Gunnar Evermann <ge204(a)eng.cam.ac.uk&gt; writes: [...] The assertion happens in report_extent_modification_mapper(), which I added, so it's sort of my responsibility. But the funny thing about the crashes is that no extents even have the modification functions hooked into them. Maybe report_extent_modification_mapper() is getting called while the extents are in an inconsistent state? I don't see how that can be, as signal_after_change() is the *last* of the functions to be called from buffer_insert_string_1 and friends. The only way to see what's going on is to step through the functions and try to wizard out what hoses the buffer so that carcount->bytind conversion fails.