The circumstances that trigger this seem to be a combination of
overlays and timers. Attached is an init.el file that installs several
packages needed to trigger the problem. I have not yet managed to find
a simpler way of reproducing this. After installing the packages, and
running M-x irony-install-server (requires libclang), the problem can
be triggered by a C++ mode buffer with the following contents:

void func(int x);
int main() {
  fun|
}

where | represents the cursor. Press TAB y C-f C-b C-f C-b, this
results in a (wrong-type-argument overlayp nil) which is due to
yas--on-field-overlay-modification being called with *Messages* as the
current buffer, rather than the C++ buffer where the yasnippet's
overlay is in. The begin and end positions passed correspond to
*Messages* buffer positions (i.e. they are too big to be from the C++
buffer). According to the lisp backtrace (see below), it seems to be
triggered by a call to `message' via a timer.

Original report is at https://github.com/capitaomorte/yasnippet/issues/607

Debugger entered--Lisp error: (wrong-type-argument overlayp nil)
  overlay-get(nil yas--snippet)
  (let* ((inhibit-modification-hooks t) (field (overlay-get overlay
(quote yas--field))) (snippet (overlay-get yas--active-field-overlay
(quote yas--snippet)))) (cond (after\? (yas--advance-end-maybe field
(overlay-end overlay)) (save-excursion (yas--field-update-display
field)) (yas--update-mirrors snippet)) (field (if (and (not after\?)
(not (progn nil (or ... ...) (aref field 7))) (eq (point) (if (markerp
...) (marker-position ...) (progn nil ... ...)))) (progn
(yas--skip-and-clear field))) (progn nil (or (progn nil (and (vectorp
field) (>= ... 9) (memq ... cl-struct-yas--field-tags) t)) (signal
(quote wrong-type-argument) (list (quote yas--field) field))) (let*
((v field)) (aset v 7 t))))))
  (if (or yas--inhibit-overlay-hooks (yas--undo-in-progress)) nil
(message "yas--on-field-ov-mod(%S %S %S %S %S): buffer = %s" overlay
after\? _beg _end _length (current-buffer)) (let*
((inhibit-modification-hooks t) (field (overlay-get overlay (quote
yas--field))) (snippet (overlay-get yas--active-field-overlay (quote
yas--snippet)))) (cond (after\? (yas--advance-end-maybe field
(overlay-end overlay)) (save-excursion (yas--field-update-display
field)) (yas--update-mirrors snippet)) (field (if (and (not after\?)
(not (progn nil ... ...)) (eq (point) (if ... ... ...))) (progn
(yas--skip-and-clear field))) (progn nil (or (progn nil (and ... ...
... t)) (signal (quote wrong-type-argument) (list ... field))) (let*
((v field)) (aset v 7 t)))))))
  yas--on-field-overlay-modification(#<overlay from 41 to 42 in
foo.cpp> t 3008 3008 33)
  message("%s" "use of undeclared identifier 'y'")
  display-message-or-buffer("use of undeclared identifier 'y'"
"*Flycheck error messages*")
  (let ((messages (mapcar (function
flycheck-error-format-message-and-id) errors)))
(display-message-or-buffer (string-join messages "\n\n")
flycheck-error-message-buffer))
  (progn (let ((messages (mapcar (function
flycheck-error-format-message-and-id) errors)))
(display-message-or-buffer (string-join messages "\n\n")
flycheck-error-message-buffer)))
  (if (and errors (flycheck-may-use-echo-area-p)) (progn (let
((messages (mapcar (function flycheck-error-format-message-and-id)
errors))) (display-message-or-buffer (string-join messages "\n\n")
flycheck-error-message-buffer))))
  flycheck-display-error-messages(([cl-struct-flycheck-error #<buffer
foo.cpp> irony "/tmp/el-get-test-home/foo.cpp" 5 8 "use of undeclared
identifier 'y'" error nil]))
  funcall(flycheck-display-error-messages ([cl-struct-flycheck-error
#<buffer foo.cpp> irony "/tmp/el-get-test-home/foo.cpp" 5 8 "use of
undeclared identifier 'y'" error nil]))
  (progn (funcall flycheck-display-errors-function errors))
  (if flycheck-display-errors-function (progn (funcall
flycheck-display-errors-function errors)))
  flycheck-display-errors(([cl-struct-flycheck-error #<buffer foo.cpp>
irony "/tmp/el-get-test-home/foo.cpp" 5 8 "use of undeclared
identifier 'y'" error nil]))
  (progn (flycheck-display-errors errors))
  (if errors (progn (flycheck-display-errors errors)))
  (let ((errors (flycheck-overlay-errors-at (point)))) (if errors
(progn (flycheck-display-errors errors))))
  (progn (let ((errors (flycheck-overlay-errors-at (point)))) (if
errors (progn (flycheck-display-errors errors)))))
  (if flycheck-mode (progn (let ((errors (flycheck-overlay-errors-at
(point)))) (if errors (progn (flycheck-display-errors errors))))))
  (progn (flycheck-cancel-error-display-error-at-point-timer) (if
flycheck-mode (progn (let ((errors (flycheck-overlay-errors-at
(point)))) (if errors (progn (flycheck-display-errors errors)))))))
  (condition-case err (progn
(flycheck-cancel-error-display-error-at-point-timer) (if flycheck-mode
(progn (let ((errors (flycheck-overlay-errors-at ...))) (if errors
(progn (flycheck-display-errors errors))))))) ((debug error) (message
"Flycheck error display error: %s" err) nil))
  flycheck-display-error-at-point()
  apply(flycheck-display-error-at-point nil)
  timer-event-handler([t 22073 29035 116958 nil
flycheck-display-error-at-point nil nil 308000])


