bug#7517: 24.0.50; repeated crash under Mac OS X

[emacs user]

This crash occurs when I use vm to read my mail, and attempt to edit
an email written in non-English characters.  I cannot provide a simple
reproducible example, but it is very easy for me to reproduce this
with my setup and mail files.  Am happy to try patches etc.  Backtrace
attached.

In GNU Emacs 24.0.50.1 (x86_64-apple-darwin10.4.3, NS apple-appkit-1038.32)
 of 2010-11-19 on dhcp-0126683956-1d-ed.client.fas.harvard.edu
Windowing system distributor `Apple', version 10.3.1038
configured using `configure  '--with-ns' '--without-x''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: C
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  value of $XMODIFIERS: nil
  locale-coding-system: nil
  default enable-multibyte-characters: t

Major mode: Fundamental

Minor modes in effect:
  delete-selection-mode: t
  display-time-mode: t
  auto-image-file-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t
  abbrev-mode: t

~ $ cd /usr/local/emacs/trunk/src
/usr/local/emacs/trunk/src $ gdb
/usr/local/emacs/trunk/nextstep/Emacs.app/Cont nts/MacOS/Emacs
GNU gdb 6.3.50-20050815 (Apple version gdb-1472) (Wed Jul 21 10:53:12 UTC 2010)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin"...Reading symbols for
shared libraries ........ ..... done

DISPLAY = :0.0
TERM = xterm
Breakpoint 1 at 0x4189374bb95c7f
Breakpoint 2 at 0x1000be992: file sysdep.c, line 845.
(gdb) run
Starting program:
/usr/local/emacs/trunk/nextstep/Emacs.app/Contents/MacOS/Emacs
Reading symbols for shared libraries
.+++++++++++++.............................................
................................. done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done
Reading symbols for shared libraries . done

