bug#14264: 24.3.50; SEGV in char_table_ref's use of SUB_CHAR_TABLE_P

[Eli Zaretskii]

> From: Glenn Morris <rgm@gnu.org>
> Cc: Jim Meyering <jim@meyering.net>,  14264@debbugs.gnu.org
> Date: Mon, 21 Oct 2013 19:23:54 -0400
> 
> Eli Zaretskii wrote:
> 
> >> Reading mail with GNUS, this segmentation fault strikes when I attempt
> >> to read the following message from a local nnml folder:
> [...]
> > The backtraces are from an optimized build, and all the interesting
> > values are "optimized out".  Please try reproducing this in an
> > unoptimized build, and then submitting a backtrace.
> 
> I just had what looks like the same crash, on entering comp.unix.shell
> today in Gnus. Both 24.3 and current trunk crash. Unoptimized 24.3
> backtrace follows:

Unfortunately, I cannot reproduce this.  I tried with today's trunk
both on Windows and on GNU/Linux (the latter in a text-mode session),
and neither crashed.

Is this reproducible from "emacs -Q"?  I started from that, then did
this:

  M-: (setq gnus-select-method '(nntp "nntp.aioe.org")) RET

then "M-x gnus RET", then 'U' to subscribe to the group you mentioned,
then I typed RET to activate it, navigated to the offending message,
and finally typed RET on its summary line to display it.  Should I
have done anything else?

A few comments regarding what I see in the backtrace:

> #0  0x00000000004d8c79 in char_table_ref (table=13078765, c=4194733)

This value is bogus, of course, and is the immediate reason for the
crash.

> #1  0x00000000006518dd in composition_compute_stop_pos 
> (cmp_it=0x7fffffff0050, 
>     charpos=1646, bytepos=1647, endpos=1746, string=12927554)
      ^^^^^^^^^^^^^^^^^^^^^^^^^^
This tells me Emacs was scanning at this position:

>         col = 43
>         prev_col = 42

This is also strange, since the above position is at column 71, not 42
or 43.