Created attachment 98076 [details]
Xterm strace output (strace -o ... xterm)

Nalin... I think this is a gnome-terminal/vte bug

It is not the terminal, but the bash shell itself.  It even happens in
a text VT.  zsh seems unaffected by this problem.

Program received signal SIGSEGV, Segmentation fault.
0x00a9564d in _int_free (av=0xb4d760, mem=0x874e288) at malloc.c:4223
4223            unlink(p, bck, fwd);
(gdb) bt
#0  0x00a9564d in _int_free (av=0xb4d760, mem=0x874e288) at malloc.c:4223
#1  0x00a96b5b in __libc_free (mem=0x874e288) at malloc.c:3374
#2  0x00d76a26 in tgetent () from /lib/libtermcap.so.2
#3  0x080b407f in _rl_init_terminal_io (terminal_name=0x875c708
"gnome") at terminal.c:392
#4  0x080b4341 in rl_reset_terminal (terminal_name=0x36722d6d <Address
0x36722d6d out of bounds>) at terminal.c:525
#5  0x0806fccc in stupidly_hack_special_variables (name=0x874e998
"TERM") at variables.c:3472
#6  0x0807979b in do_assignment_internal (string=0x8741a70
"\220\032t\b\b�u\b", expand=0) at subst.c:1992
#7  0x08079987 in do_assignment_no_expand (string=0x36722d6d <Address
0x36722d6d out of bounds>) at subst.c:2017
#8  0x0809acfe in set_or_show_attributes (list=0x8746d08, attribute=1,
nodefs=4) at setattr.def:217
#9  0x0809aad0 in export_builtin (list=0x36722d6d) at setattr.def:73
#10 0x0806a8ca in execute_builtin (builtin=0x809aab0 <export_builtin>,
words=0x36722d6d, flags=0, subshell=0)
    at execute_cmd.c:2829
#11 0x0806b019 in execute_builtin_or_function (words=0x8749688,
builtin=0x809aab0 <export_builtin>, var=0x36722d6d,
    redirects=0x36722d6d, fds_to_close=0x36722d6d, flags=0) at
execute_cmd.c:3112
#12 0x0806a401 in execute_simple_command (simple_command=0x87575b0,
pipe_in=-1, pipe_out=-1, async=0,
    fds_to_close=0x8750c38) at execute_cmd.c:2704
#13 0x0806781a in execute_command_internal (command=0x874f608,
asynchronous=0, pipe_in=-1, pipe_out=-1,
    fds_to_close=0x8750c38) at execute_cmd.c:633
#14 0x08067345 in execute_command (command=0x36722d6d) at
execute_cmd.c:328
#15 0x0805c9b0 in reader_loop () at eval.c:143
#16 0x0805ac95 in main (argc=1, argv=0xfeedb554, env=0xfeedb55c) at
shell.c:690

Created attachment 99597 [details]
termcap-116934.patch

Try this patch.

I have just tried this with gnome-terminal/xterm with todays Rawhide
tree (upgraded from a fc2test3 install), and this is not reproducable. 

libtermcap-2.0.8-37.1
xterm-179-6.EL
gnome-terminal-2.6.0-2
termcap-11.0.1-18.1
libtermcap-devel-2.0.8-37.1

This might be closable as RAWHIDE.

I have the exact same versions as in comment #5, and I can still
reproduce this crash.  Will need to test patch a little later.

Patch works for me.

Can reproduce the crash on FC1 with libtermcap-2.0.8-37.1 (rebuilt
from rawhide), but can't reproduce it with the patch from comment 4
being applied.

Confirmation for yesterday's Rawhide. Needs eight (8) times toggling
$TERM between gnome and gnome-rh9 to crash. Patch fixes it.

OK, with the standard .bashrc in /etc/skel, this cannot be reproduced,
as in comment #5. However, using a custom .bashrc crashes
gnome-terminal (or the tab that it was running in). The patch in
comment #4 works to fix this.

On FC1, the crash does happen with a custom .bashrc, but with a fresh
user I still cannot reproduce the crash.

Fixed package has been built as 2.0.8-38.

fixed in rawhide-latest (as of 08/05/2004) using libtermcap-2.0.8-39.
 Please re-open this issue if the bug re-appears.