bug#12310: crash in remember_mouse_glyph

[Werner LEMBERG <wl@gnu.org>]

Just now I've got a crash, but I'm not sure whether it belongs to this
bug report.  Since I'm using Martin's patch, I'm reporting it here.

The crash happened after composing an email with mew, then trying to
send it with C-c C-c.

I still have the process.  Anything else I can investigate?


    Werner


======================================================================


Program received signal SIGSEGV, Segmentation fault.
set_buffer_internal_1 (b=0x846958d) at buffer.c:2154
2154        bset_undo_list (b, BVAR (b->base_buffer, undo_list));

(gdb) p b
$1 = (struct buffer *) 0x846958d

(gdb) p b->base_buffer
$2 = (struct buffer *) 0x98000000

(gdb) p undo_list
No symbol "undo_list" in current context.

(gdb) bt full
#0  set_buffer_internal_1 (b=0x846958d) at buffer.c:2154
        old_buf = 0x8480af8
        tail = <optimized out>
#1  0x08147c06 in command_loop_1 () at keyboard.c:1438
        cmd = <optimized out>
        keybuf = {12, -1073747977, 159382230, 40, -1073746568, 134626714, 141443984, 138843538, 
    -1073747977, -1073747977, 159382230, 40, -1073746568, 135518707, 159382230, 138843562, -1073747977, 
    140927362, -1073747977, 40, 40, 135518989, 159382230, -1073747977, -1073746568, 135978019, 140497734, 
    4625810, -1207960904, 0}
        i = <optimized out>
        prev_modiff = 0
        prev_buffer = 0x0
#2  0x081aa67d in internal_condition_case (bfun=0x8147b30 <command_loop_1>, handlers=138877346, hfun=
    0x813da40 <cmd_error>) at eval.c:1322
        val = <optimized out>
        c = {
          tag = 138843538, 
          val = 138843538, 
          next = 0xbfffe968, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {0, 142791432, 142791448, -1073746568, 1781480335, -1598877472}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {134553001, 0, 0, 0, 0, 0, 0, 0, 0, 0, 3062816632, 3065862960, 0, 0, 0, 0, 
    4294967295, 3221219536, 3221219824, 135609939, 2, 3087003588, 3087005952, 1, 0, 3086922907, 3087006392, 
    3058843712, 1, 1, 0, 1}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
        h = {
          handler = 138877346, 
          var = 138843538, 
          chosen_clause = 138843562, 
          tag = 0xbfffe844, 
          next = 0x0
        }
#3  0x0813c375 in command_loop_2 (ignore=138843538) at keyboard.c:1204
        val = 138843538
#4  0x081aa599 in internal_catch (tag=138875290, func=0x813c350 <command_loop_2>, arg=138843538)
    at eval.c:1079
        c = {
          tag = 138875290, 
          val = 138843538, 
          next = 0x0, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {0, 142791432, 142791448, -1073746568, 1781398415, -1598716192}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {0, 177, 23, 3063290583, 140685641, 140685640, 136248496, 142668888, 136562658, 14, 
    58, 142668888, 14, 136562658, 3221219912, 0, 0, 0, 3221219912, 400, 3221221571, 136562658, 138967378, 
    138967376, 138843538, 3221220728, 135976258, 138967378, 138843538, 138843538, 1, 0}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
#5  0x0813d58a in command_loop () at keyboard.c:1183
No locals.
#6  recursive_edit_1 () at keyboard.c:804
        count = 1
        val = 0
#7  0x0813d87f in Frecursive_edit () at keyboard.c:868
        count = <optimized out>
        buffer = 138843538
#8  0x080599d0 in main (argc=2, argv=Cannot access memory at address 0xa0b310e4
) at emacs.c:1654
        dummy = 136470960
        stack_bottom_variable = 8 '\b'
        do_initial_setlocale = <optimized out>
        skip_args = 0
        rlim = {
          rlim_cur = 8388608, 
          rlim_max = 18446744073709551615
        }
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0xb6a873c4 "\300\201\250\266\340\203\250\266\300p\250\266\264p\250\266dp\250\266\003"