bug#24692: 25.1; simple, reproducible Emacs 25.1 crash on MS Windows

[Drew Adams <drew.adams@oracle.com>]

> No crash here, just takes some time to execute.  Tested with release and
> master.  The recipe seems contrived.  ‘fit-frame-same-row-windows’ and
> ‘fit-frame-same-column-windows’ are nowhere used, IIUC.  All you do is
> find the number of lines and the maximum number of columns of any line
> of simple.el.  Why on earth should that crash?

The recipe seems "contrived"?  Of course it is contrived.
I narrowed down tons of code to this simple recipe.

And yes, I forgot to finally remove those two functions, when
I had it narrowed down.  As you noted, you can completely
remove them.  This is thus sufficient to crash Emacs 100% of
the time (on my system):

(defun fit-frame (frame)
  (save-window-excursion
    (select-frame frame)
    (let ((win-cons (fit-frame-max-window-size (selected-window))))
      (cons (car win-cons) (cdr win-cons)))))

(defun fit-frame-max-window-size (window)
  (select-window window)
  (let ((max-win-width  0)
        (max-win-height 1))
    (save-excursion
      (set-buffer (window-buffer))
      (goto-char (point-min))
      (while (not (eobp))
        (end-of-line)
        (setq max-win-width  (max (current-column) max-win-width))
        (when (zerop (forward-line 1))
          (setq max-win-height  (1+ max-win-height)))))
    (cons max-win-width max-win-height)))

(setq pop-up-frames  t)
(let ((after-make-frame-functions  ())) (make-frame '((minibuffer . only))))
(add-hook 'after-make-frame-functions 'fit-frame)

As for "Why on earth should that crash?"  Why indeed?  The answer
seems to be "Because Emacs 25" - it does not crash in Emacs 20
through 24.5.

You can use a different command, such as `digit-argument', for
`C-h f', since `prefix-command-preserve-state' does not exist
in previous releases.  (`digit-argument' will also crash Emacs
25.)  Note, BTW, that even though Emacs 24.5 does not crash, it
does take a long time to show `simple.el'.

Note too that the time it takes Emacs 25 to crash, after clicking
`simple.el', seems variable - but it always crashes.  There is
always a period when you see a blank `simple.el' frame, before
the crash, but sometimes the crash comes more quickly than other
times.

This makes me think that the actual crash occurs elsewhere from
where the bug is manifested - e.g. eventually trying to access
an improper memory location.  (Just a hunch, and likely not very
helpful.)