bug#39962: 27.0.90; Crash in Emacs 27.0.90

[Eli Zaretskii]

> From: Pieter van Oostrum <pieter-l@vanoostrum.org>
> Cc: Eli Zaretskii <eliz@gnu.org>,  39962@debbugs.gnu.org,  eggert@cs.ucla.edu
> Date: Tue, 17 Mar 2020 04:29:09 +0100
> 
> ./lisp.h:2623: Emacs fatal error: assertion failed: MARKERP (a)
> 
> Thread 3 hit Breakpoint 1, terminate_due_to_signal (sig=6, 
>     backtrace_limit=2147483647) at emacs.c:371
> 371     signal (sig, SIG_DFL);
> (gdb) bt
> #0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at emacs.c:371
> #1  0x00000001002a4b2b in die (msg=0x1004f65cc "MARKERP (a)", 
>     file=0x1004f0449 "./lisp.h", line=2623) at alloc.c:7249
> #2  0x000000010023c21f in XMARKER (a=XIL(0x12590f575)) at ./lisp.h:2623
> #3  0x000000010023cdc5 in marker_position (marker=XIL(0x12590f575))
>     at marker.c:691
> #4  0x0000000100221335 in OVERLAY_POSITION (p=XIL(0x12590f575))
>     at ./buffer.h:1394
> #5  0x00000001002268d7 in report_overlay_modification (
>     start=make_fixnum(40255), end=make_fixnum(40255), after=false, 
>     arg1=make_fixnum(40255), arg2=make_fixnum(40255), arg3=XIL(0))
>     at buffer.c:4496

This is here:

      /* We are being called before a change.
         Scan the overlays to find the functions to call.  */
      last_overlay_modification_hooks_used = 0;
      for (struct Lisp_Overlay *tail = current_buffer->overlays_before;
           tail; tail = tail->next)
        {
          ptrdiff_t startpos, endpos;
          Lisp_Object ostart, oend;

          Lisp_Object overlay = make_lisp_ptr (tail, Lisp_Vectorlike);

          ostart = OVERLAY_START (overlay);
          oend = OVERLAY_END (overlay);
          endpos = OVERLAY_POSITION (oend); <<<<<<<<<<<<<<<<
          if (XFIXNAT (start) > endpos)
            break;
          startpos = OVERLAY_POSITION (ostart);

Are this overlay's other fields valid?  E.g., what about ostart -- is
it a valid marker, and if so, what buffer does it point to? is that
buffer identical to current_buffer?

Also, can you go through this linked list of the overlays (it starts
at current_buffer->overlays_before), and see if there are other
overlays there that are similarly invalid?  Likewise with overlays
that start at current_buffer->overlays_after.

And what is current_buffer, anyway?  Any idea what are those overlays
in that buffer?

Btw, note that we again have mapatoms in the backtrace -- it
definitely has something to do with this.

Thanks.