Subject: bug#35429: 27.0.50; Arbitrary xdisp.c related crashes when working with overlay-using packages

From: Eli Zaretskii <[email-masked]>
Date: Fri, 26 Apr 2019 22:04:54 +0300

> From: Kaushal Modi <[email-masked]>
> Date: Fri, 26 Apr 2019 14:34:38 -0400
> Cc: [email-masked]
> 
> (gdb) fr 2
> #2  0x0000000000456b44 in init_iterator (it=it@entry=0x7fffffff3040, w=w@entry=0x89da880, charpos=2874,
>     bytepos=<optimized out>, row=<optimized out>,
> base_face_id=base_face_id@entry=DEFAULT_FACE_ID)
>     at xdisp.c:3047
> 3047          eassert (charpos == BYTE_TO_CHAR (bytepos));
> (gdb) p w->start
> $13 = XIL(0x89daa95)
> (gdb) xmarker
> $14 = (struct Lisp_Marker *) 0x89daa90
> (gdb) p *$
> $15 = {
>   header = {
>     size = 4611686018477740032
>   },
>   buffer = 0x8d95c10,
>   need_adjustment = false,
>   insertion_type = false,
>   next = 0x89daaf0,
>   charpos = 2874,
>   bytepos = 2874
> }
> (gdb) 

So the window's start point is outdated.  How did that happen?  What
kind of stuff do you have on window-scroll-functions?  This should
show us:

  (gdb) pp Vwindow_scroll_functions

Also, what buffer does the window-start marker record?

  (gdb) fr 2
  (gdb) p w->start
  (gdb) xmarker
  (gdb) p $->buffer->name_
  (gdb) xstring