Repeatable crash on Solaris, with recipe

I found a repeatable crash on Solaris with the following recipe. This is 21.5-b6 built from a full tarball using gcc 3.0.4 on Solaris 2.7. Start xemacs -vanilla. Evaluate the following function (defun foo (n) (dotimes (k n) (insert-string "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\n"))) That's a string of 80 A's but that shouldn't really matter. It's the size of the buffer that counts. In some buffer, M-: (foo 30000). Then do M-x text-mode. Then C-x h to mark the whole buffer. Finally, C-w to kill it. This crashes xemacs. The Lisp backtrace is: Lisp backtrace follows: # (unwind-protect ...) # (unwind-protect ...) # (unwind-protect ...) # (unwind-protect ...) # (unwind-protect ...) # (unwind-protect ...) # bind (undo-high-threshold tail verbose end start) kill-region(1 2430001 1) # bind (command-debug-status) call-interactively(kill-region) # (condition-case ... . error) # (catch top-level ...) Abort (core dumped) The C backtrace is corrupted, but I get: #0 0xfec1a1f0 in _libc_kill () from /usr/lib/libc.so.1 #1 0xa76d0 in fatal_error_signal (sig=6) at /apps/public/XEmacs/src/xemacs-21.5.6/src/emacs.c:3358 #2 <signal handler called> #3 0xfec1a1f0 in _libc_kill () from /usr/lib/libc.so.1 #4 0xfebb959c in abort () from /usr/lib/libc.so.1 #5 0xa860c in zero_out_command_line_status_vars () at /apps/public/XEmacs/src/xemacs-21.5.6/src/emacs.c:4189 This is starting to bite me at least once a day, especially in GNUS when someone sends me some huge Word attachment. I'll try to figure this out, but I need some guidance on what to look for. Thanks, Ray