emacs crashes at search-backward

[Yoichi NAKAYAMA]

I meet emacs crash at entering specific IMAP folder with wanderlust.
I'm using emacs-22.0.50 obtained from cvs trunk at Apr 10. It crashes
every time I do the operation. Following is the backtrace:

(gdb) bt
#0  0x4e8273f1 in kill () from /lib/libc.so.6
#1  0x080e6ed9 in fatal_error_signal (sig=12292) at emacs.c:430
#2  <signal handler called>
#3  0x08124ae7 in simple_search (n=180836955, pat=0x92294 <Address 0x92294 out 
of bounds>, len=598820, len_byte=1, trt=1, pos=-1, pos_byte=0, lim=139377756, 
lim_byte=139470164) at search.c:1487
#4  0x08124126 in search_buffer (string=-1075321248, pos=598676, 
pos_byte=598820, lim=1, lim_byte=1, n=-1, RE=0, trt=139377756, 
inverse_trt=139470164, posix=0) at search.c:1351
#5  0x08123c3f in search_command (string=180836955, bound=180836955, 
noerror=137521473, count=0, direction=-1, RE=0, posix=0) at search.c:939
#6  0x081260d1 in Fsearch_backward (string=180836955, bound=137521425, 
noerror=137521473, count=137521425) at search.c:2122
#7  0x0814d259 in Ffuncall (nargs=4, args=0xbfe7e7e0) at eval.c:2901
#8  0x081767dd in Fbyte_code (bytestr=137682185, vector=3, 
maxdepth=-1075320752) at bytecode.c:694
#9  0x0814d57d in funcall_lambda (fun=56, nargs=2, arg_vector=0xbfe7e984) at 
eval.c:3088
#10 0x0814d133 in Ffuncall (nargs=3, args=0xbfe7e980) at eval.c:2956
#11 0x081767dd in Fbyte_code (bytestr=145432665, vector=2, 
maxdepth=-1075320448) at bytecode.c:694
#12 0x0814d57d in funcall_lambda (fun=104, nargs=3, arg_vector=0xbfe7ead4) at 
eval.c:3088
#13 0x0814d133 in Ffuncall (nargs=4, args=0xbfe7ead0) at eval.c:2956
#14 0x0814cac3 in Fapply (nargs=2, args=0xbfe7eb94) at eval.c:2393
#15 0x0814d311 in Ffuncall (nargs=3, args=0xbfe7eb90) at eval.c:2882
#16 0x081767dd in Fbyte_code (bytestr=137776913, vector=2, 
maxdepth=-1075319920) at bytecode.c:694
#17 0x0814d57d in funcall_lambda (fun=24, nargs=3, arg_vector=0xbfe7ecb4) at 
eval.c:3088
#18 0x0814d133 in Ffuncall (nargs=4, args=0xbfe7ecb0) at eval.c:2956
#19 0x081767dd in Fbyte_code (bytestr=145161097, vector=3, 
maxdepth=-1075319632) at bytecode.c:694
#20 0x0814d57d in funcall_lambda (fun=80, nargs=4, arg_vector=0xbfe7edf4) at 
eval.c:3088
#21 0x0814d133 in Ffuncall (nargs=5, args=0xbfe7edf0) at eval.c:2956
#22 0x081767dd in Fbyte_code (bytestr=144860705, vector=4, 
maxdepth=-1075319312) at bytecode.c:694
#23 0x0814d57d in funcall_lambda (fun=40, nargs=1, arg_vector=0xbfe7ef24) at 
eval.c:3088
#24 0x0814d133 in Ffuncall (nargs=2, args=0xbfe7ef20) at eval.c:2956
#25 0x081767dd in Fbyte_code (bytestr=144971993, vector=1, 
maxdepth=-1075319008) at bytecode.c:694
#26 0x0814c81b in Feval (form=137224856) at eval.c:2241
#27 0x08149ea0 in Fprogn (args=-1075322288) at eval.c:432
#28 0x0814dd96 in unbind_to (count=31, value=137521425) at eval.c:3257
#29 0x0817684b in Fbyte_code (bytestr=137521425, vector=1, 
maxdepth=-1075318516) at bytecode.c:716
#30 0x0814d57d in funcall_lambda (fun=48, nargs=5, arg_vector=0xbfe7f244) at 
eval.c:3088
#31 0x0814d133 in Ffuncall (nargs=6, args=0xbfe7f240) at eval.c:2956
#32 0x081767dd in Fbyte_code (bytestr=137756281, vector=5, 
maxdepth=-1075318208) at bytecode.c:694
#33 0x0814d57d in funcall_lambda (fun=72, nargs=1, arg_vector=0xbfe7f3b4) at 
eval.c:3088
#34 0x0814d133 in Ffuncall (nargs=2, args=0xbfe7f3b0) at eval.c:2956
#35 0x0814891c in Fcall_interactively (function=145870657, 
record_flag=137521425, keys=137561924) at callint.c:884
#36 0x080f51b5 in Fcommand_execute (cmd=145870657, record_flag=137521425, 
keys=137521425, special=137521425) at keyboard.c:9759
#37 0x080ea1e0 in command_loop_1 () at keyboard.c:1791
#38 0x0814b5da in internal_condition_case (bfun=0x80e9e70 <command_loop_1>, 
handlers=137566065, hfun=0x80e9960 <cmd_error>) at eval.c:1473
#39 0x080e9c86 in command_loop_2 () at keyboard.c:1328
#40 0x0814b0da in internal_catch (tag=0, func=0x80e9c60 <command_loop_2>, 
arg=137521425) at eval.c:1211
#41 0x080e9c35 in command_loop () at keyboard.c:1307
#42 0x080e96a0 in recursive_edit_1 () at keyboard.c:1000
#43 0x080e97ec in Frecursive_edit () at keyboard.c:1061
#44 0x080e7e36 in main (argc=3, argv=0xbfe7fb84) at emacs.c:1789
#45 0x4e81362e in __libc_start_main () from /lib/libc.so.6

Lisp Backtrace:
"search-backward"
"wl-summary-search-by-subject"
"wl-summary-insert-thread"
"apply"
"wl-summary-insert-message"
"wl-summary-sync-update"
"wl-summary-sync-force-update"
"byte-code"
"wl-summary-goto-folder-subr"
"wl-folder-jump-to-current-entity"
"call-interactively"

Regards,
-- 
Yoichi NAKAYAMA