Gutter-related crash in 21.4.3

I was attempting to debug the flaky progress-gauge on Solaris and I found that I could cause a core dump. I was using ielm at the time. I accidentally wrote an infloop, and after hitting a couple of C-c's and C-g's I got a core dump. This is reproducible (but it takes a few tries). I had typed this into ielm: (setq x 10) (while (< x 101) (progress-feedback-with-label "FOO" "BAR" x)) ;; please don't tell me I forgot to increment x! I know! That's=20 ;; not the point! After executing the above, some combination of C-c and C-g leads to a core dump. Lisp backtrace follows: redisplay-gutter-area() # bind (tmsg top frame value message label) append-progress-feedback("FOO" "BAR" 10 nil) # bind (frame value message label) display-progress-feedback("FOO" "BAR" 10) # bind (str) # (unwind-protect ...) # bind (args value fmt label) progress-feedback-with-label("FOO" "BAR" 10) (while (< x 101) (progress-feedback-with-label "FOO" "BAR" x)) eval((while (< x 101) (progress-feedback-with-label "FOO" "BAR" x))) # bind (! !! !!! ielm-obuf) byte-code("..." [!! !!! !!!save !!save !save ielm-obuf eval ! ielm-fo= rm ielm-r esult ielm-wbuf] 4) # (condition-case ... . ((error (byte-code "=C3\n!=C4=C3=87" ... 2)) = (quit (byte-code "=C2=C3=C4=87" ... 1)))) # (unwind-protect ...) # bind (!save !!save !!!save ielm-form ielm-pos ielm-result ielm-erro= r-type ie lm-output ielm-wbuf ielm-pmark ielm-string) ielm-eval-input("(while ( < x 101 ) (progress-feedback-with-label \"F= OO\" \"BA R\" x))") # bind (buf ielm-input) ielm-send-input() # bind (state) #<compiled-function nil "...(59)" [comint-prompt-regexp ielm-dynamic-= multiline -inputs ielm-dynamic-return state nil parse-partial-sex= p ielm-pm 1 3 ielm-send-i nput 0 looking-at newline newline-and-i= ndent] 4 ("/home/titan/charles/XEmacs/xem acs-packages/lisp/xemac= s-devel/ielm.elc" . 4554) nil>() call-interactively(ielm-return) # (condition-case ... . error) # (catch top-level ...) Abort (core dumped) GNU gdb 5.0 Copyright 2000 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and yo= u are welcome to change it and/or distribute copies of it under certain condi= tions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for deta= ils. This GDB was configured as "i386-pc-solaris2.7"... Core was generated by `./src/xemacs'. Program terminated with signal 6, Abort. Reading symbols from /usr/dt/lib/libXm.so.4...done. Loaded symbols for /usr/dt/lib/libXm.so.4 Reading symbols from /usr/dt/lib/libtt.so.2...done. Loaded symbols for /usr/dt/lib/libtt.so.2 Reading symbols from /usr/openwin/lib/libXmu.so.4...done. Loaded symbols for /usr/openwin/lib/libXmu.so.4 Reading symbols from /usr/openwin/lib/libXt.so.4...done. Loaded symbols for /usr/openwin/lib/libXt.so.4 Reading symbols from /usr/openwin/lib/libXext.so.0...done. Loaded symbols for /usr/openwin/lib/libXext.so.0 Reading symbols from /usr/openwin/lib/libX11.so.4...done. Loaded symbols for /usr/openwin/lib/libX11.so.4 Reading symbols from /usr/lib/libcurses.so.1...done. Loaded symbols for /usr/lib/libcurses.so.1 Reading symbols from /usr/lib/libldap.so.3...done. Loaded symbols for /usr/lib/libldap.so.3 Reading symbols from /usr/lib/libm.so.1...done. Loaded symbols for /usr/lib/libm.so.1 Reading symbols from /usr/lib/libsocket.so.1...done. Loaded symbols for /usr/lib/libsocket.so.1 Reading symbols from /usr/lib/libnsl.so.1...done. Loaded symbols for /usr/lib/libnsl.so.1 Reading symbols from /usr/lib/libgen.so.1...done. Loaded symbols for /usr/lib/libgen.so.1 Reading symbols from /usr/lib/libdl.so.1...done. Loaded symbols for /usr/lib/libdl.so.1 Reading symbols from /usr/lib/libc.so.1...done. Loaded symbols for /usr/lib/libc.so.1 Reading symbols from /usr/openwin/lib/libSM.so.6...done. Loaded symbols for /usr/openwin/lib/libSM.so.6 Reading symbols from /usr/openwin/lib/libICE.so.6...done. Loaded symbols for /usr/openwin/lib/libICE.so.6 Reading symbols from /usr/lib/libresolv.so.2...done. Loaded symbols for /usr/lib/libresolv.so.2 Reading symbols from /usr/lib/libmp.so.2...done. Loaded symbols for /usr/lib/libmp.so.2 #0 0xdf79e0f4 in _libc_kill () from /usr/lib/libc.so.1 (gdb) where #0 0xdf79e0f4 in _libc_kill () from /usr/lib/libc.so.1 #1 0xdf79dad4 in kill () from /usr/lib/libc.so.1 #2 0x80be619 in fatal_error_signal (sig=3D6) at emacs.c:535 #3 0xdf74fb45 in sigacthandler () from /usr/lib/libc.so.1 #4 <signal handler called> #5 0xdf79e0f4 in _libc_kill () from /usr/lib/libc.so.1 #6 0xdf7513f7 in abort () from /usr/lib/libc.so.1 #7 0x80c10c5 in assert_failed (file=3D0x824a44f "eval.c", line=3D1885,= =20 expr=3D0x824a447 "abort()") at emacs.c:3305 #8 0x80c2865 in signal_1 (sig=3D137250940, data=3D137250820) at eval.c= :1885 #9 0x80c4359 in signal_quit () at eval.c:2052 #10 0x810dc50 in internal_equal (obj1=3D141542208, obj2=3D137250820, de= pth=3D0) at fns.c:2649 #11 0x812060d in image_instance_changed (subwindow=3D141834624) at glyp= hs.c:4587 #12 0x815e343 in compare_runes (w=3D0x85b0c00, crb=3D0x8744100, drb=3D0= x8730000) at redisplay-output.c:270 #13 0x815e4aa in compare_display_blocks (w=3D0x85b0c00, cdl=3D0x8731000= , ddl=3D0x8678000,=20 c_block=3D0, d_block=3D0, start_pixpos=3D6, cursor_start=3D0, curso= r_width=3D0,=20 cursor_height=3D0) at redisplay-output.c:473 #14 0x815ec8b in output_display_line (w=3D0x85b0c00, cdla=3D0x8756500, = ddla=3D0x8756520,=20 line=3D0, force_start=3D-1, force_end=3D-1) at redisplay-output.c:7= 70 #15 0x812e797 in output_gutter (f=3D0x85a1200, pos=3DBOTTOM_GUTTER, for= ce=3D0) at gutter.c:444 #16 0x812ebb0 in update_frame_gutters (f=3D0x85a1200) at gutter.c:634 #17 0x812f523 in Fredisplay_gutter_area () at gutter.c:1082 #18 0x80c589a in Ffuncall (nargs=3D1, args=3D0x8045af4) at eval.c:3528 #19 0x80a1c8b in execute_optimized_program ( program=3D0x8743b90 "\r=AC\004=C6 \025\n＠\211\031A\036\020\b\t＠a=AB= %\t\f=A1\210\016\020\fk=AB\020=C7\016\021=C8\013#\210=C9=CA\r!!