bug#60096: 29.0.60; Crash in format_mode_line_unwind_data

[Eli Zaretskii]

> Cc: 60096@debbugs.gnu.org, juri@linkov.net
> Date: Sat, 17 Dec 2022 12:00:47 +0200
> From: Eli Zaretskii <eliz@gnu.org>
> 
> > The earlier call
> > 
> >        delete_all_child_windows (FRAME_ROOT_WINDOW (f));
> > 
> > should have reliably reset Vwindow_list to nil.
> 
> AFAIR, the code which runs after that call recalculated Vwindow_list,
> adding to it those windows with no buffer.

Specifically, here's what happens:

 . We call

              wset_buffer (w, other_buffer_safely (Fcurrent_buffer ()));

 . other_buffer_safely cannot find a single buffer that satisfies the
   candidate_buffer condition, so it ends up recreating *scratch*
   (whose deletion caused this mess to begin with) by calling
   get-scratch-buffer-create in Lisp
 . get-scratch-buffer-create calls substitute-command-keys to produce
   the blurb we put in the comment at the beginning of *scratch*
 . substitute-command-keys uses a temporary buffer to format the
   message, and calls kill-buffer to delete that buffer when it's done
 . kill-buffer calls replace_buffer_in_windows, which calls
   replace-buffer-in-windows in Lisp
 . replace-buffer-in-windows calls window-list-1, which calls
   window_list, which fills Vwindow_list with windows that have no
   buffer:

    (gdb) pp Vwindow_list
    (#<window 8> #<window 4>)

 . one of these windows gets assigned a buffer, eventually, since it's
   a selected-window, but the other window stays without a buffer, and
   causes a crash in the following redisplay