crashes during Feval from within WINDOW_WANTS_HEADER_LINE_P

[David Reitter]

I'm getting crashes after extending a macro.  I would appreciate your  
help.

I have added to the WINDOW_WANTS_HEADER_LINE_P macro (dispextern.h) a  
function call to an elisp function whose name is stored in `window- 
wants-header-line-function':

      && (NILP(Vwindow_wants_header_line_function)  
||                   \
          !NILP (safe_call_win(Vwindow_wants_header_line_function, (W)))))



safe_call_win looks pretty straight-forward:

/* Call function FN with window argument.
   Return the result, or nil if something went wrong. */

Lisp_Object
safe_call_win (fn, w)
     Lisp_Object fn;
     struct window *w;
{
  Lisp_Object window;
  Lisp_Object val;
  struct gcpro gcpro1;
  val = Qnil;
  window = Qnil;
  if ((FUNCTIONP (fn)))
    {
      XSETWINDOW (window, w);
      GCPRO1 (window);
      val = safe_call1 (fn, window);
      UNGCPRO;
    }
  return val;
}

However, I keep getting crashes, always during the evaluation of said  
function:

5   libSystem.B.dylib                   0x966639af abort + 73
6   org.gnu.Emacs                       0x000f320b Feval + 923 (eval.c:2362)
7   org.gnu.Emacs                       0x000f360f Fprogn + 63 (eval.c:450)
8   org.gnu.Emacs                 	0x000f38df funcall_lambda + 671  
(eval.c:3185)
9   org.gnu.Emacs                 	0x000f3c2b Ffuncall + 443 (eval.c: 
3062)
10  org.gnu.Emacs                 	0x000f1f3a  
internal_condition_case_2 + 266 (eval.c:1583)
11  org.gnu.Emacs                 	0x0001717e safe_call + 158 (xdisp.c: 
2348)
12  org.gnu.Emacs                 	0x000171c5 safe_call1 + 37 (xdisp.c: 
2362)
13  org.gnu.Emacs                 	0x00017278 safe_call_win + 168  
(xdisp.c:2382)
14  org.gnu.Emacs                 	0x0016cc4b draw_fringe_bitmap_1 +  
1467 (fringe.c:669)
15  org.gnu.Emacs                 	0x0016cf2a draw_fringe_bitmap + 90  
(fringe.c:868)

The elisp function that is called just evaluates to nil or t and  
doesn't do anything else. (It does work in some cases.)
The crashes do not depend on the `window' argument, and they do not go  
away if I play around with the GCPRO call or an additional BLOCK_INPUT.

What's going on?