\210=AA\= a=CB\f\013\r#\210=CC \210=AA\r\b\fB\nB\022=CB\f\013\r#\210=CD \210\013=CE= a=AD\004=CF\b!*\207", stack_depth=3D5, constants_data=3D0x84d0e10) at b= ytecode.c:746 #20 0x80a1997 in funcall_compiled_function (fun=3D139116348, nargs=3D4,= args=3D0x8045c38) at bytecode.c:515 #21 0x80c5a5b in Ffuncall (nargs=3D5, args=3D0x8045c34) at eval.c:3563 #22 0x80a1c8b in execute_optimized_program ( program=3D0x86fcb90 "\f=C5a=AB\a=C6\n\t\013#\207=C7=C8\013\"=AB\004= \b=AB\026=C9\n\t\f=CAa=AB\004=CB=AA\a=CC\f=CD=A5=CE\"P\013#\207=CF\n\t\= f\013$\207\026=C8o\b", stack_depth=3D6, constants_data=3D0x84d0d90) at bytecode.c:746 #23 0x80a1997 in funcall_compiled_function (fun=3D139116432, nargs=3D3,= args=3D0x8045d78) at bytecode.c:515 #24 0x80c5a5b in Ffuncall (nargs=3D4, args=3D0x8045d74) at eval.c:3563 #25 0x80a1c8b in execute_optimized_program ( program=3D0x86fcbd0 "\212\013=AC\f\n=AC\t=C5=C6\t=C5\"\210=AA\017=C7= =C8\013\n#\034=C9\t\f\b#\210\f))\207n to use to find \026=C8o\b\200=C5r= \b", stack_depth=3D4, constants_data=3D0x84add50) at bytecode.c:746 #26 0x80a1997 in funcall_compiled_function (fun=3D139118596, nargs=3D3,= args=3D0x8045e20) at bytecode.c:515 #27 0x80c51d9 in Feval (form=3D139428840) at eval.c:3388 #28 0x80cbb04 in Fwhile (args=3D139429224) at eval.c:775 #29 0x80c4e67 in Feval (form=3D139429848) at eval.c:3304 #30 0x80c58ab in Ffuncall (nargs=3D2, args=3D0x8046124) at eval.c:3528 #31 0x80a1c8b in execute_optimized_program ( program=3D0x8046180 "\f\013\np\035\031\030\036\a=C6\016\b!\026\tp\0= 26\n\rq\210,=C6\207=D0's\b=E5X\f\b=C4\e=C5\n!\211\023＠\021\013A\020)=C4= \207\b\002", stack_depth=3D4,=20 constants_data=3D0x8732750) at bytecode.c:746 #32 0x80a3b2a in Fbyte_code (instructions=3D141646996, constants=3D1417= 64416,=20 stack_depth=3D9) at bytecode.c:2403 #33 0x80c4f65 in Feval (form=3D141958756) at eval.c:3331 #34 0x80c2775 in condition_case_3 (bodyform=3D141958756, var=3D13837013= 2,=20 handlers=3D141958648) at eval.c:1651 #35 0x80a2586 in execute_rare_opcode (stack_ptr=3D0x80465dc,=20 program_ptr=3D0x87e125c "\210,=AA\005=D2\024=D3\021\n\013a=AC\b=D4=D5= \n\"\210\n\023\016 b\210\f=AC\006=CA=D6=D7\217\210\f=AB\024\016'=AB\004= =D8 \210\r=D9\f=DAR\211\025\tP\025=AA\f\016\037\026\"\016\036\026\037\t= \026\036\r=DBP\025\b=AB\006\r\016(P\025=DC=DD \r\".\a\207", opcode=3D<e= rror type>) at bytecode.c:1271 #36 0x80a1b17 in execute_optimized_program ( program=3D0x87e1210 "=C6\211\211\211=C7\013=C8 \036 \032\035\034\03= 1\036!\036#\b=AB}=C9\b!