bug#9709: 24.0.90; TAB-completion causes assertion violation

[Eli Zaretskii]

This bug report will be sent to the Bug-GNU-Emacs mailing list
and the GNU bug tracker at debbugs.gnu.org.  Please check that
the From: line contains a valid email address.  After a delay of up
to one day, you should receive an acknowledgement at that address.

Please write in English if possible, as the Emacs maintainers
usually do not have translators for other languages.

Please describe exactly what actions triggered the bug, and
the precise symptoms of the bug.  If you can, give a recipe
starting from `emacs -Q':

 emacs -Q
 C-x b w TAB

 => minibuf.c:1866: Emacs fatal error: assertion failed: CONSP ((bufs))

The backtrace is below.  I will leave this crashed session running
under GDB, in case you need more information.


#0  0x7c901231 in ntdll!DbgUiConnectToDbg ()
   from C:\WINDOWS\system32\ntdll.dll
#1  0x01231c62 in w32_abort () at w32fns.c:7196
#2  0x010439d3 in die (msg=0x1555704 "assertion failed: CONSP ((bufs))",
    file=0x15544c0 "minibuf.c", line=1866) at alloc.c:6261
#3  0x0110af61 in Finternal_complete_buffer (string=20066513,
    predicate=53643525, flag=52521010) at minibuf.c:1866
#4  0x01038179 in Ffuncall (nargs=4, args=0x82c670) at eval.c:2981
#5  0x011262b6 in exec_byte_code (bytestr=20552897, vector=20552957,
    maxdepth=32, args_template=4112, nargs=4, args=0x82c8ec) at bytecode.c:785
#6  0x01038b85 in funcall_lambda (fun=20552869, nargs=4, arg_vector=0x82c8dc)
    at eval.c:3139
#7  0x010384a0 in Ffuncall (nargs=5, args=0x82c8d8) at eval.c:3023
#8  0x011262b6 in exec_byte_code (bytestr=20554225, vector=20554301,
    maxdepth=68, args_template=6168, nargs=6, args=0x82cb6c) at bytecode.c:785
#9  0x01038b85 in funcall_lambda (fun=20554197, nargs=6, arg_vector=0x82cb54)
    at eval.c:3139
#10 0x010384a0 in Ffuncall (nargs=7, args=0x82cb50) at eval.c:3023
#11 0x01036fb8 in Fapply (nargs=5, args=0x82cc00) at eval.c:2479
#12 0x01035f66 in eval_sub (form=270106142) at eval.c:2294
#13 0x01031147 in Fprogn (args=270106134) at eval.c:358
#14 0x01038ed1 in funcall_lambda (fun=270106118, nargs=3, arg_vector=0x82ce74)
    at eval.c:3198
#15 0x01038574 in Ffuncall (nargs=4, args=0x82ce70) at eval.c:3035
#16 0x01037614 in call3 (fn=270106110, arg1=20066513, arg2=52520986,
    arg3=52521010) at eval.c:2774
#17 0x0110981d in Fall_completions (string=20066513, collection=270106110,
    predicate=52520986, hide_spaces=52520986) at minibuf.c:1510
#18 0x010381f8 in Ffuncall (nargs=4, args=0x82d044) at eval.c:2985
#19 0x011262b6 in exec_byte_code (bytestr=20573097, vector=20573189,
    maxdepth=52, args_template=4112, nargs=4, args=0x82d2f0) at bytecode.c:785
#20 0x01038b85 in funcall_lambda (fun=20573069, nargs=4, arg_vector=0x82d2e0)
    at eval.c:3139
#21 0x010384a0 in Ffuncall (nargs=5, args=0x82d2dc) at eval.c:3023
#22 0x011262b6 in exec_byte_code (bytestr=20575457, vector=20575509,
    maxdepth=68, args_template=4112, nargs=4, args=0x82d564) at bytecode.c:785
#23 0x01038b85 in funcall_lambda (fun=20575429, nargs=4, arg_vector=0x82d554)
    at eval.c:3139
#24 0x010384a0 in Ffuncall (nargs=5, args=0x82d550) at eval.c:3023
#25 0x011262b6 in exec_byte_code (bytestr=20575569, vector=20575629,
    maxdepth=60, args_template=4112, nargs=4, args=0x82d7d8) at bytecode.c:785
#26 0x01038b85 in funcall_lambda (fun=20575541, nargs=4, arg_vector=0x82d7c8)
    at eval.c:3139
#27 0x010384a0 in Ffuncall (nargs=5, args=0x82d7c4) at eval.c:3023
#28 0x011262b6 in exec_byte_code (bytestr=20557649, vector=54054309,
    maxdepth=24, args_template=1028, nargs=1, args=0x82da2c) at bytecode.c:785
#29 0x01038b85 in funcall_lambda (fun=54054405, nargs=1, arg_vector=0x82da28)
    at eval.c:3139
#30 0x010384a0 in Ffuncall (nargs=2, args=0x82da24) at eval.c:3023
#31 0x011262b6 in exec_byte_code (bytestr=20552801, vector=53171301,
    maxdepth=20, args_template=0, nargs=0, args=0x82dc94) at bytecode.c:785
#32 0x01038b85 in funcall_lambda (fun=53170437, nargs=0, arg_vector=0x82dc94)
    at eval.c:3139
#33 0x010384a0 in Ffuncall (nargs=1, args=0x82dc90) at eval.c:3023
#34 0x01035f66 in eval_sub (form=270154782) at eval.c:2294
#35 0x01033cd0 in internal_lisp_condition_case (var=53654010,
    bodyform=270154782, handlers=269905838) at eval.c:1453
#36 0x01126b71 in exec_byte_code (bytestr=20552625, vector=20552725,
    maxdepth=60, args_template=2056, nargs=2, args=0x82e120) at bytecode.c:981
#37 0x01038b85 in funcall_lambda (fun=20552597, nargs=2, arg_vector=0x82e118)
    at eval.c:3139
#38 0x010384a0 in Ffuncall (nargs=3, args=0x82e114) at eval.c:3023
#39 0x011262b6 in exec_byte_code (bytestr=20557521, vector=20557597,
