Jan Vroonhof <vroonhof(a)math.ethz.ch&gt; writes: [snip David's recipe incl. widen/narrowing ] yes and that's what I looked at more closely. The problem is quite simple actually. (I'm not quite sure whether Shenghuo's crash is the same problem -- Bill what kind of stuff are you doing in that after-change-functions?). A new and improved test case is: ----- (switch-to-buffer "FOO") (insert "123456") (defun acf (start end len) (goto-char 4) (delete-char 2)) (setq after-change-functions '(acf)) (insert "a") ----- No narrowing necessary. What happens is that when inserting the "a" we call: signal_after_change(buf = 0x824000, start = 7, orig_end = 7, new_end = 8) this runs acf, which in turn deletes two characters, making bufz=6. Now we call report_extent_modification which calls map_extents(from = 7, to = 8, fn = 0x1cd3f8,...) but 7 and 8 are now outside the buffer range, therefore triggering the assert when converting them to byteinds. I am surprised we don't see this more often. What do people usually use this after-change stuff for? any suggestions for a fix? Gunnar