>
> And I've found the culprit: we weren't restoring point after lifting the 
> locked narrowing.  narrow-to-region can move point if the new 
> restriction puts point outside of the region.  So what was happening is 
> that isearch-update was calling pos-visible-in-window-group-p to see 
> whether the match is visible, and that call would move point from under 
> the feet of isearch-update, because pos-visible-in-window-p calls 
> display routines.  So any subsequent uses of point would use a 
> completely wrong value of point.
>
> I've now made narrow-to-region preserve point across locked narrowing, 
> and the problem went away.
>
> Ugh! this one was a bitch to debug!
>

😉  Thanks, that's even better!

So the only remaining question is whether it is necessary to recompute 
narrowed_begv and narrowed_zv in init_iterator:

diff --git a/src/xdisp.c b/src/xdisp.c
index b1ee7889d4..e415320a52 100644
--- a/src/xdisp.c
+++ b/src/xdisp.c
@@ -3429,6 +3429,12 @@ init_iterator (struct it *it, struct window *w,
     {
       it->narrowed_begv = get_narrowed_begv (w, window_point (w));
       it->narrowed_zv = get_narrowed_zv (w, window_point (w));
+      if (charpos >= 0
+         && (charpos < it->narrowed_begv || charpos > it->narrowed_zv))
+       {
+         it->narrowed_begv = get_narrowed_begv (w, charpos);
+         it->narrowed_zv = get_narrowed_zv (w, charpos);
+       }
     }