21.2.35 crash in GC on Solaris 2.7

I've been seeing this crash fairly often of late. I haven't changed anything, and the frequency of crashes is becoming annoying. I wasn't doing anything unusual; just editing a file, and switching between buffers. Poof, XEmacs is gone. Unfortunately, I haven't figured out a repeatable test case. It always happens sometime after my recycle GC cursor shows up. I think GC is just about done when XEmacs crashes. Ray No lisp backtrace. C backtrace: #0 0xfeb16870 in _libc_kill () from /usr/lib/libc.so.1 #1 0xa9924 in fatal_error_signal (sig=6) at emacs.c:514 #2 <signal handler called> #3 0xfeb16870 in _libc_kill () from /usr/lib/libc.so.1 #4 0xfeab92a4 in abort () from /usr/lib/libc.so.1 #5 0xac9f4 in assert_failed (file=0x9b7 <Address 0x9b7 out of bounds>, line=2503592, expr=0x2633a8 "GCLI_lh != 0") at emacs.c:3118 #6 0x6a754 in mark_object (obj=0) at alloc.c:2487 #7 0x6c350 in garbage_collect_1 () at alloc.c:3459 #8 0xb4038 in Ffuncall (nargs=1, args=0xffbec97c) at eval.c:3163 #9 0x7bc6c in execute_optimized_program (program=0xffbec97c "", stack_depth=1, constants_data=0x819d10) at bytecode.c:745 #10 0x7b49c in funcall_compiled_function (fun=4046948, nargs=3, args=0xffbecbe0) at bytecode.c:517 #11 0xb43e4 in Ffuncall (nargs=3, args=0xffbecbd8) at eval.c:3249 #12 0xb54dc in call3 (fn=8511708, arg0=3358668, arg1=7681940, arg2=3246084) at eval.c:3898 #13 0x12b054 in Fexpand_file_name (name=7681940, default_directory=3246084) at fileio.c:767 #14 0xb4218 in Ffuncall (nargs=2, args=0xffbecdb0) at eval.c:3214 #15 0xb4b00 in Fapply (nargs=2, args=0xffbecf58) at eval.c:3486 #16 0xb4398 in Ffuncall (nargs=2, args=0xffbecf54) at eval.c:3235 #17 0x7bc6c in execute_optimized_program (program=0xffbecf54 "", stack_depth=2, constants_data=0x819c10) at bytecode.c:745 #18 0x7b49c in funcall_compiled_function (fun=4046948, nargs=3, args=0xffbed1b8) at bytecode.c:517 #19 0xb43e4 in Ffuncall (nargs=3, args=0xffbed1b0) at eval.c:3249 #20 0xb54dc in call3 (fn=8511900, arg0=3358668, arg1=7681940, arg2=3246084) at eval.c:3898 #21 0x12b054 in Fexpand_file_name (name=7681940, default_directory=3246084) at fileio.c:767 #22 0x6e71c in Fget_file_buffer (filename=7681940) at buffer.c:451 #23 0xb4204 in Ffuncall (nargs=1, args=0xffbed578) at eval.c:3214 #24 0xb495c in Fapply (nargs=2, args=0xffbed578) at eval.c:3429 #25 0xb4398 in Ffuncall (nargs=2, args=0xffbed574) at eval.c:3235 #26 0x7bc6c in execute_optimized_program (program=0xffbed574 "", stack_depth=2, constants_data=0x819d10) at bytecode.c:745 #27 0x7b49c in funcall_compiled_function (fun=4046948, nargs=2, args=0xffbed7d8) at bytecode.c:517 #28 0xb43e4 in Ffuncall (nargs=2, args=0xffbed7d0) at eval.c:3249 #29 0xb548c in call2 (fn=8511708, arg0=3247620, arg1=7681940) at eval.c:3881 #30 0x6e754 in Fget_file_buffer (filename=7681940) at buffer.c:459 #31 0xb4204 in Ffuncall (nargs=1, args=0xffbedb00) at eval.c:3214 #32 0xb495c in Fapply (nargs=2, args=0xffbedb00) at eval.c:3429 #33 0xb4398 in Ffuncall (nargs=2, args=0xffbedafc) at eval.c:3235 #34 0x7bc6c in execute_optimized_program (program=0xffbedafc "", stack_depth=2, constants_data=0x819c10) at bytecode.c:745 #35 0x7b49c in funcall_compiled_function (fun=4046948, nargs=2, args=0xffbedd60) at bytecode.c:517 #36 0xb43e4 in Ffuncall (nargs=2, args=0xffbedd58) at eval.c:3249 #37 0xb548c in call2 (fn=8511900, arg0=3247620, arg1=7681940) at eval.c:3881 #38 0x6e754 in Fget_file_buffer (filename=7681940) at buffer.c:459 #39 0x6ee58 in get_truename_buffer (filename=7681940) at buffer.c:544 #40 0xc379c in lock_file (fn=7681940) at filelock.c:324 #41 0x18300c in prepare_to_modify_buffer (buf=0x9c6200, start=3223, end=3223, lockit=1) at insdel.c:2328 #42 0x18337c in buffer_insert_string_1 (buf=0x9c6200, pos=3223, nonreloc=0xffbee180 "#", reloc=3246084, offset=0, length=1, flags=0) at insdel.c:2453 #43 0x18414c in buffer_insert_emacs_char_1 (buf=0x9c6200, pos=-1, ch=35, flags=0) at insdel.c:2619 #44 0x8d830 in internal_self_insert (c1=35, noautofill=0) at cmds.c:420 #45 0x8d130 in Fself_insert_command (n=0) at cmds.c:311 #46 0xb4204 in Ffuncall (nargs=1, args=0xffbee388) at eval.c:3214 #47 0x82374 in Fcall_interactively (function=3328316, record_flag=3246084, keys=3246084) at callint.c:946 #48 0xb2b6c in Fcommand_execute (cmd=3328316, record=3246084, keys=3246084) at eval.c:2652 #49 0x10f450 in execute_command_event (command_builder=0x656780, event=9971060) at event-stream.c:3838 #50 0x10fea0 in Fdispatch_event (event=9971060) at event-stream.c:4157 #51 0x8c304 in Fcommand_loop_1 () at cmdloop.c:579 #52 0x8c044 in command_loop_1 (dummy=6614784) at cmdloop.c:494 #53 0xb00b4 in condition_case_1 (handlers=3246180, bfun=0x8bff8 <command_loop_1>, barg=3246084, hfun=0x8c4e4 <cmd_error>, harg=3246084) at eval.c:1640 #54 0x8c5f4 in command_loop_2 (dummy=3246084) at cmdloop.c:256 #55 0xafc24 in internal_catch (tag=3328196, func=0x8c5a8 <command_loop_2>, arg=3246084, threw=0x0) at eval.c:1306 #56 0x8b940 in initial_command_loop (load_me=574888) at cmdloop.c:305 #57 0xab64c in xemacs_21_2_b35_sparc_sun_solaris2_7 (argc=1, argv=0xffbeecfc, envp=0xffbeed04, restart=0) at emacs.c:2155 #58 0xabe70 in main (argc=1, argv=0xffbeecfc, envp=0xffbeed04) at emacs.c:2584