bug#23221: 25.0.92; Crash in redisplay during isearch

[Andy Moreton <amoreton@solarflare.com>]

Emacs crashed during isearch in a Gnus summary buffer, after doing:
  - open a group
  - reload 2000 old articles ("/ o 2000 RET")
Attaching gdb showed the following backtrace (unfortunately I don't have the
session open any more).

(gdb) bt
#0  0x000007fefd9831f3 in KERNELBASE!DebugBreak () from
C:\windows\system32\KernelBase.dll
#1  0x0000000400290224 in emacs_abort () at ../../src/w32fns.c:9794
#2  0x000000040012fc3b in terminate_due_to_signal (sig=0x16,
backtrace_limit=0x7fffffff) at ../../src/emacs.c:380
#3  0x00000004001c5462 in die (msg=0x4006b3280 <get_next_element+128>
"IT_BYTEPOS (*it) == CHAR_TO_BYTE (IT_CHARPOS (*it))", file=0x4006b1010
<DEFAULT_REHASH_SIZE+8> "../../src/xdisp.c", line=0x1d12) at
../../src/alloc.c:7218
#4  0x0000000400043d79 in set_iterator_to_next (it=0x826840, reseat_p=0x1) at
../../src/xdisp.c:7442
#5  0x0000000400049315 in move_it_in_display_line_to (it=0x826840,
to_charpos=0x1daff, to_x=0xffffffff, op=MOVE_TO_POS) at ../../src/xdisp.c:9012
#6  0x000000040004a669 in move_it_to (it=0x826840, to_charpos=0x1daff,
to_x=0xffffffff, to_y=0xffffffff, to_vpos=0xffffffff, op=0x8) at
../../src/xdisp.c:9333
#7  0x000000040004b0b8 in move_it_vertically_backward (it=0x828f10, dy=0x1d5)
at ../../src/xdisp.c:9526
#8  0x00000004000657e1 in redisplay_window (window=..., just_this_one_p=0x1)
at ../../src/xdisp.c:16820
#9  0x000000040005a798 in redisplay_window_1 (window=...) at
../../src/xdisp.c:14454
#10 0x00000004001e7972 in internal_condition_case_1 (bfun=0x40005a759
<redisplay_window_1>, arg=..., handlers=..., hfun=0x40005a6ce
<redisplay_window_error>) at ../../src/eval.c:1333
#11 0x000000040005981a in redisplay_internal () at ../../src/xdisp.c:14079
#12 0x0000000400059f7c in redisplay_preserve_echo_area (from_where=0x2) at
../../src/xdisp.c:14279
#13 0x0000000400010736 in Fredisplay (force=...) at ../../src/dispnew.c:5791
#14 0x00000004001eb5b0 in Ffuncall (nargs=0x1, args=0x82bae0) at
../../src/eval.c:2693
#15 0x00000004002400f1 in exec_byte_code (bytestr=..., vector=...,
maxdepth=..., args_template=..., nargs=0x1, args=0x82c378) at
../../src/bytecode.c:880
#16 0x00000004001ebf18 in funcall_lambda (fun=..., nargs=0x1,
arg_vector=0x82c370) at ../../src/eval.c:2855
#17 0x00000004001eb83d in Ffuncall (nargs=0x2, args=0x82c368) at
../../src/eval.c:2742
#18 0x00000004002400f1 in exec_byte_code (bytestr=..., vector=...,
maxdepth=..., args_template=..., nargs=0x0, args=0x0) at ../../src/bytecode.c:880
#19 0x00000004001ec36f in funcall_lambda (fun=..., nargs=0x0,
arg_vector=0x40047a74d <pure+1451565>) at ../../src/eval.c:2921
#20 0x00000004001eb83d in Ffuncall (nargs=0x1, args=0x82cbf8) at
../../src/eval.c:2742
#21 0x00000004002400f1 in exec_byte_code (bytestr=..., vector=...,
maxdepth=..., args_template=..., nargs=0x0, args=0x0) at ../../src/bytecode.c:880
#22 0x00000004001ec36f in funcall_lambda (fun=..., nargs=0x0,
arg_vector=0x400470ccd <pure+1412013>) at ../../src/eval.c:2921
#23 0x00000004001eb83d in Ffuncall (nargs=0x1, args=0x82d488) at
../../src/eval.c:2742
#24 0x00000004002400f1 in exec_byte_code (bytestr=..., vector=...,
maxdepth=..., args_template=..., nargs=0x0, args=0x0) at ../../src/bytecode.c:880
#25 0x00000004001ec36f in funcall_lambda (fun=..., nargs=0x1,
arg_vector=0x40047440d <pure+1426157>) at ../../src/eval.c:2921
#26 0x00000004001eb83d in Ffuncall (nargs=0x2, args=0x82dd18) at
../../src/eval.c:2742
#27 0x00000004002400f1 in exec_byte_code (bytestr=..., vector=...,
maxdepth=..., args_template=..., nargs=0x0, args=0x0) at ../../src/bytecode.c:880
#28 0x00000004001ec36f in funcall_lambda (fun=..., nargs=0x0,
arg_vector=0x40047455d <pure+1426493>) at ../../src/eval.c:2921
#29 0x00000004001eb83d in Ffuncall (nargs=0x1, args=0x82e908) at
../../src/eval.c:2742
#30 0x00000004001e0d09 in Ffuncall_interactively (nargs=0x1, args=0x82e908) at
../../src/callint.c:248
#31 0x00000004001eb462 in Ffuncall (nargs=0x2, args=0x82e900) at
../../src/eval.c:2673
#32 0x00000004001ea3e9 in Fapply (nargs=0x3, args=0x82e900) at
../../src/eval.c:2274
#33 0x00000004001e126f in Fcall_interactively (function=..., record_flag=...,
keys=...) at ../../src/callint.c:385
#34 0x00000004001eb615 in Ffuncall (nargs=0x4, args=0x82ebe8) at
../../src/eval.c:2700
#35 0x00000004002400f1 in exec_byte_code (bytestr=..., vector=...,
maxdepth=..., args_template=..., nargs=0x1, args=0x82f490) at
../../src/bytecode.c:880
#36 0x00000004001ebf18 in funcall_lambda (fun=..., nargs=0x1,
arg_vector=0x82f488) at ../../src/eval.c:2855
#37 0x00000004001eb83d in Ffuncall (nargs=0x2, args=0x82f480) at
../../src/eval.c:2742
#38 0x00000004001eaf3f in call1 (fn=..., arg1=...) at ../../src/eval.c:2552
#39 0x000000040013573b in command_loop_1 () at ../../src/keyboard.c:1471
#40 0x00000004001e78c2 in internal_condition_case (bfun=0x400134d6c
<command_loop_1>, handlers=..., hfun=0x4001341b7 <cmd_error>) at
../../src/eval.c:1309
#41 0x00000004001348f5 in command_loop_2 (ignore=...) at ../../src/keyboard.c:1099
#42 0x00000004001e6d97 in internal_catch (tag=..., func=0x4001348c3
<command_loop_2>, arg=...) at ../../src/eval.c:1074
#43 0x0000000400134848 in command_loop () at ../../src/keyboard.c:1078
#44 0x0000000000000000 in ?? ()
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
"redisplay" (0x82bae8)
"sit-for" (0x82c370)
"isearch-lazy-highlight-new-loop" (0x82cc00)
"isearch-update" (0x82d490)
"isearch-repeat" (0x82dd20)
"isearch-repeat-forward" (0x82e910)
"funcall-interactively" (0x82e908)
"call-interactively" (0x82ebf0)
"command-execute" (0x82f488)


