bug#68940: 29.2; Random crashes in face for char / font

[Gerd Möllmann]

Robert Vojta <rvojta@me.com> writes:

> Address sanitizer gave me ...
>
>   https://gist.github.com/zrzka/3506322a8e4e63fc6b323a48faad8f64
>
> ... heap user after free in "Automatic GC". When this happened, Emacs
> was showing the mentioned init file load error, and weird character.
>
> Don't know if it's related to my initial issue, if the problem is the
> timer & kill, ...

I can't make sense of what is happening here: A marker M is created from
Lisp (point-marker), and later GC'd. So far so good, and nrmal, but some
later GC then finds M in a member of struct buffer. No idea how that's
possible.