bug#23704: 25.1.50; Emacs crash in syntax.c

[Eli Zaretskii]

> From: Andreas Schwab <schwab@suse.de>
> Date: Mon, 06 Jun 2016 09:36:07 +0200
> Cc: 23704@debbugs.gnu.org
> 
> > 2233                  if (! fastmap[SYNTAX (*p)])
> 
> I think I have seen a similar crash with the emacs-25 branch as well,
> but only once, and I couldn't reproduce it so far.

If my reading of the code is correct, we have pointers to buffer text
and the gap lying around, while invoking code that can GC (which
compacts buffers).  For example, the sequence of calls

   SETUP_SYNTAX_TABLE
    -> SETUP_BUFFER_SYNTAX_TABLE
        -> update_syntax_table_forward
           -> parse_sexp_propertize

could call Lisp, and that happens after we already computed the values
of p, endp, and stop.  Likewise the call to UPDATE_SYNTAX_TABLE_FORWARD
we make inside the loop.

If GC decides to compact the gap, it could well make a previously
valid pointer invalid.

Could that be the reason?