) at dispnew.c:6623
        sec = 30
        usec = 0
        do_display = 1
#25 0x000e0363 in read_char (commandflag=1, nmaps=2, maps=0xbffff3d0, prev_event=58721289, used_mouse_menu=0xbffff4c8, end_time=0x0) at keyboard.c:2932
        tem0 = 30
        delay_level = 4
        buffer_size = 48001023
        c = 58721289
        count = 58824873
        jmpcount = 2
        local_getcjmp = {895, 0, 8096, 914157, 0, 1251674, 3304112, 3298672, -1073745016, -1073745488, 35127327, 658, 916096, 66977815, 31, 31, 0, 1245239}
        save_jump = {0 <repeats 18 times>}
        key_already_recorded = 0
        tem = 48001024
        save = -1073745280
        previous_echo_area_message = 58721289
        also_record = 58721289
        reread = 0
        polling_stopped_here = 30
        orig_kboard = (struct kboard *) 0x2134e30
#26 0x000e1e66 in read_key_sequence (keybuf=0xbffff588, bufsize=30, prompt=58721289, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9431
        interrupted_kboard = (KBOARD *) 0x2134e30
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 58721289
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 2
        nmaps_allocated = 2
        defs = (Lisp_Object * volatile) 0xbffff3b0
        submaps = (Lisp_Object * volatile) 0xbffff3d0
        orig_local_map = 39979517
        orig_keymap = 58721289
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 40032861, 
  map = 40032861, 
  start = 0, 
  end = 0
}
        keytran = {
  parent = 34140029, 
  map = 34140029, 
  start = 0, 
  end = 0
}
        indec = {
  parent = 40032869, 
  map = 40032869, 
  start = 0, 
  end = 0
}
        shift_translated = 0
        delayed_switch_frame = 58721289
        original_uppercase = 3076992
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x218e610
        fake_prefixed_keys = 58721289
#27 0x000e4230 in command_loop_1 () at keyboard.c:1653
        cmd = 3298672
        lose = 3298672
        nonundocount = 0
        keybuf = {248, 904827, 3321440, 58721289, -1073744360, 905036, 40287917, -1073744434, -1073744392, -1879037169, 92274892, 152, -1073744434, 58721289, 100663439, 1, 43, -1879036413, 51396120, 58721337, 51385976, -1881082098, 5651960, 0, -1073744388, -1073744576, 0, 3342336, 58721289, 67054001}
        i = 1
        prev_modiff = 385161
        prev_buffer = (struct buffer *) 0x218e610
        already_adjusted = 0
#28 0x001435a8 in internal_condition_case (bfun=0xe4012 <command_loop_1>, handlers=58760953, hfun=0xdce6d <cmd_error>) at eval.c:1511
        val = 48001023
        c = {
  tag = 58721289, 
  val = 58721289, 
  next = 0xbffff73c, 
  gcpro = 0x0, 
  jmp = {895, 17831856, 8096, 1324215, 58721289, 58721289, 3311984, 3298672, -1073744168, -1073744352, 31, 658, 1324364, 1507351, 3276831, 3276831, -1073807360, -1073807305}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 58760953, 
  var = 58721289, 
  chosen_clause = 58721337, 
  tag = 0xbffff638, 
  next = 0x0
}
#29 0x000d6054 in command_loop_2 () at keyboard.c:1369
        val = 48001024
#30 0x001431fa in internal_catch (tag=58757025, func=0xd6010 <command_loop_2>, arg=58721289) at eval.c:1247
        c = {
  tag = 58757025, 
  val = 58721289, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {895, 18, 8096, 1323358, 4, 20287, 3320944, 3298672, -1073743944, -1073744096, 58851359, 658, 1323501, 58851351, 58851359, 58720287, 51380224, 55}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        tag = 48001024
#31 0x000d5df6 in command_loop () at keyboard.c:1348
        val = 48001024
#32 0x000d5eaf in recursive_edit_1 () at keyboard.c:957
        val = 0
#33 0x000d5ff7 in Frecursive_edit () at keyboard.c:1019
        buffer = 58721289
#34 0x000d5035 in main (argc=5, argv=0xbffff9c0) at emacs.c:1796
        dummy = -1881117246
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {
  rlim_cur = 8388608, 
  rlim_max = 67108864
}
        no_loadup = 0
        junk = 0x0

Lisp Backtrace:
"scan-sexps" (0xbfffe518)
"byte-code" (0xbfffe604)
"show-paren-function" (0xbfffe998)
"apply" (0xbfffe994)
"byte-code" (0xbfffea84)
"timer-event-handler" (0xbfffed54)



In GNU Emacs 23.0.60.10 (i386-apple-darwin8.11.1, GTK+ Version 2.12.9)
 of 2008-07-18 on pnsgw3-client030.demo.tuwien.ac.at
Windowing system distributor `The XFree86 Project, Inc', version 11.0.40400000
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  value of $XMODIFIERS: nil
  locale-coding-system: nil
  default-enable-multibyte-characters: t