[bug] crash using M-% in indirect buffer.

This is Finnish Landrace with 2 of Hrvoje's indirect buffer patches applied. I was using `c-comment-edit', made an indirect buffer of the comment, which contained a scheme define, switched to the new indirect buffer, and threw it into scheme mode with font lock on. I tried to use M-% to change a variable name in the scheme, and XEmacs exited with a stack trace and core dump. I just verified that this is reproducable; it happens right when I push `y' to replace the first blue highlighted match. I'm not running `-vanilla', but don't feel that it would matter in this case. (obviously tell me if I'm wrong.) Fatal error: assertion failed, file insdel.c, line 2241, orig_end >= buf->text->changes->mc_begin && orig_end <= buf->text->changes->mc_new_end Fatal error (6). Your files have been auto-saved. [...] Lisp backtrace follows: # (unwind-protect ...) replace-match("tails" nil t) # bind (help-form done replaced def) # (unwind-protect ...) # bind (message qr-case-fold-search match-again limit lastrepl replace-count next-rotate-count stack keep-going replacement-index next-replacement real-match-data search-string search-function literal nocasify event map repeat-count delimited-flag regexp-flag query-flag replacements from-string) perform-replace("new-tails" "tails" t nil nil) # bind (delimited to-string from-string) #<compiled-function (from-string to-string &optional delimited) "...(8)" [perform-replace from-string to-string t nil delimited] 6 580195 (query-replace-read-args "Query replace" nil)>("new-tails" "tails" nil) call-interactively(query-replace) # (condition-case ... . error) # (catch top-level ...) /usr/local/bin/xg: line 7: 8479 Aborted (core dumped) xemacs -f gnuserv-start "$＠" Knowledge is power. -- Francis Bacon karlheg＠bittersweet:~ % gdb xemacs core GNU gdb 4.17.m68k.objc.threads.hwwp.fpu.gnat Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i586-pc-linux-gnu"... Core was generated by `xemacs -f gnuserv-start'. Program terminated with signal 6, Aborted. Reading symbols from /usr/X11R6/lib/neXtaw/libXaw.so.6...done. Reading symbols from /usr/lib/libcompface.so.1...done. Reading symbols from /usr/lib/libtiff.so.3...done. Reading symbols from /usr/lib/libpng.so.2...done. Reading symbols from /usr/lib/libjpeg.so.6a...done. Reading symbols from /usr/lib/libz.so.1...done. Reading symbols from /usr/X11R6/lib/libXpm.so.4...done. Reading symbols from /usr/X11R6/lib/libXmu.so.6...done. Reading symbols from /usr/X11R6/lib/libXt.so.6...done. Reading symbols from /usr/X11R6/lib/libXext.so.6...done. Reading symbols from /usr/X11R6/lib/libX11.so.6...done. Reading symbols from /usr/X11R6/lib/libSM.so.6...done. Reading symbols from /usr/X11R6/lib/libICE.so.6...done. Reading symbols from /lib/libdl.so.2...done. ---Type <return> to continue, or q <return> to quit--- Reading symbols from /lib/libdb.so.2...done. Reading symbols from /usr/lib/libgdbm.so.1...done. Reading symbols from /usr/lib/libgpm.so.1...done. Reading symbols from /lib/libncurses.so.3.4...done. Reading symbols from /lib/libm.so.6...done. Reading symbols from /lib/libc.so.6...done. Reading symbols from /lib/ld-linux.so.2...done. Reading symbols from /lib/libnss_files.so.1...done. Reading symbols from /lib/libnss_compat.so.1...done. Reading symbols from /lib/libnsl.so.1...done. #0 0x402d16e1 in kill () (gdb) where #0 0x402d16e1 in kill () #1 0x809f5c1 in fatal_error_signal (sig=6) at emacs.c:262 #2 <signal handler called> #3 0x402d16e1 in kill () #4 0x402d272f in abort () #5 0x809f526 in assert_failed (file=0x8182b01 "insdel.c", line=2241, expr=0x8182bc7 "orig_end >= buf->text->changes->mc_begin && orig_end <= buf->text->changes->mc_new_end") at emacs.c:2605 #6 0x80f4fd8 in signal_after_change (buf=0x89d47f0, start=228, orig_end=237, new_end=228) at insdel.c:2240 #7 0x80f6018 in buffer_delete_range (buf=0x89d47f0, from=228, to=237, flags=0) at insdel.c:2849 #8 0x8127842 in Freplace_match (newtext=142896924, fixedcase=136898052, literal=136898080, string=136898052, strbuffer=136898052) at search.c:2157 #9 0x80a2dca in funcall_recording_as (recorded_as=137008664, nargs=3, args=0xbffff474) at eval.c:3197 #10 0x80a6d17 in Ffuncall (nargs=4, args=0xbffff474) at eval.c:3238 #11 0x8085252 in Fbyte_code (bytestr=135997412, vector=135998248, maxdepth=17) at bytecode.c:416 #12 0x80a3a54 in funcall_lambda (fun=135999240, nargs=5, arg_vector=0xbffff5d4) at eval.c:3597 #13 0x80a2eda in funcall_recording_as (recorded_as=137399908, nargs=5, args=0xbffff5d0) at eval.c:3214 ---Type <return> to continue, or q <return> to quit--- #14 0x80a6d17 in Ffuncall (nargs=6, args=0xbffff5d0) at eval.c:3238 #15 0x8085252 in Fbyte_code (bytestr=135987628, vector=135987724, maxdepth=13) at bytecode.c:416 #16 0x80a3a54 in funcall_lambda (fun=135987764, nargs=3, arg_vector=0xbffff6f4) at eval.c:3597 #17 0x80a2eda in funcall_recording_as (recorded_as=135987764, nargs=3, args=0xbffff6f0) at eval.c:3214 #18 0x80a352c in Fapply (nargs=2, args=0xbffff740) at eval.c:3463 #19 0x80a5e28 in apply1 (fn=135987764, arg=145129352) at eval.c:3895 #20 0x80867ce in Fcall_interactively (function=137399796, record_flag=136898052, keys=136898052) at callint.c:397 #21 0x80a1a7e in Fcommand_execute (cmd=137399796, record=136898052, keys=136898052) at eval.c:2584 #22 0x80c56f2 in execute_command_event (command_builder=0x82f7400, event=144973500) at event-stream.c:4346 #23 0x80c5e2a in Fdispatch_event (event=144973500) at event-stream.c:4685 #24 0x808b4d2 in Fcommand_loop_1 () at cmdloop.c:579 #25 0x808b69a in command_loop_1 (dummy=136898052) at cmdloop.c:494 #26 0x80a69db in condition_case_1 (handlers=136898164, bfun=0x808b684 <command_loop_1>, barg=136898052, hfun=0x808afc4 <cmd_error>, harg=136898052) at eval.c:1653 #27 0x808b774 in command_loop_2 (dummy=136898052) at cmdloop.c:256 #28 0x80a68b5 in internal_catch (tag=136972452, ---Type <return> to continue, or q <return> to quit--- func=0x808b740 <command_loop_2>, arg=136898052, threw=0x0) at eval.c:1328 #29 0x808b20e in initial_command_loop (load_me=136898052) at cmdloop.c:305 #30 0x809e3a5 in xemacs_21_0_i586_pc_linux (argc=3, argv=0xbffffba0, envp=0xbffffbb0, restart=0) at emacs.c:1702 #31 0x809f8f9 in main (argc=3, argv=0xbffffba0, envp=0xbffffbb0) at emacs.c:2119 (gdb) quit karlheg＠bittersweet:~ %