Emacs crash on linux

[Yoichi NAKAYAMA]

I'm running emacs-21.3.50 (cvs version) on linux and it crashes
several times in malloc.c. Following is a trace I got just now
with emacs installed yesterday. And the next one is what I got
yesterday with emacs installed some times ago.

Regards,
-- 
Yoichi NAKAYAMA

% TZ=UTC LANG=C ls -l =emacs-21.3.50
-rwxr-xr-t    2 root     root      9236510 Oct 19 15:19 
/usr/local/bin/emacs-21.3.50

Program received signal SIGSEGV, Segmentation fault.
mark_object (arg=137129088) at alloc.c:4991
4991              MARK_STRING (XSTRING (ptr->xname));
(gdb) p *ptr
$1 = {gcmarkbit = 1, indirect_variable = 0, constant = 0, interned = 0, 
  xname = 0, value = 0, function = 0, plist = 0, next = 0x0}
(gdb) bt
#0  mark_object (arg=137129088) at alloc.c:4991
#1  0x0813e48f in mark_object (arg=137129088) at alloc.c:4974
#2  0x0813e48f in mark_object (arg=137129088) at alloc.c:4974
#3  0x0813de33 in Fgarbage_collect () at alloc.c:4458
#4  0x0817e9b3 in Fbyte_code (bytestr=137671617, vector=132, 
    maxdepth=-1073755312) at bytecode.c:737
#5  0x08153db6 in funcall_lambda (fun=136105772, nargs=1, 
    arg_vector=0xbfffcc74) at eval.c:2923
#6  0x0815396c in Ffuncall (nargs=2, args=0xbfffcc70) at eval.c:2793
#7  0x0817db4f in Fbyte_code (bytestr=137671281, vector=1, 
    maxdepth=-1073755024) at bytecode.c:686
#8  0x08153db6 in funcall_lambda (fun=136105772, nargs=1, 
    arg_vector=0xbfffcd94) at eval.c:2923
#9  0x0815396c in Ffuncall (nargs=2, args=0xbfffcd90) at eval.c:2793
#10 0x0817db4f in Fbyte_code (bytestr=137671281, vector=1, 
    maxdepth=-1073754736) at bytecode.c:686
#11 0x08153db6 in funcall_lambda (fun=136105772, nargs=1, 
    arg_vector=0xbfffceb4) at eval.c:2923
#12 0x0815396c in Ffuncall (nargs=2, args=0xbfffceb0) at eval.c:2793
#13 0x0817db4f in Fbyte_code (bytestr=137671281, vector=1, 
    maxdepth=-1073754448) at bytecode.c:686
#14 0x08153db6 in funcall_lambda (fun=136105772, nargs=1, 
    arg_vector=0xbfffcfd4) at eval.c:2923
#15 0x0815396c in Ffuncall (nargs=2, args=0xbfffcfd0) at eval.c:2793
#16 0x0817db4f in Fbyte_code (bytestr=137671281, vector=1, 
    maxdepth=-1073754160) at bytecode.c:686
#17 0x08153db6 in funcall_lambda (fun=136105772, nargs=1, 
    arg_vector=0xbfffd0f4) at eval.c:2923
#18 0x0815396c in Ffuncall (nargs=2, args=0xbfffd0f0) at eval.c:2793


Following is another one I got yesterday with old emacs
which I've installed about 3 weeks ago.
(I've got similar crash several times)

% ls -l =emacs-21.3.50
-rwxr-xr-t    2 root     root      9229846  Sep 27 3:59 
/usr/local/bin/emacs-21.3.50

Program received signal SIGSEGV, Segmentation fault.
0x0813d63c in mark_object (arg=10176) at alloc.c:4793
4793            MARK_INTERVAL_TREE (ptr->intervals);
(gdb) p *ptr
$1 = {size = 157760, size_byte = 10168, intervals = 0x27c0,
  data = 0x27c8 <Address 0x27c8 out of bounds>}
(gdb) where
#0  0x0813d63c in mark_object (arg=10176) at alloc.c:4793
#1  0x0813d9af in mark_object (arg=10176) at alloc.c:4974
#2  0x0818e757 in traverse_intervals_noorder (tree=0x85d604c,
    function=0x813abd0 <mark_interval>, arg=137426369) at intervals.c:207
#3  0x0818e77c in traverse_intervals_noorder (tree=0x85f60a0,
    function=0x813abd0 <mark_interval>, arg=137426369) at intervals.c:212
#4  0x0818e77c in traverse_intervals_noorder (tree=0x9715084,
    function=0x813abd0 <mark_interval>, arg=137426369) at intervals.c:212
#5  0x0813ac0a in mark_interval_tree (tree=0x941f058) at alloc.c:1235
#6  0x0813dd65 in mark_buffer (buf=10176) at alloc.c:5145
#7  0x0813d68c in mark_object (arg=10176) at alloc.c:4986
#8  0x0813d9af in mark_object (arg=10176) at alloc.c:4974
#9  0x0813d696 in mark_object (arg=10176) at alloc.c:4987
#10 0x0813d9af in mark_object (arg=10176) at alloc.c:4974
#11 0x0813d696 in mark_object (arg=10176) at alloc.c:4987
#12 0x0813dc31 in mark_object (arg=10176) at alloc.c:5099
#13 0x0813dc31 in mark_object (arg=10176) at alloc.c:5099
#14 0x0813dd2e in mark_buffer (buf=10176) at alloc.c:5156
#15 0x0813d68c in mark_object (arg=10176) at alloc.c:4986
#16 0x0813dc31 in mark_object (arg=10176) at alloc.c:5099
#17 0x0813d875 in mark_object (arg=10176) at alloc.c:4849
#18 0x0813d696 in mark_object (arg=10176) at alloc.c:4987
#19 0x0813d9af in mark_object (arg=10176) at alloc.c:4974