Here is the VC++ CallStack for another of these crashes. They typically happens while clicking in a Gnus Summary buffer (gnus-version "Pterodactyl Gnus v0.66"), 21.2-b5+. Line 717 in lisp.h is where it ends: => DECLARE_LRECORD (cons, Lisp_Cons); Or, even more precisely in this assembly code which above macro expands to: 717: DECLARE_LRECORD (cons, Lisp_Cons); 01001410 push ebp 01001411 mov ebp,esp 01001413 push ecx 01001414 xor eax,eax 01001416 test eax,eax 01001418 jne error_check_cons+4 (01001414) 0100141A mov ecx,dword ptr [obj] 0100141D and ecx,3 01001420 test ecx,ecx 01001422 jne error_check_cons+28h (01001438) 01001424 mov edx,dword ptr [obj] 01001427 xor eax,eax 01001429 mov al,byte ptr [edx] 0100142B cmp dword ptr [eax*4+118BB9Ch],offset _lrecord_cons (012455a0) 01001436 je error_check_cons+58h (01001468) 01001438 cmp dword ptr [_gc_in_progress (0118bb2c)],0 0100143F je error_check_cons+3Ch (0100144c) 01001441 mov ecx,dword ptr [obj] 01001444 movsx edx,byte ptr [ecx+1] 01001448 test edx,edx 0100144A jne error_check_cons+58h (01001468) 0100144C push offset string "RECORD_TYPEP (obj, lrecord_cons)"... (011860cc) 01001451 push 2CDh 01001456 push offset string "..\\src\\lisp.h" (011860bc) 0100145B call assert_failed (01053a8f) => 01001460 add esp,0Ch 01001463 mov dword ptr [ebp-4],eax 01001466 jmp error_check_cons+5Fh (0100146f) 01001468 mov dword ptr [ebp-4],0 0100146F mov eax,dword ptr [obj] 01001472 mov esp,ebp 01001474 pop ebp 01001475 ret And here the CallStack (I still don't know what is meant by debug_backtrace()): NTDLL! 77f76148() error_check_cons(Lisp_Object {...}) line 717 + 80 bytes condition_case_unwind(Lisp_Object {...}) line 1521 + 9 bytes unbind_to_hairy(int 0x00000017) line 4625 + 18 bytes unbind_to(int 0x00000017, Lisp_Object {...}) line 4600 + 181 bytes garbage_collect_1() line 4548 + 16 bytes Ffuncall(int 0x00000001, Lisp_Object * 0x0082ec08) line 3137 execute_optimized_program(const unsigned char * 0x106eb118, int 0x00000006, Lisp_Object * 0x105eed10) line 750 + 16 bytes funcall_compiled_function(Lisp_Object {...}, int 0x00000000, Lisp_Object * 0x0082ee74) line 530 + 53 bytes Feval(Lisp_Object {...}) line 3045 + 20 bytes Fprogn(Lisp_Object {...}) line 761 + 9 bytes funcall_lambda(Lisp_Object {...}, int 0x00000000, Lisp_Object * 0x0082f0e8) line 3508 + 9 bytes Ffuncall(int 0x00000001, Lisp_Object * 0x0082f0e4) line 3229 + 17 bytes execute_optimized_program(const unsigned char * 0x0082f2d8, int 0x00000004, Lisp_Object * 0x01225b3c) line 750 + 16 bytes Fbyte_code(Lisp_Object {...}, Lisp_Object {...}, Lisp_Object {...}) line 2400 + 38 bytes Feval(Lisp_Object {...}) line 2986 + 195 bytes condition_case_1(Lisp_Object {...}, Lisp_Object (Lisp_Object)* 0x01058b06 Feval(Lisp_Object), Lisp_Object {...}, Lisp_Object (Lisp_Object, Lisp_Object)* 0x0105643e run_condition_case_handlers(Lisp_Object, Lisp_Object), Lisp_Object {...}) line 1640 + 7 bytes condition_case_3(Lisp_Object {...}, Lisp_Object {...}, Lisp_Object {...}) line 1721 + 27 bytes execute_rare_opcode(Lisp_Object * 0x0082f630, const unsigned char * 0x01225e12, int 0x0000008f) line 1275 + 19 bytes execute_optimized_program(const unsigned char * 0x01225d4c, int 0x00000008, Lisp_Object * 0x01225994) line 660 + 17 bytes funcall_compiled_function(Lisp_Object {...}, int 0x00000001, Lisp_Object * 0x0082f92c) line 530 + 53 bytes Ffuncall(int 0x00000002, Lisp_Object * 0x0082f928) line 3221 + 17 bytes execute_optimized_program(const unsigned char * 0x01226764, int 0x00000005, Lisp_Object * 0x01226708) line 750 + 16 bytes funcall_compiled_function(Lisp_Object {...}, int 0x00000001, Lisp_Object * 0x0082fc24) line 530 + 53 bytes Ffuncall(int 0x00000002, Lisp_Object * 0x0082fc20) line 3221 + 17 bytes call1(Lisp_Object {...}, Lisp_Object {...}) line 3834 + 11 bytes execute_internal_event(Lisp_Object {...}) line 3044 + 19 bytes Fdispatch_event(Lisp_Object {...}) line 4689 + 9 bytes Fcommand_loop_1() line 578 + 9 bytes command_loop_1(Lisp_Object {...}) line 494 condition_case_1(Lisp_Object {...}, Lisp_Object (Lisp_Object)* 0x0103a91e command_loop_1(Lisp_Object), Lisp_Object {...}, Lisp_Object (Lisp_Object, Lisp_Object)* 0x0103a3ab cmd_error(Lisp_Object, Lisp_Object), Lisp_Object {...}) line 1640 + 7 bytes command_loop_3() line 255 + 35 bytes command_loop_2(Lisp_Object {...}) line 267 internal_catch(Lisp_Object {...}, Lisp_Object (Lisp_Object)* 0x0103a513 command_loop_2(Lisp_Object), Lisp_Object {...}, int * volatile 0x00000000) line 1315 + 7 bytes initial_command_loop(Lisp_Object {...}) line 304 + 25 bytes STACK_TRACE_EYE_CATCHER(int 0x00000001, char * * 0x10105680, char * * 0x101ce100, int 0x00000000) line 1715 + 9 bytes main(int 0x00000001, char * * 0x10105680, char * * 0x101ce100) line 2144 + 21 bytes XEMACS! mainCRTStartup + 180 bytes _start() line 165 KERNEL32! 77f1b304() -- Adrian Aichner European Design Center Teradyne GmbH Semiconductor Test Group Telephone +49/89/41861(0)-208 Dingolfinger Strasse 2 Fax +49/89/41861-217 (What is a Fax?) D-81673 MUENCHEN E-mail adrian.aichner(a)teradyne.com