Marcus> I'll commit in a few days to clear the way for Stephen's Xft merge, if Marcus> nobody objects. I've managed to get this crash on Fedora Core 3 while using, as you might have guessed, Gnus. I've also seen asserts while recompiling the core lisp core on FC3 and Solaris 10, but frustratingly I haven't managed to reproduce these when I tried to produce better debugging information for you. Malcolm Fatal Error: Received SIGSEGV (11) for address 0x34 Program received signal SIGABRT, Aborted. [Switching to Thread -1208432000 (LWP 4312)] 0xb7fcd402 in __kernel_vsyscall () (gdb) where #0 0xb7fcd402 in __kernel_vsyscall () #1 0x00632c76 in kill () from /lib/tls/libc.so.6 #2 0x080e7e94 in fatal_error_signal (sig=11) at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/emacs.c:3765 #3 <signal handler called> #4 0x08117124 in detagged_lisp_object_size (h=0xb93f0b0) at lrecord.h:1786 #5 0x081e05e9 in remove_cell (ptr=0xb93f0b0, ph=0xbc03c08) at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/mc-alloc.c:1452 #6 0x081e0aa3 in sweep_page (ph=0xbc03c08) at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/mc-alloc.c:1618 #7 0x081df070 in visit_all_used_page_headers (f=0x81e0974 <sweep_page>) at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/mc-alloc.c:449 #8 0x081e0b09 in mc_sweep () at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/mc-alloc.c:1634 #9 0x08175c99 in gc_sweep () at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/gc.c:1718 #10 0x08176105 in gc_1 (incremental=1) at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/gc.c:1897 #11 0x08176142 in gc (incremental=1) at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/gc.c:1917 #12 0x08176199 in gc_incremental () at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/gc.c:1946 #13 0x080f2571 in Ffuncall (nargs=3, args=0xbf9cb414) at /home/malcolmp/builds/xemacs/sandboxen/garbage/src/eval.c:3822 [...] (gdb) up #4 0x08117124 in detagged_lisp_object_size (h=0xb93f0b0) at lrecord.h:1786 1786 return (imp->size_in_bytes_method ? (gdb) print imp $1 = (const struct lrecord_implementation *) 0x0 (gdb) print *h $2 = {type = 112, lisp_readonly = 0, free = 0, uid = 165967} (gdb) print lrecord_implementations_table $3 = {0x8320e20, 0x8320f40, 0x8320ee0, 0x8320e80, 0x8320a00, 0x82fe540, 0x82ef920, 0x82ef9e0, 0x82efb00, 0x82f2580, 0x82f4bc0, 0x830aca0, 0x830aae0, 0x82fc3e0, 0x8313d00, 0x8317e60, 0x8315260, 0x83087c0, 0x82f34a0, 0x82f32c0, 0x8319180, 0x8317340, 0x83173e0, 0x82f07e0, 0x8306700, 0x8306220, 0x8305e60, 0x83146e0, 0x82ff4e0, 0x8312340, 0x83000c0, 0x83001a0, 0x831fba0, 0x82f4020, 0x82fa6c0, 0x830bda0, 0x832b380, 0x832b4a0, 0x0, 0x83104e0, 0x0, 0x8310ec0, 0x83109c0, 0x8316b20, 0x8316ce0, 0x830e7c0, 0x830f160, 0x8307400, 0x82f55e0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82f30c0, 0x0, 0x0, 0x0, 0x82f4ce0, 0x82f4dc0, 0x0, 0x0, 0x0, 0x82efc20, 0x82efb80, 0x82fc2c0, 0x8321b40, 0x82f03a0, 0x82f1480, 0x83239e0, 0x82f4660, 0x0, 0x832aaa0, 0x832ab80, 0x832ac00, 0x832ace0, 0x8325220, 0x0, 0x8323c60, 0x0, 0x0, 0x8328860, 0x0, 0x0, 0x8305ee0, 0x8305fc0, 0x8306060, 0x8306100, 0x8306180, 0x8323ec0, 0x8323f40, 0x831fa20, 0x830b940, 0x0 <repeats 32 times>} -- Malcolm Purvis <malcolmp(a)xemacs.org&gt;