=ACx=CA=CB=CC\217\210\f=AC3=CD\013!=AC\t=CE\021=CF= \024p\022=AA&=C9\b\016!=C6O!=AB\031\016\036\016\037\016\"\036$\036%\036= &\212\013q\210=CA=D0=D1\217\210,=AA\005=D2\024=D3\021\n\013a=AC\b=D4=D5= \n\"\210\n\023\016 b\210\f=AC\006=CA=D6=D7\217\210\f=AB\024\016'=AB\004= =D8 \210\r=D9\f=DAR\211\025\tP\025=AA\f\016\037\026\"\016\036\026\037\t= \026\036\r=DBP\025\b=AB\006\r\016(P\025=DC=DD \r\".\a\207", stack_depth= =3D8,=20 constants_data=3D0x87e1c10) at bytecode.c:656 #37 0x80a1997 in funcall_compiled_function (fun=3D141939588, nargs=3D1,= args=3D0x8046728) at bytecode.c:515 #38 0x80c5a5b in Ffuncall (nargs=3D2, args=3D0x8046724) at eval.c:3563 #39 0x80a1c8b in execute_optimized_program ( program=3D0x87e0fd0 "p=C2\031\030=C3 \210=C4\t!*\207", stack_depth=3D= 2,=20 constants_data=3D0x8732890) at bytecode.c:746 #40 0x80a1997 in funcall_compiled_function (fun=3D141939476, nargs=3D0,= args=3D0x8046858) at bytecode.c:515 #41 0x80c5a5b in Ffuncall (nargs=3D1, args=3D0x8046854) at eval.c:3563 #42 0x80a1c8b in execute_optimized_program ( program=3D0x87cf310 "\n=AB6\212=C4\177\210=C5=C6 `\")\211\e＠=C7W=AB= \n=C8\0138=AC\005=C9 =AA\032\t=AB\025\212=CAy\210=CB\b!)=AB\013\212=C6 = b\210=CC=C7!\210)=CD )\207=CC \207\b\024\006J\b0\006J\bL\006J\bh\006J\b= \204\006J\b=A0\006J\b=BC\006J\b=D8\006J\b=F4\006J\b\020\aJ\bs", stack_d= epth=3D4,=20 constants_data=3D0x8774b90) at bytecode.c:746 #43 0x80a1997 in funcall_compiled_function (fun=3D141939420, nargs=3D0,= args=3D0x80469c4) at bytecode.c:515 #44 0x80c5a5b in Ffuncall (nargs=3D1, args=3D0x80469c0) at eval.c:3563 #45 0x80ca633 in apply1 (fn=3D141939420, arg=3D137250820) at eval.c:415= 2 #46 0x80a45eb in Fcall_interactively (function=3D141941340, record_flag= =3D137250820,=20 keys=3D137250820) at callint.c:397 #47 0x80c4554 in Fcommand_execute (cmd=3D141941340, record_flag=3D13725= 0820,=20 keys=3D137250820) at eval.c:2970 #48 0x80ef36d in execute_command_event (command_builder=3D0x856e380, ev= ent=3D142212468) at event-stream.c:3915 #49 0x80ef9f3 in Fdispatch_event (event=3D142212468) at event-stream.c:= 4247 #50 0x80a9bf8 in Fcommand_loop_1 () at cmdloop.c:583 #51 0x80a9e59 in command_loop_1 (dummy=3D137250820) at cmdloop.c:494 #52 0x80cb1da in condition_case_1 (handlers=3D137250916,=20 bfun=3D0x80a9e40 <command_loop_1>, barg=3D137250820, hfun=3D0x80a9e= c8 <cmd_error>,=20 harg=3D137250820) at eval.c:1651 #53 0x80a9fb7 in command_loop_2 (dummy=3D137250820) at cmdloop.c:256 #54 0x80cb0a8 in internal_catch (tag=3D137330860, func=3D0x80a9f7c <com= mand_loop_2>,=20 arg=3D137250820, threw=3D0x0) at eval.c:1317 #55 0x80a9942 in initial_command_loop (load_me=3D137250820) at cmdloop.= c:305 #56 0x80bf7aa in xemacs_21_4_3_i386_pc_solaris2_7 () at emacs.c:2344 #57 0x80c1329 in main () at emacs.c:2773 #58 0x80955f7 in _start ()