Crash when evaling questionmark-backslash-newline

[Dominique Quatravaux]

The attached file crashes the tip version of XEmacs when compiled,
loaded or M-x eval-buffered. Here is a stack trace:

#0  0xb7fff410 in __kernel_vsyscall ()
#1  0x4a917366 in kill () from /lib/tls/i686/cmov/libc.so.6
#2  0x080e489b in fatal_error_signal (sig=6) at emacs.c:3801
#3  <signal handler called>
#4  0xb7fff410 in __kernel_vsyscall ()
#5  0x4a916f35 in raise () from /lib/tls/i686/cmov/libc.so.6
#6  0x4a9188b1 in abort () from /lib/tls/i686/cmov/libc.so.6
#7  0x080e5d14 in really_abort () at emacs.c:4693
#8  0x080e499c in assert_failed (file=0x82daafe "lisp.h", line=2871,
    expr=0x82dac46 "valid_ichar_p (val)") at emacs.c:3987
#9  0x08110904 in make_char (val=-1) at lisp.h:2871
#10 0x081bd318 in read1 (readcharfun=151025208) at lread.c:2766
#11 0x081bd5f0 in read_list_conser (readcharfun=151025208, state=0xbfffe888,
    unused_len=0) at lread.c:2919
#12 0x081bd5c7 in sequence_reader (readcharfun=151025208, terminator=41,
    state=0xbfffe888, conser=0x81bd5d8 <read_list_conser>) at lread.c:2899
#13 0x081bd91e in read_list (readcharfun=151025208, terminator=41,
    allow_dotted_lists=1, check_for_doc_references=1) at lread.c:3024
#14 0x081bcc41 in read1 (readcharfun=151025208) at lread.c:2471
#15 0x081bb0ae in read0 (readcharfun=151025208) at lread.c:1661
#16 0x081baa76 in readevalloop (readcharfun=151025208, sourcename=143472436,
    evalfun=0x80eca9e <Feval>, printflag=0) at lread.c:1464
#17 0x081bad4e in Feval_buffer (buffer=143472644, printflag=137714428)
    at lread.c:1517
#18 0x080ee64f in Ffuncall (nargs=2, args=0xbfffeb20) at eval.c:3928
#19 0x080b24ef in Fcall_interactively (function=137686348,
    record_flag=137713780, keys=137714428) at callint.c:994
#20 0x080ec178 in Fcommand_execute (cmd=137686348, record_flag=137713780,
    keys=137714428) at eval.c:3138
#21 0x080ee67c in Ffuncall (nargs=3, args=0xbfffedc4) at eval.c:3928
#22 0x080ab003 in execute_optimized_program (
    program=0x9023308
"\r\035�\r�a�\004Ȫ$\r�k�\004ʪ\034\r��\a��\r\"�\022\r:�\r\r@��\b��\r@\"�\002�!\024)\t�Kt�H�\f!\f\032\033�\f�\"\210\v�8\b�\023�
� a�\a� pa�\006� \210�\004�
\210��!�\033���\vA�\004ڪ\002�\n�\v!#\"\210�\016\036!\210��!*\207�\f�\"\207",
stack_depth=7, constants_data=0x83ff97c) at bytecode.c:862
#23 0x080ee1ca in funcall_compiled_function (fun=139030756, nargs=1,
    args=0xbffff144) at eval.c:3517
#24 0x080ee9c8 in Ffuncall (nargs=2, args=0xbffff140) at eval.c:3967
#25 0x080b24ef in Fcall_interactively (function=137571124,
    record_flag=137714428, keys=137714428) at callint.c:994
#26 0x080ec178 in Fcommand_execute (cmd=137571124, record_flag=137714428,
    keys=137714428) at eval.c:3138
#27 0x08106a01 in execute_command_event (command_builder=0x8a6c9a0,
    event=148283772) at event-stream.c:4288
#28 0x08107462 in Fdispatch_event (event=148283772) at event-stream.c:4592
#29 0x080ba394 in Fcommand_loop_1 () at cmdloop.c:600
#30 0x080ba165 in command_loop_1 (unused_dummy=137714428) at cmdloop.c:505
#31 0x080ea27d in condition_case_1 (handlers=137710804,
    bfun=0x80ba133 <command_loop_1>, barg=137714428,
    hfun=0x80b9d25 <cmd_error>, harg=137714428) at eval.c:1946
#32 0x080b9e51 in command_loop_3 () at cmdloop.c:262
#33 0x080b9e73 in command_loop_2 (unused_dummy=137714428) at cmdloop.c:275
#34 0x080e9d1f in internal_catch (tag=137454988,
    func=0x80b9e68 <command_loop_2>, arg=137714428, threw=0x0, thrown_tag=0x0,
    backtrace_before_throw=0x0) at eval.c:1552
#35 0x080b9f89 in initial_command_loop (load_me=137714428) at cmdloop.c:313
#36 0x080e37e5 in xemacs_21_5_b20080303_i486_pc_linux (argc=2,
    argv=0xbffff7d4, unused_envp=0x0, restart=0) at emacs.c:2668
#37 0x080e4150 in main (argc=Cannot access memory at address 0x7d7e
) at emacs.c:3112

Best,

-- 
  Dominique Quatravaux
  +41 791 609 40 72
-------------- next part --------------
A non-text attachment was scrubbed...
Name: crash.el
Type: application/octet-stream
Size: 5 bytes
Desc: not available
Url : http://lists.xemacs.org/pipermail/xemacs-beta/attachments/20080305/ca76c993/crash.obj