Adrian, Colin, could you please confirm that this patch fixes the problem? The patch disallows attaching glyphs to extents unless glyphs are of type `buffer', which prevents the crash for me. It might still be possible to muck things up by attaching an empty `buffer' glyph to an extent, and then attaching a, say, `pointer' image instance object to the glyph, but I was unable to prove it. 1998-12-14 Hrvoje Niksic <hniksic(a)srce.hr&gt; * extents.c (set_extent_glyph_1): Make sure that the glyph we attach to the extent is valid. --- src/extents.c.orig Mon Dec 14 23:08:54 1998 +++ src/extents.c Mon Dec 14 23:17:45 1998 ＠＠ -5009,10 +5009,10 ＠＠ EXTENT extent = decode_extent (extent_obj, DE_MUST_HAVE_BUFFER); glyph_layout layout = symbol_to_glyph_layout (layout_obj); - /* Make sure we've actually been given a glyph or it's nil (meaning - we're deleting a glyph from an extent). */ + /* Make sure we've actually been given a valid glyph or it's nil + (meaning we're deleting a glyph from an extent). */ if (!NILP (glyph)) - CHECK_GLYPH (glyph); + CHECK_BUFFER_GLYPH (glyph); set_extent_glyph (extent, glyph, endp, layout); return glyph;