[i586-linux; b40] Seg fault while printing lisp backtrace after fatal error

XEmacs died of a seg fault while printing a lisp backtrace of an error condition. Here's the C backtrace: #0 0x8147d63 in print_internal (obj=146582848, printcharfun=137564988, escapeflag=1) at print.c:1213 1213 if (LHEADER_IMPLEMENTATION (lheader)->printer) (gdb) print lheader $19 = (struct lrecord_header *) 0xffffffff Obj is a Lisp_Type_Record, but the result of XRECORD_LRECORD (obj) is (struct lrecord_header *)(-1). The seg fault comes from the dereference of lheader. (gdb) where #0 0x8147d63 in print_internal (obj=146582848, printcharfun=137564988, escapeflag=1) at print.c:1213 #1 0x8147733 in print_cons (obj=146582848, printcharfun=137564988, escapeflag=1) at print.c:921 #2 0x8147d77 in print_internal (obj=144870916, printcharfun=137564988, escapeflag=1) at print.c:1214 #3 0x81476a9 in print_cons (obj=144871336, printcharfun=137564988, escapeflag=1) at print.c:914 #4 0x8147d77 in print_internal (obj=144871780, printcharfun=137564988, escapeflag=1) at print.c:1214 #5 0x8146778 in Fprin1 (object=144871780, stream=137564988) at print.c:506 #6 0x80b6281 in Fbacktrace (stream=137564988, detailed=137456824) at eval.c:4927 #7 0x80aa313 in fatal_error_signal (sig=11) at emacs.c:245 #8 0xbffff368 in ?? () <-- this should be a call to print_internal #9 0x8147733 in print_cons (obj=146582848, printcharfun=138966072, escapeflag=1) at print.c:921 print.c:921 -> print_internal (obj, printcharfun, escapeflag); #10 0x8147d77 in print_internal (obj=144870916, printcharfun=138966072, escapeflag=1) at print.c:1214 #11 0x8146d8d in print_error_message (error_object=144871780, stream=138966072) at print.c:651 #12 0x8146f97 in Fdisplay_error (error_object=144871780, stream=137456824) at print.c:704 #13 0x80b2caa in funcall_recording_as (recorded_as=137564736, nargs=2, args=0xbffff7e4) at eval.c:3197 #14 0x80b2e83 in Ffuncall (nargs=3, args=0xbffff7e4) at eval.c:3238 #15 0x8088fe6 in Fbyte_code (bytestr=136651092, vector=136651232, maxdepth=11) at bytecode.c:416 #16 0x80b3d90 in funcall_lambda (fun=136651436, nargs=1, arg_vector=0xbffff8f8) at eval.c:3597 #17 0x80b2e3e in funcall_recording_as (recorded_as=137531140, nargs=1, args=0xbffff8f4) at eval.c:3214 #18 0x80b2e83 in Ffuncall (nargs=2, args=0xbffff8f4) at eval.c:3238 #19 0x80b43ef in call1 (fn=137531140, arg0=144871780) at eval.c:3912 #20 0x809087c in cmd_error (data=144871780, dummy=137456796) at cmdloop.c:195 #21 0x80afecc in condition_case_1 (handlers=137456908, bfun=0x8091420 <command_loop_1>, barg=137456796, hfun=0x8090830 <cmd_error>, harg=137456796) at eval.c:1636 #22 0x8090931 in command_loop_3 () at cmdloop.c:256 #23 0x8090958 in command_loop_2 (dummy=137456796) at cmdloop.c:267 #24 0x80afa69 in internal_catch (tag=137531196, func=0x8090950 <command_loop_2>, arg=137456796, threw=0x0) at eval.c:1328 #25 0x8090cdb in initial_command_loop (load_me=137456796) at cmdloop.c:305 #26 0x80ab443 in xemacs_21_0_b40_i586_pc_linux (argc=1, argv=0xbffffab4, envp=0xbffffabc, restart=0) at emacs.c:1683 #27 0x80abbdd in main (argc=1, argv=0xbffffab4, envp=0xbffffabc) at emacs.c:2100 #28 0x80781ee in _start () Here's the lisp backtrace it was trying to print when it died: Lisp backtrace follows: # bind (print-message-label) display-error((error "Invalid list format" (vm-add-mail-mode-header-separator vm-convert-folder-type-headers vm-digest-get-header-contents vm-parse-structured -header vm-energize-headers vm-mime-parse-content-header vm-headers-of vm-set-he aders-of vm-match-ordered-header vm-mm-encoded-header vm-vheaders-regexp-of vm-s tartup-apply-header-variables vm-matched-header-contents-start vm-mime-get-heade r-contents vm-reorder-message-headers vm-matched-header-contents vm-matched-head er-contents-end vm-set-mime-encoded-header-flag-of vm-mail-mode-get-header-conte nts vm-highlight-headers-maybe vm-matched-header-end vm-stuff-header-variables v m-forward-message-all-headers vm-match-header vm-mm-layout-header-start vm-remov e-mail-mode-header-separator vm-matched-header vm-energize-headers-and-xfaces vm -vheaders-of vm-highlight-headers vm-forward-message-all-headers-other-frame vm- matched-header-name vm-convert-folder-header vm-folder-header vm-matched-header- name-end vm-decode-mime-message-headers vm-save-message-sans-headers vm-matched- header-start vm-gobble-visible-header-variables vm-mime-insert-mime-headers vm-m atched-header-name-start vm-vs-header-or-text vm-set-vheaders-regexp-of vm-build I haven't tried to reproduce it yet: I think I was executing M-x apropos RET vm.*mark RET when it died, so this may have happened somewhere in hyper-apropos. I'm currently recompiling with more debuging and error checking information, and I'll try to reproduce it then. Tips and suggestions are very welcome! Thanks, -- Sam Mikes smikes(a)alumni.hmc.edu