latest-from-bzr segfaults easily

[Jim Meyering <jim@meyering.net>]

The latest is not usable for me on Fedora 15, x86_64.

How to reproduce using emacs built from the latest bzr
sources of about 5 hours ago:

First, get a cloned copy of the dash sources:
(you can probably use C source file, but this is particularly reliable)

   git clone git://git.kernel.org/pub/scm/utils/dash/dash.git && cd dash

Then, run this and type `C-s sh_':

  $ /p/p/emacs-2011-05-25.08h03/bin/emacs -q src/error.c
  Fatal error (11)zsh: abort (core dumped)


Here's a partial stack trace:

#0  0x00000000005591b6 in mark_object (arg=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/alloc.c:5344
#1  0x000000000055b6c1 in mark_maybe_pointer (p=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/alloc.c:4097
#2  mark_memory (offset=0, end=0x7fffffff1d10, start=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/alloc.c:4147
#3  mark_stack () at /h/j/w/co/emacs/trunk/src/alloc.c:4395
#4  Fgarbage_collect () at /h/j/w/co/emacs/trunk/src/alloc.c:4982
#5  0x0000000000570f85 in Ffuncall (nargs=4, args=0x7fffffff1de0)
    at /h/j/w/co/emacs/trunk/src/eval.c:2975
#6  0x00000000005a947e in exec_byte_code (bytestr=<optimized out>,
    vector=<optimized out>, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/bytecode.c:783
#7  0x0000000000570b99 in funcall_lambda (fun=16680341, nargs=0, arg_vector=
    0x7fffffff1fa8) at /h/j/w/co/emacs/trunk/src/eval.c:3272
#8  0x0000000000570f2b in Ffuncall (nargs=1, args=0x7fffffff1fa0)
    at /h/j/w/co/emacs/trunk/src/eval.c:3100
#9  0x00000000005a947e in exec_byte_code (bytestr=<optimized out>,
    vector=<optimized out>, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/bytecode.c:783
#10 0x0000000000570b99 in funcall_lambda (fun=23897685, nargs=2, arg_vector=
    0x7fffffff2168) at /h/j/w/co/emacs/trunk/src/eval.c:3272
#11 0x0000000000570f2b in Ffuncall (nargs=3, args=0x7fffffff2160)
    at /h/j/w/co/emacs/trunk/src/eval.c:3100
#12 0x00000000005a947e in exec_byte_code (bytestr=<optimized out>,

in src/alloc.c,

   │5336      switch (SWITCH_ENUM_CAST (XTYPE (obj)))                           │
   │5337        {                                                               │
   │5338        case Lisp_String:                                               │
   │5339          {                                                             │
   │5340            register struct Lisp_String *ptr = XSTRING (obj);           │
   │5341            if (STRING_MARKED_P (ptr))                                  │
   │5342              break;                                                    │
   │5343            CHECK_ALLOCATED_AND_LIVE (live_string_p);                   │
  >│5344            MARK_INTERVAL_TREE (ptr->intervals);                        │
   │5345            MARK_STRING (ptr);                                          │

(gdb) p *ptr
$2 = {
  size = 6221254864074593878,
  size_byte = 6221254864074593878,
  intervals = 0x5656565656565656,
  data = 0x5656565656565656 <Address 0x5656565656565656 out of bounds>
}