bug#25684: 25.1; (downcase -1) segfaults Emacs on GNU/Linux

[Wilfred Hughes]

When I tested it on OS X, (downcase -1) returned -1.

I agree with Glenn that I think the most sensible behaviour would be
to signal a type error. I don't believe the manual specifies this
behaviour: 
https://www.gnu.org/software/emacs/manual/html_node/elisp/Case-Conversion.html
so it's unlikely users depend on this.

On 14 February 2017 at 15:04, Andreas Schwab <schwab@linux-m68k.org> wrote:
> On Feb 13 2017, Glenn Morris <rgm@gnu.org> wrote:
>
>> Wilfred Hughes wrote:
>>
>>> The elisp primitives downcase and upcase cause Emacs to segfault when
>>> given a negative argument. For example, (downcase -1).
>>>
>>> I can reproduce this on Emacs 25.1 as well as on master. It occurs on
>>> GNU/Linux but not on OS X.
>>
>> I can't reproduce this, but it seems to me that (downcase -1) should
>> signal a wrong-type-argument error, since negative numbers are not 
>> characters.
>> But I think there are probably subtleties here that I don't get.
>
> The function uses XFASTINT, which only works for non-negative numbers.
> This is checked when runtime checking is enabled.
>
> Andreas.
>
> --
> Andreas Schwab, schwab@linux-m68k.org
> GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
> "And now for something completely different."