bug#68940: 29.2; Random crashes in face for char / font

[Eli Zaretskii]

> From: Gerd Möllmann <gerd.moellmann@gmail.com>
> Cc: 68940@debbugs.gnu.org,  Eli Zaretskii <eliz@gnu.org>
> Date: Thu, 08 Feb 2024 06:42:14 +0100
> 
> Robert Vojta <rvojta@me.com> writes:
> 
> > Address sanitizer gave me ...
> >
> >   https://gist.github.com/zrzka/3506322a8e4e63fc6b323a48faad8f64
> >
> > ... heap user after free in "Automatic GC". When this happened, Emacs
> > was showing the mentioned init file load error, and weird character.
> >
> > Don't know if it's related to my initial issue, if the problem is the
> > timer & kill, ...
> 
> I can't make sense of what is happening here: A marker M is created from
> Lisp (point-marker), and later GC'd. So far so good, and nrmal, but some
> later GC then finds M in a member of struct buffer. No idea how that's
> possible.

Exactly my thoughts.  I suspect that it could be a bug in the address
sanitizer, perhaps triggered by our quite unique memory management.