emacs 21.2 core dump while running GNUs

[Ralf Fassel]

In GNU Emacs 21.2.1 (mips-sgi-irix6.5, X toolkit)
 of 2002-03-21 on jupiter.akutech-local.de
configured using `configure  --prefix=/software/emacs/21.2 
-exec-prefix=/software/emacs/21.2/IRIX-6 --with-pop --with-x-toolkit=athena'
Important settings:
  value of $LC_ALL: C
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  locale-coding-system: nil
  default-enable-multibyte-characters: nil

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

While running GNUs, emacs dumped core and produced the following
backtrace:

#0  kill () at engine.c:1232
#1  0x101619bc in fatal_error_signal (sig=11) at emacs.c:354
#2  <signal handler called>
#3  0x101a7284 in gap_left (charpos=33, bytepos=33, newgap=0) at insdel.c:190
#4  0x101abbb8 in del_range_2 (from=32, from_byte=32, to=33, to_byte=33, 
ret_string=0) at insdel.c:1684
#5  0x101ab52c in del_range_1 (from=32, to=33, prepare=1, ret_string=0) at 
insdel.c:1568
#6  0x101ab3a0 in del_range (from=32, to=33) at insdel.c:1535
#7  0x101cd7d0 in Fdelete_char (n=268435455, killflag=273132548) at cmds.c:219
#8  0x1022f7fc in Ffuncall (nargs=2, args=0x7fff1310) at eval.c:2662
#9  0x1028d60c in Fbyte_code (bytestr=814251172, vector=1082668288, maxdepth=8) 
at bytecode.c:716
#10 0x10230518 in funcall_lambda (fun=1078427104, nargs=2, 
arg_vector=0x7fff1504) at eval.c:2851
#11 0x1022fa20 in Ffuncall (nargs=3, args=0x7fff1500) at eval.c:2707
#12 0x1028d60c in Fbyte_code (bytestr=814200964, vector=1082566144, maxdepth=7) 
at bytecode.c:716
#13 0x10230518 in funcall_lambda (fun=1082641952, nargs=4, 
arg_vector=0x7fff16f4) at eval.c:2851
#14 0x1022fa20 in Ffuncall (nargs=5, args=0x7fff16f0) at eval.c:2707
#15 0x1028d60c in Fbyte_code (bytestr=814030084, vector=1080901696, maxdepth=5) 
at bytecode.c:716
#16 0x10230518 in funcall_lambda (fun=1082372096, nargs=3, 
arg_vector=0x7fff18e4) at eval.c:2851
#17 0x1022fa20 in Ffuncall (nargs=4, args=0x7fff18e0) at eval.c:2707
#18 0x1028d60c in Fbyte_code (bytestr=814635892, vector=1083029888, maxdepth=6) 
at bytecode.c:716
#19 0x10230518 in funcall_lambda (fun=1083032160, nargs=3, 
arg_vector=0x7fff1ad4) at eval.c:2851
#20 0x1022fa20 in Ffuncall (nargs=4, args=0x7fff1ad0) at eval.c:2707
#21 0x1028d60c in Fbyte_code (bytestr=814030084, vector=1080901696, maxdepth=5) 
at bytecode.c:716
#22 0x10230518 in funcall_lambda (fun=1082372096, nargs=3, 
arg_vector=0x7fff1cc4) at eval.c:2851
#23 0x1022fa20 in Ffuncall (nargs=4, args=0x7fff1cc0) at eval.c:2707
#24 0x1028d60c in Fbyte_code (bytestr=814818740, vector=1083244032, maxdepth=6) 
at bytecode.c:716
#25 0x10230518 in funcall_lambda (fun=1083260288, nargs=3, 
arg_vector=0x7fff1eb4) at eval.c:2851
#26 0x1022fa20 in Ffuncall (nargs=4, args=0x7fff1eb0) at eval.c:2707
#27 0x1028d60c in Fbyte_code (bytestr=814785124, vector=1082592768, maxdepth=6) 
at bytecode.c:716
#28 0x10230518 in funcall_lambda (fun=1083228032, nargs=6, 
arg_vector=0x7fff20a4) at eval.c:2851
#29 0x1022fa20 in Ffuncall (nargs=7, args=0x7fff20a0) at eval.c:2707
#30 0x1028d60c in Fbyte_code (bytestr=814785092, vector=1083066496, maxdepth=8) 
at bytecode.c:716
#31 0x10230518 in funcall_lambda (fun=1083224064, nargs=7, 
arg_vector=0x7fff2294) at eval.c:2851
#32 0x1022fa20 in Ffuncall (nargs=8, args=0x7fff2290) at eval.c:2707
#33 0x1028d60c in Fbyte_code (bytestr=814537924, vector=1082825344, maxdepth=8) 
at bytecode.c:716
#34 0x10230518 in funcall_lambda (fun=1082982144, nargs=3, 
arg_vector=0x7fff2484) at eval.c:2851
#35 0x1022fa20 in Ffuncall (nargs=4, args=0x7fff2480) at eval.c:2707
#36 0x1028d60c in Fbyte_code (bytestr=814724116, vector=1083323200, maxdepth=4) 
at bytecode.c:716
#37 0x10230518 in funcall_lambda (fun=1083406752, nargs=1, 
arg_vector=0x7fff2694) at eval.c:2851
#38 0x1022fa20 in Ffuncall (nargs=2, args=0x7fff2690) at eval.c:2707
#39 0x10227bd8 in Fcall_interactively (function=278090284, 
record_flag=273132548, keys=1078517760)
    at callint.c:797
#40 0x1017d918 in Fcommand_execute (cmd=278090284, record_flag=273132548, 
keys=273132548, special=273132548)
    at keyboard.c:9221
#41 0x1016893c in command_loop_1 () at keyboard.c:1644
#42 0x1022b548 in internal_condition_case (bfun=0x10166e38 <command_loop_1>, 
handlers=273254596, 
    hfun=0x10166540 <cmd_error>) at eval.c:1267
#43 0x10166ad8 in command_loop_2 () at keyboard.c:1245
#44 0x1022ad40 in internal_catch (tag=273206948, func=0x10166a98 
<command_loop_2>, arg=273132548)
    at eval.c:1030
#45 0x10166a40 in command_loop () at keyboard.c:1224
#46 0x10165f8c in recursive_edit_1 () at keyboard.c:950
#47 0x1016621c in Frecursive_edit () at keyboard.c:1006
#48 0x10163a1c in main (argc=7, argv=0x7fff2e54, envp=0x7fff2e74) at 
emacs.c:1547

emacs-21.2/src/insdel.c:190

   {
          new_s1 -= i;
          while (--i >= 0)
=>         *--to = *--from;
        }
    }

(gdb) p i
$1 = 5675
(gdb) p to
$2 = (unsigned char *) 0x406732f <Address 0x406732f out of bounds>

The contents of the `from' pointer indicate that this happens while
reading the Group Info:

(gdb) p (char*) from-100
$12 = 0x405d5ff "> <7bmj9uov3r3hpn9a3mia9bd5ujrg483730@4ax.com>\t1015\t7\tXref: 
uni-berlin.de de.rec.motorrad:490164\r\n.\r\n"

Happens non-reproducable, but rather often, though I haven't checked
yet whether it is the same place that triggers the core.  But it
always seems to happen whenever I re-enter a Group in GNUs.

I saved the core file, so I can check further if required.

R'