bug#1382: segfault when killing unsaved buffer

["Ben Walton (student)" <t-walton@cquest.utoronto.ca>]

This bug report will be sent to the Free Software Foundation,
not to your local site managers!
Please write in English, because the Emacs maintainers do not have
translators to read other languages for them.

Please write in English, because the Emacs maintainers do not have
translators to read other languages for them.

Your bug report will be posted to the bug-gnu-emacs@gnu.org mailing list,
and to the gnu.emacs.bug news group.

In GNU Emacs 21.4.1 (i686-redhat-linux-gnu)
 of 2007-12-10 on hs20-bc2-3.build.redhat.com
configured using `configure  --build=i686-redhat-linux-gnu --host=i686-redhat-linux-gnu --target=i386-redhat-linux-gnu --program-prefix= --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/usr/com --mandir=/usr/share/man --infodir=/usr/share/info --without-x'
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8
  default-enable-multibyte-characters: t

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

1. Open new emacs (-nox) session [tested with -q --no-site-file also]
2. Open buffer for new file (C-x C-f ~/somenewfile.txt RET)
3. Enter some text so buffer is modified/dirty.
4. Kill buffer (C-x k)
5. RET (to confirm killing the buffer)
6. Segfault

The following is a gdb backtrace from the core file:


$ gdb `which emacs-nox` core.21239
GNU gdb Red Hat Linux (6.5-37.el5_2.2rh)
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1".


warning: Can't read pathname for load map: Input/output error.
Reading symbols from /usr/lib/libncurses.so.5...done.
Loaded symbols for /usr/lib/libncurses.so.5
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Core was generated by `emacs-nox'.
Program terminated with signal 11, Segmentation fault.
#0  0x0095a402 in __kernel_vsyscall ()
(gdb) backtrace
#0  0x0095a402 in __kernel_vsyscall ()
#1  0x00690146 in kill () from /lib/libc.so.6
#2  0x0809b3c9 in fatal_error_signal (sig=11) at emacs.c:354
#3  <signal handler called>
#4  0x006d6053 in strlen () from /lib/libc.so.6
#5  0x0812e6f8 in doprnt1 (lispstrings=0,
    buffer=0xbfc6059c "Buffer \n, <gibberish>
    bufsize=<value optimized out>,
    format=0x81407f8 "Buffer %s modified; kill anyway? ",
    format_end=0x8140819 "", nargs=5, args=0xbfc60594) at doprnt.c:249
#6  0x080ec919 in format1 (
    string1=0x81407f8 "Buffer %s modified; kill anyway? ") at editfns.c:3536
#7  0x080b6b58 in Fkill_buffer (buffer=973129580) at buffer.c:1213
#8  0x080f6df4 in Ffuncall (nargs=2, args=0xbfc60720) at eval.c:2659
#9  0x080f45a3 in Fcall_interactively (function=405216116,
    record_flag=405074988, keys=1210440104) at callint.c:797
#10 0x0809dbf7 in Fcommand_execute (cmd=405216116, record_flag=405074988,
    keys=405074988, special=405074988) at keyboard.c:9255
#11 0x080a68b6 in command_loop_1 () at keyboard.c:1661
#12 0x080f56fd in internal_condition_case (bfun=0x80a6540 <command_loop_1>,
    handlers=405172732, hfun=0x80a0740 <cmd_error>) at eval.c:1267
#13 0x080a0333 in command_loop_2 () at keyboard.c:1245
#14 0x080f57b2 in internal_catch (tag=405132772,
    func=0x80a0310 <command_loop_2>, arg=405074988) at eval.c:1030
#15 0x080a0467 in command_loop () at keyboard.c:1224
#16 0x080a0505 in recursive_edit_1 () at keyboard.c:950
#17 0x080a0603 in Frecursive_edit () at keyboard.c:1006
#18 0x0809a7f0 in main (argc=1, argv=0xbfc61044, envp=Cannot access memory at address 0x8
) at emacs.c:1547
#19 0x0067cdec in __libc_start_main () from /lib/libc.so.6
#20 0x0804ac71 in _start ()
(gdb)



Recent input:
ESC x r e p o TAB e DEL r TAB RET

Recent messages:
(emacs-nox -q --no-site-file)
Loading disp-table...done
For information about the GNU Project and its goals, type C-h C-p.
Making completion list...
Loading view...done
Loading emacsbug...done