Built 21.2.31 from a full tarball on Solaris 2.7 using gcc 2.7.2.x. The following recipe gives me a 100% repeatable crash when balloon-help tries to pop up its help window. xemacs -vanilla In the *scratch* buffer, evaluate the following (balloon-help-mode) Now place the mouse over one of the toolbar buttons. Instant crash. Here's the Lisp backtrace: Lisp backtrace follows: # (unwind-protect ...) # (catch #<INTERNAL OBJECT (XEmacs bug?) (opaque_ptr, adr=0x2b31f8) 0x318000> ...) # (unwind-protect ...) # (unwind-protect ...) # bind (inhibit-quit) # (condition-case ... . error) # (catch top-level ...) Abort (core dumped) Here's the C backtrace: #0 0xfec16870 in _libc_kill () from /usr/lib/libc.so.1 #1 0xa3870 in fatal_error_signal (sig=6) at emacs.c:272 #2 <signal handler called> #3 0xfec16870 in _libc_kill () from /usr/lib/libc.so.1 #4 0xfebb92a4 in abort () from /usr/lib/libc.so.1 #5 0xa6598 in assert_failed (file=0x261ff8 "glyphs.h", line=808, expr=0x262058 "RECORD_TYPEP (obj, lrecord_type_glyph)") at emacs.c:2770 #6 0x147d5c in text_query_geometry (image_instance=7900800, width=0xffbed8e0, height=0xffbed8dc, disp=IMAGE_DESIRED_GEOMETRY, domain=7829504) at glyphs.c:1168 #7 0x13f91c in image_instance_layout (image_instance=7900800, width=4294967295, height=4294967295, domain=7829504) at glyphs.c:1699 #8 0x13c5cc in instantiate_image_instantiator (device=6454272, domain=7829504, instantiator=7779296, pointer_fg=6919424, pointer_bg=6700384, dest_mask=-1, glyph=3276160) at glyphs.c:615 #9 0x141f90 in image_instantiate (specifier=2599060, matchspec=6454272, domain=7829504, instantiator=7779296, depth=6919424) at glyphs.c:2831 #10 0xaa504 in call_with_suspended_errors_1 (opaque_arg=-4269120) at eval.c:2046 #11 0xaa924 in call_with_suspended_errors (fun=0x1419b4 <image_instantiate>, retval=2599060, class=3024900, errb=Cannot access memory at address 0x2a. ) at eval.c:1304 #12 0x1c1b4c in specifier_instance_from_inst_list (specifier=3560896, matchspec=2599060, domain=7829504, inst_list=6340592, errb=Cannot access memory at address 0x2a. ) at specifier.c:2455 #13 0x1c1f10 in specifier_instance (specifier=3560896, matchspec=2599060, domain=7829504, errb= Cannot access memory at address 0x2a. ) at specifier.c:2564 #14 0x116e90 in update_face_cachel_data (cachel=0xffbede28, domain=7829504, face=3276160) at faces.c:1194 #15 0x117abc in add_face_cachel (w=0x777800, face=3276160) at faces.c:1330 #16 0x117d38 in reset_face_cachels (w=0x777800) at faces.c:1361 #17 0x196c4c in redisplay_window (window=7829504, skip_selected=1) at redisplay.c:5936 #18 0x197ad8 in redisplay_frame (f=0x777a00, preemption_check=268435456) at redisplay.c:6410 #19 0x197ec0 in redisplay_device (d=0x627c00, automatic=7830016) at redisplay.c:6518 #20 0x1982ac in redisplay_without_hooks () at redisplay.c:6577 #21 0x198514 in redisplay () at redisplay.c:6634 #22 0xfbadc in Fnext_event (event=7662616, prompt=3024900) at event-stream.c:2238 #23 0x87708 in Fcommand_loop_1 () at cmdloop.c:566 #24 0x874ac in command_loop_1 (dummy=3024900) at cmdloop.c:490 #25 0xa9764 in condition_case_1 (handlers=2804736, bfun=0x87460 <command_loop_1>, barg=3024900, hfun=0x878f8 <cmd_error>, harg=3024900) at eval.c:1629 #26 0x87a08 in command_loop_2 (dummy=3024900) at cmdloop.c:252 #27 0xa9338 in internal_catch (tag=3107060, func=0x879bc <command_loop_2>, arg=3024900, threw=0x0) at eval.c:1304 #28 0x86de0 in initial_command_loop (load_me=555452) at cmdloop.c:301 #29 0xa540c in xemacs_21_2_b31_sparc_sun_solaris2_7 (argc=2, argv=0xffbeeb5c, envp=0xffbeeb68, restart=0) at emacs.c:1879 #30 0xa5c28 in main (argc=2, argv=0xffbeeb5c, envp=0xffbeeb68) at emacs.c:2305