Emacs 21.1.1 segmentation fault (!)

[Bob Halley]

For the first time in my living memory, Emacs has crashed on me!  I
was running zenirc inside of Emacs 21.1.1, was doing something else in
another (non-emacs) window, clicked back onto the emacs window, and
started typing.  Emacs crashed.  I do not know how to reproduce the
bug.

Before I get into the gory details, I'd just like to say thanks for
Emacs! :)

I'm running Red Hat GNU/Linux 7.2, and built the Emacs executable
myself.  My kernel is 2.4.16.  RH gcc-2.96-98, RH glibc-2.2.4-19.3.  I
built with ./configure; make; make install.  Nothing special :).

In GNU Emacs 21.1.1 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2001-11-12 on localhost.localdomain
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US
  locale-coding-system: iso-latin-1
  default-enable-multibyte-characters: t

Here's the backtrace from the core, plus various possibly interesting
values.  I'd prefer not to send the core, but I will preserve it in
case you need anything else from it.

>gdb emacs core
GNU gdb Red Hat Linux (5.1-1)
Copyright 2001 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
Core was generated by `emacs -f zenirc'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/X11R6/lib/libXaw3d.so.7...done.
Loaded symbols for /usr/X11R6/lib/libXaw3d.so.7
Reading symbols from /usr/X11R6/lib/libXmu.so.6...done.
Loaded symbols for /usr/X11R6/lib/libXmu.so.6
Reading symbols from /usr/X11R6/lib/libXt.so.6...done.
Loaded symbols for /usr/X11R6/lib/libXt.so.6
Reading symbols from /usr/X11R6/lib/libSM.so.6...done.
Loaded symbols for /usr/X11R6/lib/libSM.so.6
Reading symbols from /usr/X11R6/lib/libICE.so.6...done.
Loaded symbols for /usr/X11R6/lib/libICE.so.6
Reading symbols from /usr/X11R6/lib/libXext.so.6...done.
Loaded symbols for /usr/X11R6/lib/libXext.so.6
Reading symbols from /usr/lib/libtiff.so.3...done.
Loaded symbols for /usr/lib/libtiff.so.3
Reading symbols from /usr/lib/libjpeg.so.62...done.
Loaded symbols for /usr/lib/libjpeg.so.62
Reading symbols from /usr/lib/libpng.so.2...done.
Loaded symbols for /usr/lib/libpng.so.2
Reading symbols from /usr/lib/libz.so.1...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /usr/lib/libungif.so.4...done.
Loaded symbols for /usr/lib/libungif.so.4
Reading symbols from /usr/X11R6/lib/libXpm.so.4...done.
Loaded symbols for /usr/X11R6/lib/libXpm.so.4
Reading symbols from /usr/X11R6/lib/libX11.so.6...done.
Loaded symbols for /usr/X11R6/lib/libX11.so.6
Reading symbols from /usr/lib/libncurses.so.5...done.
Loaded symbols for /usr/lib/libncurses.so.5
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
---Type <return> to continue, or q <return> to quit---
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /usr/lib/gconv/ISO8859-1.so...done.
Loaded symbols for /usr/lib/gconv/ISO8859-1.so
Reading symbols from /lib/libnss_nisplus.so.2...done.
Loaded symbols for /lib/libnss_nisplus.so.2
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /lib/libnss_dns.so.2...done.
Loaded symbols for /lib/libnss_dns.so.2
Reading symbols from /lib/libresolv.so.2...done.
Loaded symbols for /lib/libresolv.so.2
#0  0x403268d1 in __kill () from /lib/libc.so.6
(gdb) where
#0  0x403268d1 in __kill () from /lib/libc.so.6
#1  0x080ce974 in fatal_error_signal (sig=11) at emacs.c:354
#2  <signal handler called>
