segment fault when doing fiplr-find-file in console

[ghost]

Emacs: Emacs 24.4.50.1

When doing fiplr-find-file in console, and typing into minibuffer, it has a 90% chance to trigger a segment fault.

bt full

Program received signal SIGSEGV, Segmentation fault.
__memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:35
35      ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S: No such file or directory.
(gdb) bt full
#0  __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:35
No locals.
#1  0x000000000041ac33 in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string3.h:51
No locals.
#2  build_frame_matrix_from_leaf_window (frame_matrix=<optimized out>, w=0xbbee40) at dispnew.c:2410
        frame_row = 0xe68d90
        window_row = 0x504b110
        current_row_p = <optimized out>
        window_matrix = 0xbc2660
        window_y = 9
        frame_y = <optimized out>
        right_border_glyph = {ch = 0, face_id = 0}
#3  build_frame_matrix_from_window_tree (matrix=<optimized out>, w=0xbbee40) at dispnew.c:2326
No locals.
#4  0x000000000041b075 in build_frame_matrix (f=0xbbea88) at dispnew.c:2310
        i = <optimized out>
#5  update_frame (f=f@entry=0xbbea88, force_p=<optimized out>, force_p@entry=false, inhibit_hairy_id_p=inhibit_hairy_id_p@entry=false) at dispnew.c:3069
        paused_p = <optimized out>
#6  0x00000000004487a7 in redisplay_internal () at xdisp.c:13842
        gcscrollbars = <optimized out>
        w = <optimized out>
        sw = <optimized out>
        pending = <optimized out>
        must_finish = <optimized out>
        match_p = <optimized out>   
        tlbufpos = <optimized out>  
        tlendpos = <optimized out>  
        number_of_visible_frames = <optimized out>
        sf = <optimized out>
        polling_stopped_here = 1
        tail = 12207350
        consider_all_windows_p = <optimized out>
        update_miniwindow_p = false 
#7  0x000000000044a585 in redisplay () at xdisp.c:13088
No locals.
#8  0x00000000004e2e81 in read_char (commandflag=1, map=map@entry=85819542, prev_event=12234930, used_mouse_menu=used_mouse_menu@entry=0x7fffb2e5162b, end_time=end_time@entry=0x0) at keyboard.c:2571
        c = <optimized out>
        local_getcjmp = {{__jmpbuf = {2, 5540116, 103906550, 73686369, 140736194745392, 5539925, 51633232, 51634576}, __mask_was_saved = 72053232, __saved_mask = {__val = {72046950, 12234930, 16599677209975818496, 12234930, 2, 69097250, 12234930,
                89110928, 5489692, 12267506, 89110928, 1, 16493920, 16628816, 5468742, 2}}}}
        save_jump = {{__jmpbuf = {40, 5347838208, 12234930, 3, 89110933, 17, 17, 0}, __mask_was_saved = -1293609688, __saved_mask = {__val = {12234930, 12234930, 90888598, 5, 39, 12234978, 18446744073709551608, 12234930, 85819670,
                18446744073709551608, 5163526, 12216038, 12234930, 85825014, 53920368, 132835488}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 12234930
        also_record = 12234930
        reread = false
        polling_stopped_here = false
        orig_kboard = 0x127be50
#9  0x00000000004e47f3 in read_key_sequence (keybuf=keybuf@entry=0x7fffb2e51700, prompt=12234930, dont_downcase_last=dont_downcase_last@entry=false, can_return_switch_frame=can_return_switch_frame@entry=true,
    fix_current_buffer=fix_current_buffer@entry=true, prevent_redisplay=prevent_redisplay@entry=false, bufsize=30) at keyboard.c:9094
        interrupted_kboard = 0x127be50
        interrupted_frame = 0xbbea88
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = <optimized out>
        keys_local_start = <optimized out>
        new_binding = <optimized out>
        t = <optimized out>
        echo_start = 0
        keys_start = 0
        current_binding = 85819542  
        first_event = 12234930
        first_unbound = 31
        mock_input = 0
etc etc

