emacs-29 3b618d0e3e: Avoid segfaults due to invalid selected-window's buffer

[Eli Zaretskii]

branch: emacs-29
commit 3b618d0e3ed91c5b954b47f9044f7f3f3aa67c66
Author: Eli Zaretskii <eliz@gnu.org>
Commit: Eli Zaretskii <eliz@gnu.org>

    Avoid segfaults due to invalid selected-window's buffer
    
    * lisp/startup.el (initial-scratch-message): Don't use \\[...]
    commands for substitute-command-keys.
    * lisp/simple.el (get-scratch-buffer-create): Don't call
    substitute-command-keys on initial-scratch-message, to avoid
    signaling an error in rare cases.  (Bug#60096)
---
 lisp/simple.el  | 7 ++++++-
 lisp/startup.el | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/lisp/simple.el b/lisp/simple.el
index 654b56a088..dcc2242e49 100644
--- a/lisp/simple.el
+++ b/lisp/simple.el
@@ -10683,7 +10683,12 @@ too short to have a dst element.
         ;; we just created it.
         (with-current-buffer scratch
           (when initial-scratch-message
-            (insert (substitute-command-keys initial-scratch-message))
+            ;; We used to run this through substitute-command-keys,
+            ;; but that might be unsafe in some rare cases, and this
+            ;; function must never fail and signal an error, because
+            ;; it is called from other_buffer_safely, which must
+            ;; always produce a valid buffer.
+            (insert initial-scratch-message)
             (set-buffer-modified-p nil))
           (funcall initial-major-mode))
         scratch)))
diff --git a/lisp/startup.el b/lisp/startup.el
index 6270de2ace..7f8e8d55db 100644
--- a/lisp/startup.el
+++ b/lisp/startup.el
@@ -1669,7 +1669,7 @@ Changed settings will be marked as \"CHANGED outside of 
Customize\"."
 
 (defcustom initial-scratch-message (purecopy "\
 ;; This buffer is for text that is not saved, and for Lisp evaluation.
-;; To create a file, visit it with \\[find-file] and enter text in its buffer.
+;; To create a file, visit it with \"C-x C-f\" and enter text in its buffer.
 
 ")
   "Initial documentation displayed in *scratch* buffer at startup.