    maxdepth=60, args_template=5136, nargs=5, args=0x82e3b0) at bytecode.c:785
#40 0x01038b85 in funcall_lambda (fun=20557493, nargs=5, arg_vector=0x82e39c)
    at eval.c:3139
#41 0x010384a0 in Ffuncall (nargs=6, args=0x82e398) at eval.c:3023
#42 0x011262b6 in exec_byte_code (bytestr=20558689, vector=20558909,
    maxdepth=92, args_template=2048, nargs=0, args=0x82e624) at bytecode.c:785
#43 0x01038b85 in funcall_lambda (fun=20558661, nargs=0, arg_vector=0x82e624)
    at eval.c:3139
#44 0x010384a0 in Ffuncall (nargs=1, args=0x82e620) at eval.c:3023
#45 0x011262b6 in exec_byte_code (bytestr=20559233, vector=20559325,
    maxdepth=20, args_template=0, nargs=0, args=0x82e8c4) at bytecode.c:785
#46 0x01038b85 in funcall_lambda (fun=20559205, nargs=0, arg_vector=0x82e8c4)
    at eval.c:3139
#47 0x010384a0 in Ffuncall (nargs=1, args=0x82e8c0) at eval.c:3023
#48 0x01037508 in apply1 (fn=53602266, arg=52520986) at eval.c:2710
#49 0x011235da in Fcall_interactively (function=53602266,
    record_flag=52520986, keys=52542213) at callint.c:379
#50 0x01038179 in Ffuncall (nargs=4, args=0x82eb40) at eval.c:2981
#51 0x01037614 in call3 (fn=52641130, arg1=53602266, arg2=52520986,
    arg3=52520986) at eval.c:2774
#52 0x010200ef in Fcommand_execute (cmd=53602266, record_flag=52520986,
    keys=52520986, special=52520986) at keyboard.c:10280
#53 0x01006424 in command_loop_1 () at keyboard.c:1570
#54 0x01033dda in internal_condition_case (bfun=0x100548f <command_loop_1>,
    handlers=52578714, hfun=0x1004cb9 <cmd_error>) at eval.c:1499
#55 0x010050f5 in command_loop_2 (ignore=52520986) at keyboard.c:1158
#56 0x0103379a in internal_catch (tag=52625866,
    func=0x10050d2 <command_loop_2>, arg=52520986) at eval.c:1256
#57 0x0100505c in command_loop () at keyboard.c:1123
#58 0x01004677 in recursive_edit_1 () at keyboard.c:757
#59 0x01107101 in read_minibuf (map=52923134, initial=52520986,
    prompt=54980737, backup_n=52520986, expflag=0, histvar=52651634,
    histpos=0, defalt=53045073, allow_props=0, inherit_input_method=0)
    at minibuf.c:677
#60 0x01107e54 in Fread_from_minibuffer (prompt=54980737,
    initial_contents=52520986, keymap=52923134, sys_read=52520986,
    hist=52651634, default_value=53045073, inherit_input_method=52520986)
    at minibuf.c:970
#61 0x010383b1 in Ffuncall (nargs=8, args=0x82f098) at eval.c:3000
#62 0x011262b6 in exec_byte_code (bytestr=20576177, vector=20576261,
    maxdepth=72, args_template=8200, nargs=8, args=0x82f324) at bytecode.c:785
#63 0x01038b85 in funcall_lambda (fun=20576149, nargs=8, arg_vector=0x82f304)
    at eval.c:3139
#64 0x010384a0 in Ffuncall (nargs=9, args=0x82f300) at eval.c:3023
#65 0x0110a22d in Fcompleting_read (prompt=54980737, collection=52654418,
    predicate=52520986, require_match=53025490, initial_input=52520986,
    hist=52651634, def=53045073, inherit_input_method=52520986)
    at minibuf.c:1715
#66 0x011085e6 in Fread_buffer (prompt=54980737, def=53045073,
    require_match=53025490) at minibuf.c:1165
#67 0x01038179 in Ffuncall (nargs=4, args=0x82f440) at eval.c:2981
#68 0x011262b6 in exec_byte_code (bytestr=20285601, vector=20285677,
    maxdepth=16, args_template=52520986, nargs=0, args=0x0) at bytecode.c:785
#69 0x01039005 in funcall_lambda (fun=20285573, nargs=1, arg_vector=0x82f600)
    at eval.c:3205
#70 0x010387d5 in apply_lambda (fun=20285573, args=55085454) at eval.c:3082
#71 0x01036547 in eval_sub (form=55085446) at eval.c:2367
#72 0x01035eb1 in eval_sub (form=55085438) at eval.c:2286
#73 0x010357f6 in Feval (form=55085438, lexical=52520986) at eval.c:2176
#74 0x01123452 in Fcall_interactively (function=52707594,
    record_flag=52520986, keys=52542213) at callint.c:346
#75 0x01038179 in Ffuncall (nargs=4, args=0x82fb80) at eval.c:2981
#76 0x01037614 in call3 (fn=52641130, arg1=52707594, arg2=52520986,
    arg3=52520986) at eval.c:2774
#77 0x010200ef in Fcommand_execute (cmd=52707594, record_flag=52520986,
    keys=52520986, special=52520986) at keyboard.c:10280
#78 0x01006424 in command_loop_1 () at keyboard.c:1570
#79 0x01033dda in internal_condition_case (bfun=0x100548f <command_loop_1>,
    handlers=52578714, hfun=0x1004cb9 <cmd_error>) at eval.c:1499
#80 0x010050f5 in command_loop_2 (ignore=52520986) at keyboard.c:1158
#81 0x0103379a in internal_catch (tag=52576738,
    func=0x10050d2 <command_loop_2>, arg=52520986) at eval.c:1256
#82 0x010050ad in command_loop () at keyboard.c:1137
#83 0x01004677 in recursive_edit_1 () at keyboard.c:757
#84 0x01004999 in Frecursive_edit () at keyboard.c:821
#85 0x010027be in main (argc=2, argv=0xa33fe8) at emacs.c:1706