Breakpoint 1, 0x00007fff86da8c7f in abort ()
(gdb) bt full
#0  0x00007fff86da8c7f in abort ()
No symbol table info available.
#1  0x0000000100101ea9 in Fgarbage_collect () at alloc.c:5077
        bind = <value temporarily unavailable, due to optimizations>
        catch = <value temporarily unavailable, due to optimizations>
        handler = <value temporarily unavailable, due to optimizations>
        stack_top_variable = 0 '\0'
        i = <value temporarily unavailable, due to optimizations>
        message_p = 0
        total = {4689107254, 1204557, 4337316290, 176147753894,
140734799796272, 4328685322, 40, 4300585072}
        count = <value temporarily unavailable, due to optimizations>
        t1 = {
  tv_sec = 1291039991,
  tv_usec = 957606
}
        t2 = {
  tv_sec = 4328685322,
  tv_usec = 1606408508
}
#2  0x000000010011a2ab in Feval (form=4689107254) at eval.c:2242
        fun = <value temporarily unavailable, due to optimizations>
        val = <value temporarily unavailable, due to optimizations>
        original_fun = <value temporarily unavailable, due to optimizations>
        original_args = <value temporarily unavailable, due to optimizations>
        funcar = <value temporarily unavailable, due to optimizations>
        backtrace = {
  next = 0x102027f0a,
  function = 0x10055b870,
  args = 0x10055c518,
  nargs = 33566778,
  evalargs = 1 '\001',
  debug_on_exit = 0 '\0'
}
#3  0x0000000100140f28 in readevalloop (readcharfun=4328685322,
stream=0x7fff70dbff40, sourcenam =4800300321, evalfun=0x100119ff0
<Feval>, printflag=0, unibyte=<value temporarily unavailable, d e to
optimizations>, readfun=4328534074, start=4328534074, end=4328534074)
at lread.c:1737
        count1 = 23
        c = <value temporarily unavailable, due to optimizations>
        val = 4689107254
        b = (struct buffer *) 0x0
        continue_reading_p = 1
        whole_buffer = 0
        first_sexp = 0
#4  0x0000000100142915 in Fload (file=4320237433, noerror=4328534074,
nomessage=4328534122, nosu fix=4328534074, must_suffix=4328534122) at
lread.c:1228
        stream = (FILE *) 0x7fff70dbff40
        fd = 9
        count = 12
        found = 4801669825
        efound = <value temporarily unavailable, due to optimizations>
        hist_file_name = 4801669825
        newer = 0
        compiled = 1
        handler = <value temporarily unavailable, due to optimizations>
        safe_p = 1
        tmp = {4300585720, 7686741539101004111}
        version = 23
#5  0x000000010011c15e in do_autoload (fundef=4349060838,
funname=<value temporarily unavailable  due to optimizations>) at
eval.c:2203
        fun = <value temporarily unavailable, due to optimizations>
#6  0x000000010011ae52 in Ffuncall (nargs=3, args=<value temporarily
unavailable, due to optimiz tions>) at eval.c:3050
        fun = <value temporarily unavailable, due to optimizations>
        original_fun = 4339766418
        funcar = <value temporarily unavailable, due to optimizations>
        numargs = 2
        val = <value temporarily unavailable, due to optimizations>
        backtrace = {
  next = 0x7fff5fbfded0,
  function = 0x7fff5fbfdd40,
  args = 0x7fff5fbfdd48,
  nargs = 2,
  evalargs = 0 '\0',
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x7fff5fbfdd48
        i = <value temporarily unavailable, due to optimizations>
#7  0x0000000100156b0e in Fbyte_code (bytestr=<value temporarily
unavailable, due to optimizatio s>, vector=<value temporarily
unavailable, due to optimizations>, maxdepth=<value temporarily un
vailable, due to optimizations>) at bytecode.c:679
        count = 6
        op = <value temporarily unavailable, due to optimizations>
        vectorp = (Lisp_Object *) 0x11782b3a0
        stack = {
  pc = 0x1173921a9 "\210\016E\203\335",
  top = 0x7fff5fbfdd50,
  bottom = 0x7fff5fbfdd40,
  byte_string = 4689404289,
  byte_string_start = 0x1173920e0 "\306 \210\307t\030\031\b\203\r",
  constants = 4689408917,
  next = 0x0
}
        top = (Lisp_Object *) 0x7fff5fbfdd40
        result = <value temporarily unavailable, due to optimizations>
#8  0x000000010011abdc in funcall_lambda (fun=4679307221, nargs=1,
arg_vector=0x7fff5fbfdf98) at eval.c:3174
        val = <value temporarily unavailable, due to optimizations>
        syms_left = <value temporarily unavailable, due to optimizations>
        next = <value temporarily unavailable, due to optimizations>
        i = 1
        optional = 1
        rest = 0
#9  0x000000010011aed2 in Ffuncall (nargs=2, args=<value temporarily
unavailable, due to optimiz tions>) at eval.c:3047
        fun = <value temporarily unavailable, due to optimizations>
        original_fun = 4337411042
        funcar = <value temporarily unavailable, due to optimizations>
        numargs = 1
        val = <value temporarily unavailable, due to optimizations>
        backtrace = {
  next = 0x7fff5fbfe170,
  function = 0x7fff5fbfdf90,
  args = 0x7fff5fbfdf98,
  nargs = 1,
  evalargs = 0 '\0',
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x7fff5fbfdf98
        i = <value temporarily unavailable, due to optimizations>
#10 0x000000010011759f in Fcall_interactively (function=4337411042,
record_flag=4328534074, keys 4320148728) at callint.c:849
        val = <value temporarily unavailable, due to optimizations>
        args = (Lisp_Object *) 0x7fff5fbfdf90
