emacs core dump: getenv problem?

[Thomas Klausner <tk%giga.or.at@localhost>]

When I run the GTK version of emacs (24) on any of
pkgsrc/doc/guide/files/*xml, I get a coredump ('emacs -nw file.xml'
works fine!)

The backtrace is
(gdb) r debug.xml
Starting program: /usr/pkg/bin/emacs debug.xml

Program received signal SIGSEGV, Segmentation fault.
[Switching to LWP 1]
0x00007f7febcf78c4 in strncmp () from /usr/lib/libc.so.12
(gdb) bt
#0  0x00007f7febcf78c4 in strncmp () from /usr/lib/libc.so.12
#1  0x00007f7febcafbfe in __getenvslot (name=0x7f7ff290ee88 "_XKB_CHARSET", 
l_name=12, allocate=false) at /archive/foreign/src/lib/libc/stdlib/_env.c:266
#2  0x00007f7febcafd52 in __findenvvar (name=<optimized out>, l_name=12) at 
/archive/foreign/src/lib/libc/stdlib/_env.c:333
#3  0x00007f7febcaf7f0 in getenv (name=0x7f7ff290ee88 "_XKB_CHARSET") at 
/archive/foreign/src/lib/libc/stdlib/getenv.c:74
#4  0x00007f7ff28861fe in _XkbGetCharset () from /usr/pkg/lib/libX11.so.6
#5  0x00007f7ff2884b46 in XkbTranslateKeySym () from /usr/pkg/lib/libX11.so.6
#6  0x00007f7ff2884d9e in XLookupString () from /usr/pkg/lib/libX11.so.6
#7  0x00007f7ff2861685 in _XimLocalFilter () from /usr/pkg/lib/libX11.so.6
#8  0x00000000004af214 in ?? ()
#9  0x00007f7ff5458580 in ?? () from /usr/pkg/lib/libgdk-x11-2.0.so.0
#10 0x00007f7ff5459c6a in ?? () from /usr/pkg/lib/libgdk-x11-2.0.so.0
#11 0x00007f7ff5459ce4 in ?? () from /usr/pkg/lib/libgdk-x11-2.0.so.0
#12 0x00007f7ff0042d09 in g_main_context_dispatch () from 
/usr/pkg/lib/libglib-2.0.so.0
#13 0x00007f7ff0042fef in g_main_context_iterate.clone.5 () from 
/usr/pkg/lib/libglib-2.0.so.0
#14 0x00007f7ff00430be in g_main_context_iteration () from 
/usr/pkg/lib/libglib-2.0.so.0
#15 0x00007f7ff592ba25 in gtk_main_iteration () from 
/usr/pkg/lib/libgtk-x11-2.0.so.0
#16 0x00000000004a7f74 in ?? ()
(lots more frames with no debugging info)
(gdb) fr 1
#1  0x00007f7febcafbfe in __getenvslot (name=0x7f7ff290ee88 "_XKB_CHARSET", 
l_name=12, allocate=false) at /archive/foreign/src/lib/libc/stdlib/_env.c:266
266                     if (strncmp(environ[num_entries], name, l_name) == 0 &&
(gdb) p name
$1 = 0x7f7ff290ee88 "_XKB_CHARSET"
(gdb) p l_name
$2 = 12
(gdb) p environ[num_entries]
value has been optimized out
(gdb) p num_entries 
$3 = <optimized out>

The code in src/lib/libc/stdlib/_env.c:266 is
        /* Search for an existing environment variable of the given name. */
        num_entries = 0;
        while (environ[num_entries] != NULL) {
                if (strncmp(environ[num_entries], name, l_name) == 0 &&
                    environ[num_entries][l_name] == '=') {
                        /* We found a match. */
                        return num_entries;
                }
                num_entries ++;
        }

name is not NULL, so I don't see how this strncmp can fail, except if
environ[num_entries] has changed since the check in the while loop
happened; or environ[num_entries] is bogus. Which it seems to be:

(gdb) p environ[0]
$4 = 0xb <Address 0xb out of bounds>
(gdb) p environ[1]
$5 = 0x0

Any ideas how this can happen?
 Thomas