When an index reader or writer calls restoreState(), the code attempts to find the element it was looking at before it saved state. If that element is no longer in the tree, it may end up pointing instead to an element flagged as unused. This is a normal situation, but in this case the code fails to skip over unused elements, and can instead return a DiskLoc that does not point to a valid data record. This can cause a server crash, or, very unlikely, to return an incorrect record.