bug#46320: 27.1; bugs about scrolling buffer with images

[ynyaaa@gmail.com]

In this report, font size is important.
If font size differs, window size or image size should be changed.
But I can not find the relations.
The cases below are tested with emacs -Q.
In my environment, the font used by 'emacs -Q' is 
harfbuzz:-outline-Courier New-normal-normal-normal-mono-13-*-*-*-c-*-iso8859-1
and (frame-char-height) => 16.

(1)wrong display
Evaluate the form below, only the line 20 is displayed.
 Type C-p, the buffer scrolls down and the lines 2 to 17 are
displayed and the cursor is displayed at the end of line 2.
At this time, the real current point must be at the beginning of the
line 19.
Type C-p again, the line 18 is displayed at the top of the window.

(let* ((buf (generate-new-buffer "tmp"))
       (width 80)
       (height 350)
       (svg (format "\
<svg width=\"%d\" height=\"%d\" version=\"1.1\"
 xmlns=\"http://www.w3.org/2000/svg\">
<rect x=\"0\" y=\"0\" width=\"%d\" height=\"%d\" fill=\"blue\"/>
</svg>
" width height width height))
       (img (create-image svg 'svg t :scale 1)))
  (switch-to-buffer buf)
  (setq header-line-format "with header line")
  (insert-image img "1")
  (insert "\n2\n3\n4\n5\n6\n7\n8\n9\n")
  (insert-image img "10")
  (insert "\n11\n12\n13\n14\n15\n16\n17\n18\n19\n20\n")
  (set-frame-height nil 40)
  (delete-other-windows)
  (forward-line -1)
  (set-window-start nil (point))
  )

(2)unable to scroll up
Evaluate the form below and type C-v repeatedly, the buffer never scroll
up to the end of the buffer. Once in three times, the buffer scrolls
down and the line 2 is displayed at the top of the window.

(let* ((buf (generate-new-buffer "tmp"))
       (width 80)
       (height 250)
       (svg (format "\
<svg width=\"%d\" height=\"%d\" version=\"1.1\"
 xmlns=\"http://www.w3.org/2000/svg\">
<rect x=\"0\" y=\"0\" width=\"%d\" height=\"%d\" fill=\"blue\"/>
</svg>
" width height width height))
       (img (create-image svg 'svg t :scale 1 :ascent 100)))
  (switch-to-buffer buf)
  (setq header-line-format "with header line")
  (insert "1\n2\n3\n4\n5\n")
  (insert-image img "6")
  (insert "\n7\n8\n9\n10\n11\n")
  (set-frame-height nil 18)
  (delete-other-windows)
  (goto-char (point-min))
  )



In GNU Emacs 27.1 (build 1, x86_64-w64-mingw32)
 of 2020-08-22 built on CIRROCUMULUS
Repository revision: 86d8d76aa36037184db0b2897c434cdaab1a9ae8
Repository branch: HEAD
Windowing system distributor 'Microsoft Corp.', version 10.0.18363
System Description: Microsoft Windows 10 Pro (v10.0.1909.18363.1316)

Recent messages:

Configured using:
 'configure --without-dbus --host=x86_64-w64-mingw32
 --without-compress-install 'CFLAGS=-O2 -static''

Configured features:
XPM JPEG TIFF GIF PNG RSVG SOUND NOTIFY W32NOTIFY ACL GNUTLS LIBXML2
HARFBUZZ ZLIB TOOLKIT_SCROLL_BARS MODULES THREADS JSON PDUMPER LCMS2 GMP

Important settings:
  value of $LANG: JPN
  locale-coding-system: cp932

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(tabify gnutls network-stream nsm mailalias smtpmail auth-source eieio
eieio-core cl-macs eieio-loaddefs json map rect cl-seq image-mode exif
misearch multi-isearch cl-extra cl-print thingatpt help-fns radix-tree
help-mode pp shadow sort mail-extr emacsbug message rmc puny dired
dired-loaddefs format-spec rfc822 mml easymenu mml-sec password-cache
epa derived epg epg-config gnus-util rmail rmail-loaddefs
text-property-search time-date subr-x seq byte-opt gv bytecomp
byte-compile cconv mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader cl-loaddefs cl-lib sendmail rfc2047
rfc2045 ietf-drums mm-util mail-prsvr mail-utils term/bobcat japan-util
tooltip eldoc electric uniquify ediff-hook vc-hooks lisp-float-type
mwheel dos-w32 ls-lisp disp-table term/w32-win w32-win w32-vars
term/common-win tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode elisp-mode lisp-mode
prog-mode register page tab-bar menu-bar rfn-eshadow isearch timer
select scroll-bar mouse jit-lock font-lock syntax facemenu font-core
term/tty-colors frame minibuffer cl-generic cham georgian utf-8-lang
misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms
cp51932 hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese composite charscript charprop case-table epa-hook
jka-cmpr-hook help simple abbrev obarray cl-preloaded nadvice loaddefs
button faces cus-face macroexp files text-properties overlay sha1 md5
base64 format env code-pages mule custom widget hashtable-print-readable
backquote threads w32notify w32 lcms2 multi-tty make-network-process
emacs)

Memory information:
((conses 16 75332 20037)
 (symbols 48 7618 6)
 (strings 32 24171 2210)
 (string-bytes 1 722800)
 (vectors 16 13737)
 (vector-slots 8 242590 23228)
 (floats 8 48 310)
 (intervals 56 1150 0)
 (buffers 1000 19))