bt

#0  __memcpy_sse2_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-sse2-unaligned.S:35
#1  0x000000000041ac33 in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string3.h:51
#2  build_frame_matrix_from_leaf_window (frame_matrix=<optimized out>, w=0xbbee40) at dispnew.c:2410
#3  build_frame_matrix_from_window_tree (matrix=<optimized out>, w=0xbbee40) at dispnew.c:2326
#4  0x000000000041b075 in build_frame_matrix (f=0xbbea88) at dispnew.c:2310
#5  update_frame (f=f@entry=0xbbea88, force_p=<optimized out>, force_p@entry=false, inhibit_hairy_id_p=inhibit_hairy_id_p@entry=false) at dispnew.c:3069
#6  0x00000000004487a7 in redisplay_internal () at xdisp.c:13842
#7  0x000000000044a585 in redisplay () at xdisp.c:13088
#8  0x00000000004e2e81 in read_char (commandflag=1, map=map@entry=85819542, prev_event=12234930, used_mouse_menu=used_mouse_menu@entry=0x7fffb2e5162b, end_time=end_time@entry=0x0) at keyboard.c:2571
#9  0x00000000004e47f3 in read_key_sequence (keybuf=keybuf@entry=0x7fffb2e51700, prompt=12234930, dont_downcase_last=dont_downcase_last@entry=false, can_return_switch_frame=can_return_switch_frame@entry=true,
    fix_current_buffer=fix_current_buffer@entry=true, prevent_redisplay=prevent_redisplay@entry=false, bufsize=30) at keyboard.c:9094
#10 0x00000000004e6430 in command_loop_1 () at keyboard.c:1446
#11 0x0000000000547dee in internal_condition_case (bfun=bfun@entry=0x4e6240 <command_loop_1>, handlers=<optimized out>, hfun=hfun@entry=0x4dd170 <cmd_error>) at eval.c:1354
#12 0x00000000004d897e in command_loop_2 (ignore=ignore@entry=12234930) at keyboard.c:1171
#13 0x0000000000547cfb in internal_catch (tag=12359266, func=func@entry=0x4d8960 <command_loop_2>, arg=12234930) at eval.c:1118
#14 0x00000000004dcd23 in command_loop () at keyboard.c:1142
#15 recursive_edit_1 () at keyboard.c:771
#16 0x0000000000505307 in read_minibuf (map=map@entry=12216038, initial=initial@entry=12234930, prompt=<optimized out>, prompt@entry=67682177, expflag=<optimized out>, histvar=histvar@entry=12399954, histpos=0, defalt=defalt@entry=12234930,
    allow_props=false, inherit_input_method=false) at minibuf.c:674
#17 0x000000000050596e in Fread_from_minibuffer (prompt=67682177, initial_contents=12234930, keymap=12216038, read=12234930, hist=<optimized out>, default_value=12234930, inherit_input_method=12234930) at minibuf.c:957
#18 0x0000000000548e03 in eval_sub (form=<optimized out>) at eval.c:2209
#19 0x00000000005491a5 in Fprogn (body=16913) at eval.c:468
#20 0x0000000000548f8b in eval_sub (form=<optimized out>) at eval.c:2133
#21 0x000000000054bedf in Funwind_protect (args=72050838) at eval.c:1215
#22 0x0000000000548f8b in eval_sub (form=<optimized out>) at eval.c:2133
#23 0x00000000005491a5 in Fprogn (body=16913) at eval.c:468
#24 0x000000000054bd85 in Flet (args=71895206) at eval.c:976
#25 0x0000000000548f8b in eval_sub (form=<optimized out>) at eval.c:2133
#26 0x00000000005491a5 in Fprogn (body=16913) at eval.c:468
#27 0x000000000054953c in funcall_lambda (fun=fun@entry=71895142, nargs=nargs@entry=2, arg_vector=arg_vector@entry=0x7fffb2e51e20) at eval.c:3042
#28 0x0000000000548914 in apply_lambda (fun=71895142, args=<optimized out>) at eval.c:2924
