> Don't know where to go from here, but I have a breakpoint set on
 >
 >        replace_buffer_in_windows_safely_count = 0;
 >
 > conditioned on count != 0.

Good.  IIUC this

 > (gdb) p list_length(Vwindow_list)
 > $2 = 2

and this

 > (gdb) xlist
 > $13 = 0x1a
 > Lisp_Int0
 > $14 = 6

together indicate that Vwindow_list spontaneously shrinks from 6 to 2
elements (which is "impossible" as we know already).  Attaching the next
patch which should catch this situation automatically.  It will still be
of no help because we won't catch the one that apparently clobbers that
list but hopefully more useful than the previous diff.

martin