Lisp Backtrace:
"internal-complete-buffer" (0x82c674)
"complete-with-action" (0x82c8dc)
"completion-table-with-predicate" (0x82cb54)
"apply" (0x82cc00)
0x10197df8 Lisp type 6
"all-completions" (0x82d048)
"completion-pcm--all-completions" (0x82d2e0)
"completion-substring--all-completions" (0x82d554)
"completion-substring-try-completion" (0x82d7c8)
0x338ce00 PVEC_COMPILED
0x32b5100 PVEC_COMPILED
"funcall" (0x82dc90)
"completion--some" (0x82e118)
"completion-try-completion" (0x82e39c)
"completion--do-completion" (0x82e624)
"minibuffer-complete" (0x82e8c4)
"call-interactively" (0x82eb44)
"read-from-minibuffer" (0x82f09c)
"completing-read-default" (0x82f304)
"read-buffer" (0x82f444)
"read-buffer-to-switch" (0x82f600)
"list" (0x82f8c0)
"call-interactively" (0x82fb84)
(gdb)


If Emacs crashed, and you have the Emacs process in the gdb debugger,
please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
For information about debugging Emacs, please read the file
d:/gnu/bzr/emacs/trunk/etc/DEBUG.


In GNU Emacs 24.0.90.1 (i386-mingw-nt5.1.2600)
 of 2011-10-09 on HOME-C4E4A596F7
Windowing system distributor `Microsoft Corp.', version 5.1.2600
configured using `configure --with-gcc (3.4) --no-opt'

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: ENU
  value of $XMODIFIERS: nil
  locale-coding-system: cp1255
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x r e p o r t - e m <tab> <return>

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr message format-spec rfc822 mml easymenu
mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231 rfc2047 rfc2045
ietf-drums mm-util mail-prsvr mailabbrev mail-utils gmm-utils mailheader
emacsbug time-date tooltip ediff-hook vc-hooks lisp-float-type mwheel
dos-w32 disp-table ls-lisp w32-win w32-vars tool-bar dnd fontset image
fringe lisp-mode register page menu-bar rfn-eshadow timer select
scroll-bar mouse jit-lock font-lock syntax facemenu font-core frame cham
georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese hebrew greek romanian slovak czech european ethiopic
indian cyrillic chinese case-table epa-hook jka-cmpr-hook help simple
abbrev minibuffer button faces cus-face files text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote make-network-process multi-tty emacs)