#3  0x080504f0 in increment_row_positions (row=0x8522044, delta=1, 
delta_bytes=1) at dispnew.c:1188
#4  0x0804fdab in increment_matrix_positions (matrix=0x8593118, start=9, 
end=18, delta=1, delta_bytes=1)
    at dispnew.c:927
#5  0x080663f0 in redisplay_internal (preserve_echo_area=0) at xdisp.c:8650
#6  0x080656a5 in redisplay () at xdisp.c:8231
#7  0x080d2649 in read_char (commandflag=1, nmaps=2, maps=0xbffff2d0, 
prev_event=405173724, 
    used_mouse_menu=0xbffff308) at keyboard.c:2272
#8  0x080d910c in read_key_sequence (keybuf=0xbffff430, bufsize=30, 
prompt=405173724, dont_downcase_last=0, 
    can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:8180
#9  0x080d120f in command_loop_1 () at keyboard.c:1440
#10 0x0812121a in internal_condition_case (bfun=0x80d0f10 <command_loop_1>, 
handlers=405270044, 
    hfun=0x80d0b50 <cmd_error>) at eval.c:1267
#11 0x080d0df2 in command_loop_2 () at keyboard.c:1245
#12 0x08120ddb in internal_catch (tag=405231652, func=0x80d0dd4 
<command_loop_2>, arg=405173724) at eval.c:1030
#13 0x080d0d80 in command_loop () at keyboard.c:1224
#14 0x080d0932 in recursive_edit_1 () at keyboard.c:950
#15 0x080d0a4b in Frecursive_edit () at keyboard.c:1006
#16 0x080cfa53 in main (argc=3, argv=0xbffff9f4, envp=0xbffffa04) at 
emacs.c:1547
#17 0x40314306 in __libc_start_main (main=0x80cee74 <main>, argc=3, 
ubp_av=0xbffff9f4, init=0x804d860 <_init>, 
    fini=0x8162c60 <_fini>, rtld_fini=0x4000d2dc <_dl_fini>, 
stack_end=0xbffff9ec)
    at ../sysdeps/generic/libc-start.c:129
(gdb) f 3
#3  0x080504f0 in increment_row_positions (row=0x8522044, delta=1, 
delta_bytes=1) at dispnew.c:1188
1188          if (BUFFERP (row->glyphs[area][i].object)
(gdb) list
1183      MATRIX_ROW_END_BYTEPOS (row) += delta_bytes;
1184
1185      /* Increment positions in glyphs.  */
1186      for (area = 0; area < LAST_AREA; ++area)
1187        for (i = 0; i < row->used[area]; ++i)
1188          if (BUFFERP (row->glyphs[area][i].object)
1189              && row->glyphs[area][i].charpos > 0)
1190            row->glyphs[area][i].charpos += delta;
1191
1192      /* Capture the case of rows displaying a line end.  */
(gdb) p row
$1 = (struct glyph_row *) 0x8522044
(gdb) p area
$2 = 1
(gdb) p i
$3 = 11
(gdb) p row->glyphs[area][i].object
$4 = 944370460
(gdb) p row->used[area]
$5 = 83
(gdb) 
(gdb) p *row
$6 = {glyphs = {0x854a1f8, 0x854a1f8, 0x854a8c4, 0x854a8c4}, used = {0, 83, 0}, 
x = 0, y = 156, 
  pixel_width = 582, ascent = 10, height = 13, phys_ascent = 9, phys_height = 
12, visible_height = 13, 
  hash = 264857795, start = {pos = {charpos = 963, bytepos = 963}, 
overlay_string_index = 0, string_pos = {
      charpos = 0, bytepos = 0}, dpvec_index = 0}, end = {pos = {charpos = 963, 
bytepos = 963}, 
    overlay_string_index = 0, string_pos = {charpos = 0, bytepos = 0}, 
dpvec_index = 0}, enabled_p = 0, 
  inverse_p = 0, truncated_on_left_p = 0, truncated_on_right_p = 0, 
overlay_arrow_p = 0, continued_p = 0, 
  displays_text_p = 0, ends_at_zv_p = 0, fill_line_p = 0, indicate_empty_line_p 
= 0, 
  contains_overlapping_glyphs_p = 0, full_width_p = 1, mode_line_p = 1, 
overlapped_p = 0, 
  ends_in_middle_of_char_p = 0, starts_in_middle_of_char_p = 0, overlapping_p = 
0, mouse_face_p = 0, 
  ends_in_newline_from_string_p = 0, continuation_lines_width = 0}