In GNU Emacs 25.0.92.19 (x86_64-w64-mingw32)
  of 2016-04-05 built on AJM-DESKTOP
Repository revision: a05fb21d73d2ca84dd7e5e7ee931931048ecddba
Windowing system distributor 'Microsoft Corp.', version 6.1.7601
Configured using:
  'configure --prefix=/c/emacs/emacs-25 --build=x86_64-w64-mingw32
  --without-dbus --enable-checking --enable-check-lisp-object-type
  --with-gif --with-jpeg --with-png --with-tiff --with-xpm --with-gnutls
  --with-rsvg --with-xml2 --without-imagemagick --with-modules 'CFLAGS=
  -g3 -O0' build_alias=x86_64-w64-mingw32
  PKG_CONFIG_PATH=/mingw64/lib/pkgconfig:/mingw64/share/pkgconfig'

Configured features:
XPM JPEG TIFF GIF PNG RSVG SOUND NOTIFY ACL GNUTLS LIBXML2 ZLIB
TOOLKIT_SCROLL_BARS MODULES

The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error, please notify the sender immediately and delete the message. Unless you are an addressee (or authorized to receive for an addressee), you may not use, copy or disclose to anyone this message or any information contained in this message. The unauthorized use, disclosure, copying or alteration of this message is strictly prohibited.