21.2.33 crash on Solaris 2.7

One of my colleagues got the following crash. (He's been getting some spontaneous crashes with 21.2.33 which has been pretty solid for me as long as I stay away from the gutters.) The C traceback appended. Ray #0 0xfeb96870 in _libc_kill () from /usr/lib/libc.so.1 #1 0xa499c in fatal_error_signal (sig=6) at emacs.c:293 #2 <signal handler called> #3 0xfeb96870 in _libc_kill () from /usr/lib/libc.so.1 #4 0xfeb392a4 in abort () from /usr/lib/libc.so.1 #5 0xa775c in assert_failed (file=0x251948 "lisp.h", line=589, expr=0x251950 "RECORD_TYPEP (obj, lrecord_type_cons)") at emacs.c:2754 #6 0xd37e8 in popup_selection_callback (widget=0x653200, ignored_id=65647, client_data=0xe5df00) at gui-x.c:232 #7 0x21dec0 in xm_generic_callback (widget=0xf07600, closure=0xf71620, call_data=0xffbed91c) at lwlib-Xm.c:1960 #8 0xfeebec84 in XtCallCallbackList () from /usr/lib/libXt.so.4 #9 0xff20e514 in ActivateCommon () from /usr/lib/libXm.so.4 #10 0xfeec1c30 in HandleActions () from /usr/lib/libXt.so.4 #11 0xfeedc0f4 in HandleComplexState () from /usr/lib/libXt.so.4 #12 0xfeec053c in _XtTranslateEvent () from /usr/lib/libXt.so.4 #13 0xfeec045c in XtDispatchEventToWidget () from /usr/lib/libXt.so.4 #14 0xfeebfce8 in _XtDefaultDispatcher () from /usr/lib/libXt.so.4 #15 0xfeebf810 in XtDispatchEvent () from /usr/lib/libXt.so.4 #16 0xfeec2fa0 in XtAppProcessEvent () from /usr/lib/libXt.so.4 #17 0x1ec668 in emacs_Xt_next_event (emacs_event=0x8e4a48) at event-Xt.c:2592 #18 0xfb4a4 in event_stream_next_event (event=0x8e4a48) at event-stream.c:508 #19 0xfe24c in next_event_internal (target_event=9325128, allow_queued=1) at event-stream.c:1967 #20 0xfe8a0 in Fnext_event (event=9325128, prompt=3053572) at event-stream.c:2181 #21 0x885cc in Fcommand_loop_1 () at cmdloop.c:566 #22 0x88370 in command_loop_1 (dummy=3053572) at cmdloop.c:490 #23 0xaa9a0 in condition_case_1 (handlers=2818048, bfun=0x88324 <command_loop_1>, barg=3053572, hfun=0x887bc <cmd_error>, harg=3053572) at eval.c:1644 #24 0x888cc in command_loop_2 (dummy=3053572) at cmdloop.c:252 #25 0xaa534 in internal_catch (tag=3135684, func=0x88880 <command_loop_2>, arg=3053572, threw=0x0) at eval.c:1310 #26 0x87ca4 in initial_command_loop (load_me=559232) at cmdloop.c:301 #27 0xa65c4 in xemacs_21_2_b33_sparc_sun_solaris2_7 (argc=1, argv=0xffbee55c, envp=0xffbee564, #28 0xa6de0 in main (argc=1, argv=0xffbee55c, envp=0xffbee564) at emacs.c:2292