In GNU Emacs 25.0.50.1 (x86_64-unknown-linux-gnu, X toolkit)
 of 2015-11-03
Repository revision: 2390d890765983ed1e5ece1711c470351705e7c8
Windowing system distributor 'The X.Org Foundation', version 11.0.11702000
Configured using:
 'configure --cache-file=../config.cache 'CFLAGS=-O2 -march=native'
 --with-crt-dir=/usr/lib/x86_64-linux-gnu --with-x-toolkit=lucid
 --without-toolkit-scroll-bars --with-gif=no'

Configured features:
XPM JPEG TIFF PNG SOUND DBUS NOTIFY GNUTLS LIBXML2 ZLIB LUCID X11

Important settings:
  value of $LANG: en_CA.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Debugger

Minor modes in effect:
  global-flycheck-mode: t
  yas-global-mode: t
  yas-minor-mode: t
  global-company-mode: t
  company-mode: t
  global-highlight-parentheses-mode: t
  highlight-parentheses-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  buffer-read-only: t
  line-number-mode: t
  transient-mark-mode: t

Recent messages:
[yas] Loading snippet files from
/tmp/el-get-test-home/.emacs.d/elpa/yasnippet-20151101.1535/snippets/c++-mode
[yas] Loading for `cc-mode', just-in-time: (lambda nil
(yas--load-directory-1 (quote
/tmp/el-get-test-home/.emacs.d/elpa/yasnippet-20151101.1535/snippets/cc-mode)
(quote cc-mode)))!
[yas] Loading snippet files from
/tmp/el-get-test-home/.emacs.d/elpa/yasnippet-20151101.1535/snippets/cc-mode
Debug on Error enabled globally
[yas] snippet expanded.
yas--on-field-ov-mod(#<overlay from 41 to 46 in foo.cpp> nil 41 41
nil): buffer = foo.cpp
yas--on-field-ov-mod(#<overlay from 41 to 42 in foo.cpp> t 41 42 0):
buffer = foo.cpp
use of undeclared identifier 'y'
yas--on-field-ov-mod(#<overlay from 41 to 42 in foo.cpp> t 3008 3008
33): buffer = *Messages*
Entering debugger...

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr emacsbug message dired format-spec
rfc822 mml mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums
mm-util help-fns mail-prsvr mail-utils debug cus-start cus-load
thingatpt lisp-mnt irony-cdb-libclang irony-cdb-json pp json
irony-cdb-clang-complete irony-cdb cc-mode cc-fonts cc-guess cc-menus
cc-cmds cc-styles cc-align cc-engine cc-vars cc-defs company-files
company-oddmuse company-keywords company-etags etags xref project eieio
byte-opt bytecomp byte-compile cconv eieio-core company-gtags
company-dabbrev-code company-dabbrev company-capf company-cmake
company-xcode company-clang company-semantic company-eclim
company-template company-css company-nxml company-bbdb company-irony
irony-completion irony-snippet flycheck-irony irony-diagnostics irony
flycheck find-func rx subr-x dash jka-compr compile comint ansi-color
ring let-alist yasnippet cl-extra derived help-mode company edmacro
kmacro highlight-parentheses cl-macs easy-mmode cl gv cl-seq finder-inf
info cl-loaddefs pcase cl-lib package easymenu epg-config time-date
mule-util tooltip eldoc electric uniquify ediff-hook vc-hooks
lisp-float-type mwheel x-win term/common-win x-dnd tool-bar dnd fontset
image regexp-opt fringe tabulated-list newcomment elisp-mode lisp-mode
prog-mode register page menu-bar rfn-eshadow timer select scroll-bar
mouse jit-lock font-lock syntax facemenu font-core frame cl-generic cham
georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese charscript case-table epa-hook
jka-cmpr-hook help simple abbrev minibuffer cl-preloaded nadvice
loaddefs button faces cus-face macroexp files text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote dbusbind inotify dynamic-setting
x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 300138 13183)
 (symbols 48 31710 0)
 (miscs 40 474 275)
 (strings 32 53496 8101)
 (string-bytes 1 1682695)
 (vectors 16 23094)
 (vector-slots 8 660438 6306)
 (floats 8 740 352)
 (intervals 56 288 0)
 (buffers 976 16)
 (heap 1024 31399 1018))