bug#28505: 26.0.60; Crash in Fmove_point_visually

[Benjamin Riefenstahl]

I read my mails in Gnus in an "emacs -nw" instance that I access via SSH
(this instance where I am writing this uses the same setup).  When I
have read my mails, I can make Emacs crash with the sequence <M-x a LEFT
RIGHT>.  GDB says this is in Fmove_point_visually at "BUFFERP
(g->object)".  I am attaching a GDB log with my commands added manually.

This does not reproduce without running Gnus before, so I can not run
this from a plain emacs -Q.  It looks to me like there is garbage in the
"row" struct, or the pointer row itself is garbage.

Let me know if I can do some more usefull debugging next time.

gdb.txt
Description: Text document

In GNU Emacs 26.0.60 (build 1, i686-pc-linux-gnu, GTK+ Version 2.24.25)
 of 2017-09-17 built on justinian
Repository revision: 57249fb297237bb942ead1f7a0af0ac20811a9cf
System Description:     Debian GNU/Linux 8.9 (jessie)

Recent messages:
scroll-down-command: Beginning of buffer [3 times]
previous-line: Beginning of buffer [4 times]
Auto-saving...done
next-line: End of buffer [2 times]
Auto-saving...done
Mark set
next-line: End of buffer [19 times]
scroll-down-command: Beginning of buffer [5 times]
Saving file /home/benny/Projects/emacs-26/gdb.txt...
Wrote /home/benny/Projects/emacs-26/gdb.txt

Configured features:
XPM JPEG TIFF GIF PNG RSVG SOUND GPM GSETTINGS NOTIFY LIBSELINUX GNUTLS
LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB TOOLKIT_SCROLL_BARS GTK2 X11

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Text

Minor modes in effect:
  shell-dirtrack-mode: t
  gpm-mouse-mode: t
  desktop-save-mode: t
  delete-selection-mode: t
  display-time-mode: t
  diff-auto-refine-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  auto-fill-function: do-auto-fill
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow sort emacsbug dirtrack shell pcomplete t-mouse term/linux imenu
elec-pair desktop frameset highline benny-calendar-cfg ange-ftp
benny-unicode generic-x autoinsert cc-cmds cc-engine cc-vars cc-defs
ps-print ps-print-loaddefs ps-def lpr advice benny-url cmuscheme comint
ansi-color ring scheme delsel disp-table time server protbuf cal-china
lunar solar cal-dst cal-bahai cal-islam cal-hebrew holidays hol-loaddefs
vc-git diff-mode easy-mmode vc-fossil vc vc-dispatcher diary-lib
diary-loaddefs cal-menu calendar cal-loaddefs benny-file-cache message-x
message subr-x puny dired dired-loaddefs format-spec mml mml-sec epa
derived epg gnus-util rmail rmail-loaddefs time-date mm-decode mm-bodies
mm-encode mail-parse rfc2231 gmm-utils mailheader bbdb-snarf mail-extr
rfc822 bbdb-com mailabbrev bbdb-autoloads bbdb cl timezone sendmail
rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils .loaddefs
browse-url autoload radix-tree lisp-mnt finder-inf gh-common gh-profile
rx s marshal eieio-compat ht json map dash info package easymenu
epg-config url-handlers url-parse auth-source cl-seq eieio eieio-core
cl-macs eieio-loaddefs password-cache url-vars seq byte-opt gv bytecomp
byte-compile cconv cl-loaddefs cl-lib mule-util tooltip eldoc electric
uniquify ediff-hook vc-hooks lisp-float-type mwheel term/x-win x-win
term/common-win x-dnd tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode elisp-mode lisp-mode
prog-mode register page menu-bar rfn-eshadow isearch timer select
scroll-bar mouse jit-lock font-lock syntax facemenu font-core
term/tty-colors frame cl-generic cham georgian utf-8-lang misc-lang
vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms cp51932
hebrew greek romanian slovak czech european ethiopic indian cyrillic
chinese composite charscript charprop case-table epa-hook jka-cmpr-hook
help simple abbrev obarray minibuffer cl-preloaded nadvice loaddefs
button faces cus-face macroexp files text-properties overlay sha1 md5
base64 format env code-pages mule custom widget hashtable-print-readable
backquote inotify dynamic-setting system-font-setting
font-render-setting move-toolbar gtk x-toolkit x multi-tty
make-network-process emacs)

Memory information:
((conses 8 193041 22460)
 (symbols 24 31276 1)
 (miscs 20 40 333)
 (strings 16 60409 2969)
 (string-bytes 1 1885315)
 (vectors 8 24621)
 (vector-slots 4 613375 18028)
 (floats 8 822 684)
 (intervals 28 254 0)
 (buffers 528 13)
 (heap 1024 9005 788))