I don't know why it never occured to me to try it before... but I
just recompiled XEmacs-21.2-b1 on the laptop where it had been
crashing, this time --with-png=no, and the crashes are cured.
I guess that narrows the location of the programmer error
somewhat... whether it's Jareth's codes or the libpng folks bug, I
haven't a clue.