A different VM crash on 21.2.32

Built from full tarball on Solaris 2.7 with gcc 2.7.2.2. In a VM summary buffer, I clicked on a line to display the message, but I might have hit a buffer tab. I wasn't paying much attention. XEmacs crashed. Here's the C backtrace. The lisp backtrace is still in kernel memory somewhere. Ray #0 0xfec16870 in _libc_kill () from /usr/lib/libc.so.1 #1 0xa429c in fatal_error_signal (sig=6) at emacs.c:293 #2 <signal handler called> #3 0xfec16870 in _libc_kill () from /usr/lib/libc.so.1 #4 0xfebb92a4 in abort () from /usr/lib/libc.so.1 #5 0xa704c in assert_failed (file=0x244468 "eval.c", line=2075, expr=0x244510 "found_error_tag || NILP (Vcurrent_error_state)") at emacs.c:2754 #6 0xaaf64 in check_error_state_sanity () at eval.c:2075 #7 0xab52c in call_with_suspended_errors (fun=0x1437f0 <image_instantiate>, retval=2616740, class=3041284, errb=Cannot access memory at address 0x2a. ) at eval.c:1314 #8 0x1c577c in specifier_instance_from_inst_list (specifier=3602688, matchspec=2616740, domain=18600960, inst_list=4395012, errb=Cannot access memory at address 0x2a. ) at specifier.c:2457 #9 0x1c5be4 in specifier_instance (specifier=3602688, matchspec=2616740, domain=18600960, errb= Cannot access memory at address 0x2a. ) at specifier.c:2572 #10 0x146164 in update_glyph_cachel_data (w=0x11bd400, glyph=3602752, cachel=0xd28280) at glyphs.c:3619 #11 0x146458 in mark_glyph_cachels_as_not_updated (w=0x11bd400) at glyphs.c:4005 #12 0x19a600 in redisplay_window (window=18600960, skip_selected=5367293) at redisplay.c:5950 #13 0x19b0a8 in redisplay_windows (window=18600960, skip_selected=1) at redisplay.c:6253 #14 0x19a318 in redisplay_window (window=18298880, skip_selected=1) at redisplay.c:5883 #15 0x19b43c in redisplay_frame (f=0x875000, preemption_check=18298880) at redisplay.c:6253 #16 0x19b6c8 in redisplay_device (d=0x628700, automatic=8867840) at redisplay.c:6487 #17 0x19bbe0 in redisplay_without_hooks () at redisplay.c:6576 #18 0x19be64 in redisplay () at redisplay.c:6633 #19 0xfd3d8 in Fnext_event (event=18008880, prompt=3041284) at event-stream.c:2180 #20 0x87ed0 in Fcommand_loop_1 () at cmdloop.c:566 #21 0x87c74 in command_loop_1 (dummy=3041284) at cmdloop.c:490 #22 0xaa254 in condition_case_1 (handlers=2805760, bfun=0x87c28 <command_loop_1>, barg=3041284, hfun=0x880c0 <cmd_error>, harg=3041284) at eval.c:1644 #23 0x881d0 in command_loop_2 (dummy=3041284) at cmdloop.c:252 #24 0xa9de8 in internal_catch (tag=3123444, func=0x88184 <command_loop_2>, arg=3041284, threw=0x0) at eval.c:1310 #25 0x875a8 in initial_command_loop (load_me=557444) at cmdloop.c:301 #26 0xa5ebc in xemacs_21_2_b32_sparc_sun_solaris2_7 (argc=1, argv=0xffbeedb4, envp=0xffbeedbc, restart=0) at emacs.c:1873 #27 0xa66d8 in main (argc=1, argv=0xffbeedb4, envp=0xffbeedbc) at emacs.c:2292