bug#7952: 24.0.50; crash in find_interval

[Romain Francoise]

Still crashes as of revision 103683, but now it hits the abort at
marker.c:130 rather than the one at intervals.c:635. I tried
bisecting it, without success so far.

Program terminated with signal 6, Aborted.
#0  0x00007f5b748c0447 in kill () at ../sysdeps/unix/syscall-template.S:82
82      ../sysdeps/unix/syscall-template.S: No such file or directory.
        in ../sysdeps/unix/syscall-template.S
(gdb) bt
#0  0x00007f5b748c0447 in kill () at ../sysdeps/unix/syscall-template.S:82
#1  0x0000000000558617 in fatal_error_signal (sig=6) at emacs.c:342
#2  <signal handler called>
#3  0x00007f5b748c0447 in kill () at ../sysdeps/unix/syscall-template.S:82
#4  0x0000000000558636 in abort () at emacs.c:371
#5  0x00000000005956cd in buf_charpos_to_bytepos (b=0x11511c0, charpos=1332719)
    at marker.c:130
#6  0x00000000005b7a51 in fast_looking_at (regexp=13575105, pos=1331082,
    pos_byte=1331194, limit=1332719, limit_byte=-1, string=12593666)
    at search.c:566
#7  0x000000000066fc57 in autocmp_chars (rule=16637925, charpos=1331082,
    bytepos=1331194, limit=1332719, win=0x117e910, face=0x114e3d0,
    string=12593666) at composite.c:916
#8  0x0000000000671e46 in composition_reseat_it (cmp_it=0x7fff61245610,
    charpos=1331082, bytepos=1331194, endpos=1332719, w=0x117e910,
    face=0x114e3d0, string=12593666) at composite.c:1266
#9  0x000000000044114e in next_element_from_buffer (it=0x7fff61244de0)
    at xdisp.c:6693
#10 0x0000000000440f5e in next_element_from_buffer (it=0x7fff61244de0)
    at xdisp.c:6660
#11 0x000000000043dd2c in get_next_display_element (it=0x7fff61244de0)
    at xdisp.c:5630
#12 0x0000000000441a43 in move_it_in_display_line_to (it=0x7fff61244de0,
    to_charpos=1332455, to_x=-1, op=MOVE_TO_POS) at xdisp.c:6956
#13 0x0000000000443274 in move_it_to (it=0x7fff61244de0, to_charpos=1332455,
    to_x=-1, to_y=25, to_vpos=-1, op=10) at xdisp.c:7406
#14 0x0000000000443e5f in move_it_vertically (it=0x7fff61244de0, dy=8)
    at xdisp.c:7691
#15 0x0000000000443d94 in move_it_vertically_backward (it=0x7fff61244de0,
    dy=25) at xdisp.c:7665
#16 0x0000000000453c5e in redisplay_window (window=18344213, just_this_one_p=0)
    at xdisp.c:14205
#17 0x000000000044e4ed in redisplay_window_0 (window=18344213) at xdisp.c:12362
#18 0x00000000005f72c8 in internal_condition_case_1 (
    bfun=0x44e4ae <redisplay_window_0>, arg=18344213, handlers=12564150,
    hfun=0x44e47f <redisplay_window_error>) at eval.c:1455
#19 0x000000000044e460 in redisplay_windows (window=18344213) at xdisp.c:12342
#20 0x000000000044d47d in redisplay_internal (preserve_echo_area=1)
    at xdisp.c:11919
#21 0x000000000044dc97 in redisplay_preserve_echo_area (from_where=12)
    at xdisp.c:12170
#22 0x0000000000651789 in wait_reading_process_output (time_limit=120,
    microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=12593666,
    wait_proc=0x0, just_wait_proc=0) at process.c:4974
#23 0x0000000000421e9f in sit_for (timeout=480, reading=1, do_display=1)
    at dispnew.c:6017
...