#29 0x0000000000548c9e in eval_sub (form=<optimized out>) at eval.c:2260
#30 0x00000000005491a5 in Fprogn (body=16913) at eval.c:468
#31 0x0000000000548f8b in eval_sub (form=<optimized out>) at eval.c:2133
#32 0x000000000054bedf in Funwind_protect (args=72154838) at eval.c:1215
#33 0x0000000000548f8b in eval_sub (form=<optimized out>) at eval.c:2133
#34 0x00000000005491a5 in Fprogn (body=16913) at eval.c:468
#35 0x000000000054bd85 in Flet (args=72153910) at eval.c:976
#36 0x0000000000548f8b in eval_sub (form=<optimized out>) at eval.c:2133
#37 0x000000000054ba30 in FletX (args=72153526) at eval.c:881
#38 0x0000000000548f8b in eval_sub (form=<optimized out>) at eval.c:2133
#39 0x00000000005491a5 in Fprogn (body=16913) at eval.c:468
#40 0x000000000054953c in funcall_lambda (fun=fun@entry=72153494, nargs=nargs@entry=2, arg_vector=arg_vector@entry=0x7fffb2e52460) at eval.c:3042
#41 0x0000000000548914 in apply_lambda (fun=72153494, args=<optimized out>) at eval.c:2924
#42 0x0000000000548c9e in eval_sub (form=<optimized out>) at eval.c:2260
#43 0x00000000005491a5 in Fprogn (body=16913) at eval.c:468
#44 0x000000000054953c in funcall_lambda (fun=72092230, nargs=nargs@entry=0, arg_vector=arg_vector@entry=0x7fffb2e52870) at eval.c:3042
#45 0x00000000005497ab in Ffuncall (nargs=nargs@entry=1, args=args@entry=0x7fffb2e52868) at eval.c:2876
#46 0x000000000054534a in Ffuncall_interactively (nargs=1, args=0x7fffb2e52868) at callint.c:250
#47 0x000000000054988a in Ffuncall (nargs=nargs@entry=2, args=args@entry=0x7fffb2e52860) at eval.c:2796
#48 0x000000000054abec in Fapply (nargs=nargs@entry=3, args=args@entry=0x7fffb2e52860) at eval.c:2297
#49 0x0000000000545918 in Fcall_interactively (function=69098418, record_flag=12234930, keys=12269917) at callint.c:399
#50 0x0000000000549978 in Ffuncall (nargs=<optimized out>, args=<optimized out>) at eval.c:2822
#51 0x000000000057dff5 in exec_byte_code (bytestr=156692447, vector=156721312, maxdepth=11952, args_template=4100, nargs=140736194750816, args=0x4) at bytecode.c:918
#52 0x00000000005494d7 in funcall_lambda (fun=0, nargs=nargs@entry=1, arg_vector=0x905d89 <pure+916521>, arg_vector@entry=0x7fffb2e52ab8) at eval.c:2983
#53 0x00000000005497ab in Ffuncall (nargs=nargs@entry=2, args=args@entry=0x7fffb2e52ab0) at eval.c:2876
#54 0x0000000000549ada in call1 (fn=<optimized out>, arg1=<optimized out>) at eval.c:2614
#55 0x00000000004e65cd in command_loop_1 () at keyboard.c:1553
#56 0x0000000000547dee in internal_condition_case (bfun=bfun@entry=0x4e6240 <command_loop_1>, handlers=<optimized out>, hfun=hfun@entry=0x4dd170 <cmd_error>) at eval.c:1354
#57 0x00000000004d897e in command_loop_2 (ignore=ignore@entry=12234930) at keyboard.c:1171
#58 0x0000000000547cfb in internal_catch (tag=12282386, func=func@entry=0x4d8960 <command_loop_2>, arg=12234930) at eval.c:1118
#59 0x00000000004dcd97 in command_loop () at keyboard.c:1150
#60 recursive_edit_1 () at keyboard.c:771
#61 0x00000000004dd0ad in Frecursive_edit () at keyboard.c:842
#62 0x0000000000412445 in main (argc=<optimized out>, argv=0x7fffb2e52e58) at emacs.c:1656

It's likely to be a bug in emacs, but it only happens for fiplr so far on my machine :(