Fix 'insert-file-contents' when REPLACE is non-nil

* src/fileio.c (maybe_move_gap): New function to move the gap to
the end of a buffer, if it isn't there already.
(Finsert_file_contents): Call 'maybe_move_gap' before using
conversion_buffer's text as a C 'char' array.  (Bug#23659)
* src/coding.c (decode_eol): Compute the byte increment before
calling del_range_2, because the latter can invalidate the pointer
to buffer text.

2 files changed, 24 insertions, 4 deletions

diff --git a/src/coding.c b/src/coding.c
index 804b628d3be..29c90f0a401 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -6826,7 +6826,14 @@ decode_eol (struct coding_system *coding)
 
       while (pos_byte < pos_end)
         {
+          int incr;
+
           p = BYTE_POS_ADDR (pos_byte);
+          if (coding->dst_multibyte)
+            incr = BYTES_BY_CHAR_HEAD (*p);
+          else
+            incr = 1;
+
           if (*p == '\r' && p[1] == '\n')
             {
               del_range_2 (pos, pos_byte, pos + 1, pos_byte + 1, 0);
@@ -6834,10 +6841,7 @@ decode_eol (struct coding_system *coding)
               pos_end--;
             }
           pos++;
-          if (coding->dst_multibyte)
-            pos_byte += BYTES_BY_CHAR_HEAD (*p);
-          else
-            pos_byte++;
+          pos_byte += incr;
         }
       coding->produced -= n;
       coding->produced_char -= n;
diff --git a/src/fileio.c b/src/fileio.c
index facc4bef927..b1f9d3cf73a 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -3359,6 +3359,21 @@ restore_window_points (Lisp_Object window_markers, ptrdiff_t inserted,
       }
 }
 
+/* Make sure the gap is at Z_BYTE.  This is required to treat buffer
+   text as a linear C char array.  */
+static void
+maybe_move_gap (struct buffer *b)
+{
+  if (BUF_GPT_BYTE (b) != BUF_Z_BYTE (b))
+    {
+      struct buffer *cb = current_buffer;
+
+      set_buffer_internal (b);
+      move_gap_both (Z, Z_BYTE);
+      set_buffer_internal (cb);
+    }
+}
+
 /* FIXME: insert-file-contents should be split with the top-level moved to
    Elisp and only the core kept in C.  */
 
@@ -3942,6 +3957,7 @@ by calling `format-decode', which see.  */)
 
       coding_system = CODING_ID_NAME (coding.id);
       set_coding_system = true;
+      maybe_move_gap (XBUFFER (conversion_buffer));
       decoded = BUF_BEG_ADDR (XBUFFER (conversion_buffer));
       inserted = (BUF_Z_BYTE (XBUFFER (conversion_buffer))
                   - BUF_BEG_BYTE (XBUFFER (conversion_buffer)));