bug#21824: 25.0.50; overlay modification-hooks called with wrong buffer

[Eli Zaretskii <eliz@gnu.org>]

> Date: Tue, 3 Nov 2015 22:06:20 -0500
> From: Noam Postavsky <npostavs@users.sourceforge.net>
> 
> The circumstances that trigger this seem to be a combination of
> overlays and timers. Attached is an init.el file that installs several
> packages needed to trigger the problem. I have not yet managed to find
> a simpler way of reproducing this. After installing the packages, and
> running M-x irony-install-server (requires libclang)

Thanks.  Unfortunately, I don't really have enough time at the moment
to install all of that, certainly not libclang.  Is it okay if I ask
questions and make observations, and you then try digging into this
problem, find the answers, and post them here?

> the problem can be triggered by a C++ mode buffer with the following
> contents:

> void func(int x);
> int main() {
>   fun|
> }

> where | represents the cursor. Press TAB y C-f C-b C-f C-b, this
> results in a (wrong-type-argument overlayp nil) which is due to
> yas--on-field-overlay-modification being called with *Messages* as the
> current buffer, rather than the C++ buffer where the yasnippet's
> overlay is in. The begin and end positions passed correspond to
> *Messages* buffer positions (i.e. they are too big to be from the C++
> buffer). According to the lisp backtrace (see below), it seems to be
> triggered by a call to `message' via a timer.

I see that yas-global-mode is turned on, which (AFAIU) means yasnippet
tries to do its thing in every buffer, including *Messages*, right?

That in turn means every modification of the *Messages* buffer will,
quite correctly, call yas--on-field-overlay-modification, provided
that the buffer has overlays in it.  Normally, *Messages* doesn't have
any overlays, but in this case it evidently did, or Emacs somehow
thought it did, which might be part of the problem.

A call to 'message' switches to the *Messages* buffer as part of doing
its job, which explains why yas--on-field-overlay-modification is
called with buffer positions from *Messages* -- assuming there are
overlays there, this all is expected behavior.

So far so good, and now we come to the problematic part.
yas--on-field-overlay-modification is called thusly:

   yas--on-field-overlay-modification(#<overlay from 41 to 42 in foo.cpp> t 3008 3008 33)

IOW, the overlay it is called with belongs to buffer foo.cpp, not to
*Messages*.  So the question now becomes: how come an overlay whose
buffer is foo.cpp winds up in *Messages*?  Can you try finding out?
(Is that even possible?)

After this error happens, what does the following produce if invoked
with *Messages* being the current buffer:

  M-: (overlays-in (point-min) (point-max)) RET

Maybe instrument yas--on-field-overlay-modification to show the
current buffer when it is called, and see if it is invoked with
*Messages* as the current buffer in this scenario.

Thanks.