Noam Postavsky <npostavs@gmail.com> writes:

> next time it was just mark_stack, but the object being marked still
> looks like an undo-list.

Here's the gdb evidence of that.  I note that the reproduction recipe
disables undo via (let ((buffer-undo-list t))...), but looking at its
code, I see that yasnippet unconditionally pushes entries onto the undo
list anyway.  Michał, is the binding of buffer-undo-list significant for
your reproduction (i.e., did the original crash happen in an
undo-disabled buffer)?