        visargs = (Lisp_Object *) 0x7fff5fbfdf70
        specs = 4328534074
        filter_specs = <value temporarily unavailable, due to optimizations>
        teml = 1
        up_event = 4328534074
        enable = 4328534074
        speccount = 3
        next_event = 1
        prefix_arg = 4328534074
        string = <value temporarily unavailable, due to optimizations>
        tem = (unsigned char *) 0x1001b53e8 ""
        varies = (int *) 0x7fff5fbfdf50
        i = 1
        j = 1
        prompt1 = '\0' <repeats 99 times>
        arg_from_tty = 0
        key_count = 1
        record_then_fail = 0
        save_this_command = 4337411042
        save_last_command = 4339778850
        save_this_original_command = 4337411042
        save_real_this_command = 4337411042
#11 0x000000010011b10e in Ffuncall (nargs=4, args=<value temporarily
unavailable, due to optimiz tions>) at eval.c:2996
        fun = <value temporarily unavailable, due to optimizations>
        original_fun = <value temporarily unavailable, due to optimizations>
        funcar = <value temporarily unavailable, due to optimizations>
        numargs = 3
        val = <value temporarily unavailable, due to optimizations>
        backtrace = {
  next = 0x0,
  function = 0x7fff5fbfe1e0,
  args = 0x7fff5fbfe1e8,
  nargs = 3,
  evalargs = 0 '\0',
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x7fff5fbfe1e8
        i = <value temporarily unavailable, due to optimizations>
#12 0x000000010011b2e6 in call3 (fn=<value temporarily unavailable,
due to optimizations>, arg1= value temporarily unavailable, due to
optimizations>, arg2=<value temporarily unavailable, due t
optimizations>, arg3=<value temporarily unavailable, due to
optimizations>) at eval.c:2820
        ret_ungc_val = 4377593632
        args = {4328704874, 4337411042, 4328534074, 4328534074}
#13 0x00000001000b4de4 in command_loop_1 () at keyboard.c:1720
        cmd = <value temporarily unavailable, due to optimizations>
        keybuf = {404, 4797060806, 140734799798992, 4296256866,
4611686018427404288, 4328590042, 4300563296, 7686741539101004111,
140734799799088, 4300585072, 140734799799088, 4797060806, 43005 2440,
4300584952, 140734799799056, 4295665093, 0, 4300586304, 4300586312,
4328534074, 4328534074  4300584952, 140734799799200, 4295665372,
140734799799088, 4797060806, 0, 140734799799136, 14073 799798816, 0}
        i = <value temporarily unavailable, due to optimizations>
        prev_modiff = 131391
        prev_buffer = (struct buffer *) 0x11e044af0
#14 0x00000001001192c5 in internal_condition_case (bfun=0x1000b4930
<command_loop_1>, handlers=4 28590042, hfun=0x1000aa5d0 <cmd_error>)
at eval.c:1460
        val = <value temporarily unavailable, due to optimizations>
        c = {
  tag = 4328534074,
  val = 4328534074,
  next = 0x7fff5fbfe530,
  gcpro = 0x0,
  jmp = {5617656, 1, 1606411504, 32767, 1606411184, 32767, 5617496, 1,
5594576, 1, 5596000, 1, 3 993160, 1, 1151554, 1, 530, 0, 8099, 895,
1606411600, 32767, 696960, 1, 5618416, 1, 5618352, 1,  , 0, 0, 0, 0,
0, -2033454713, 32767, 0},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 0,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        h = {
 handler = 4328590042,
  var = 4328534074,
  chosen_clause = 4328534122,
  tag = 0x7fff5fbfe3d0,
  next = 0x0
}
#15 0x00000001000aa187 in command_loop_2 (ignore=<value temporarily
unavailable, due to optimiza ions>) at keyboard.c:1321
        val = 4377593632
#16 0x00000001001193c1 in internal_catch (tag=<value temporarily
unavailable, due to optimizatio s>, func=0x1000aa150 <command_loop_2>,
arg=4328534074) at eval.c:1204
        c = {
  tag = 4328586298,
  val = 4328534074,
  next = 0x0,
  gcpro = 0x0,
  jmp = {5617656, 1, 1606411792, 32767, 1606411552, 32767, 5617792, 1,
5594576, 1, 5596000, 1, 34993160, 1, 1151920, 1, 530, 0, 8099, 895,
1606411836, 0, 344, 0, 1606411744, 22, 1454950, 1, 10, 8, 1606411900,
32767, 1606411888, 32767, 9613312, 14, 1796832},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 0,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
#17 0x00000001000aa3d6 in command_loop () at keyboard.c:1300
No locals.
#18 0x00000001000aa84f in recursive_edit_1 () at keyboard.c:923
        val = <value temporarily unavailable, due to optimizations>
#19 0x00000001000aa9ef in Frecursive_edit () at keyboard.c:985
        count = <value temporarily unavailable, due to optimizations>
        buffer = 4328534074
#20 0x00000001000a27c8 in main (argc=1, argv=0x7fff5fbfe840) at emacs.c:1721
        dummy = 0
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = <value temporarily unavailable, due to
optimizations>
        skip_args = 0
        rlim = {
  rlim_cur = 8720000,
  rlim_max = 67104768
}
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        dname_arg2 =
"\000\000\000\000\001\000\000\000\000\000\000\000\001\000\000\000\000\000\300_\377\177\000\000\000\000\000\000\000\000\000\000\370\005\300_\377\177\000\000\t\000\000\000\t\000\000\000(\352\277_\377\177\000\000`\a\300_\377\177",
'\0' <repeats 17 times>
        ch_to_dir = 0x0

Lisp Backtrace:
"vm-retrieve-operable-messages" (0x5fbfdd48)
"vm-edit-message" (0x5fbfdf98)
"call-interactively" (0x5fbfe1e8)
(gdb) xbacktrace full
"vm-retrieve-operable-messages" (0x5fbfdd48)
"vm-edit-message" (0x5fbfdf98)
"call-interactively" (0x5fbfe1e8)
(gdb)