Crash with ascii text scribbled across a data structure.

From time to time, I get a most peculiar SEGV.  Here's an example on
fairly clean source up to c761c66 on a mac:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: 13 at address: 0x0000000000000000
0x00000001000064b7 in Fl_Widget::position (this=0x118148910,
X=2003792928, Y=1869881479) at Fl_Widget.H:321
321	  void position(int X,int Y) {resize(X,Y,w_,h_);}
(gdb) bt
#0  0x00000001000064b7 in Fl_Widget::position (this=0x118148910,
X=2003792928, Y=1869881479) at Fl_Widget.H:321
#1  0x000000010008521a in dw::fltk::FltkViewport::updateCanvasWidgets
(this=0x101208a10, dx=0, dy=-25) at fltkviewport.cc:502
#2  0x0000000100086492 in dw::fltk::FltkViewport::scrollTo
(this=0x101208a10, x=0, y=347) at fltkviewport.cc:398
#3  0x0000000100084c10 in dw::fltk::FltkViewport::scroll
(this=0x101208a10, dx=0, dy=-25) at fltkviewport.cc:413
#4  0x0000000100084c4a in dw::fltk::FltkViewport::vscrollbarChanged
(this=0x101208a10) at fltkviewport.cc:156
#5  0x0000000100084c65 in dw::fltk::FltkViewport::vscrollbarCallback
(vscrollbar=0x101208c90, viewportPtr=0x101208a10) at
fltkviewport.cc:161
#6  0x0000000100100b13 in Fl_Widget::do_callback (this=0x101208c90,
o=0x101208c90, arg=0x101208a10) at Fl_Widget.cxx:328
#7  0x000000010001a8ef in Fl_Widget::do_callback (this=0x101208c90) at
Fl_Widget.H:840
#8  0x00000001001005c1 in Fl_Valuator::handle_drag (this=0x101208c90,
v=347) at Fl_Valuator.cxx:95
#9  0x00000001000ec3bc in Fl_Scrollbar::handle (this=0x101208c90,
event=19) at Fl_Scrollbar.cxx:142
#10 0x00000001000857d7 in dw::fltk::FltkViewport::handle
(this=0x101208a10, event=19) at fltkviewport.cc:304
#11 0x00000001000ceb39 in send (o=0x101208a18, event=19) at Fl_Group.cxx:98
#12 0x00000001000cf338 in Fl_Group::handle (this=0x10053d760,
event=19) at Fl_Group.cxx:254
#13 0x0000000100007aa2 in UI::handle (this=0x10053d760, event=19) at ui.cc:788
#14 0x00000001000ceb39 in send (o=0x10053d760, event=19) at Fl_Group.cxx:98
#15 0x00000001000cf338 in Fl_Group::handle (this=0x10053d6b0,
event=19) at Fl_Group.cxx:254
#16 0x00000001000ceb39 in send (o=0x10053d6b0, event=19) at Fl_Group.cxx:98
#17 0x00000001000cf338 in Fl_Group::handle (this=0x10053cf60,
event=19) at Fl_Group.cxx:254
#18 0x00000001000b7b94 in Fl_Window::handle (this=0x10053cf60, ev=19)
at Fl.cxx:1643
#19 0x00000001000b67e0 in send (event=19, to=0x10053cf60,
window=0x10053cf60) at Fl.cxx:1136
#20 0x00000001000b8ad1 in Fl::handle_ (e=19, window=0x10053cf60) at Fl.cxx:1444
#21 0x00000001000b8b7a in Fl::handle (e=19, window=0x10053cf60) at Fl.cxx:1216
#22 0x00000001000ab1b3 in cocoaMouseWheelHandler
(theEvent=0x1181582b0) at Fl_cocoa.mm:943
#23 0x00000001000ab1e8 in -[FLView scrollWheel:] (self=0x101505a50,
_cmd=0x7fff8965ff98, theEvent=0x1181582b0) at Fl_cocoa.mm:2250
#24 0x00007fff890580c7 in -[NSWindow sendEvent:] ()
#25 0x00007fff88f8cafa in -[NSApplication sendEvent:] ()
#26 0x00000001000aed74 in +[FLApplication sendEvent:]
(self=0x1001b36d0, _cmd=0x7fff896552c0, theEvent=0x1181582b0) at
Fl_cocoa.mm:1609
#27 0x00000001000ae989 in do_queued_events (time=1e+20) at Fl_cocoa.mm:749
#28 0x00000001000ae9bf in fl_wait (time=1e+20) at Fl_cocoa.mm:773
#29 0x00000001000aea86 in fl_mac_flush_and_wait (time_to_wait=1e+20)
at Fl_cocoa.mm:792
#30 0x00000001000b9081 in Fl::wait (time_to_wait=1e+20) at Fl.cxx:528
#31 0x00000001000b910b in Fl::run () at Fl.cxx:589
#32 0x00000001000052a7 in main (argc=1, argv=0x7fff5fbff280) at dillo.cc:589

(gdb) print (char *)this
$6 = 0x118148910 "lore ipsum the text out of the editor window in the
email.\n\nMore lorem ibsum.\n\nRegards,\nJames."

0x118148910 is correctly allocated to
dw::flak::ui::FltkLabelButtonResource, according to Apple's debugging
malloc.

I can't find, in the debugging malloc, the allocation for storing the
text in the text-box.

The worst cases are that someone is scribbling malloc control
structures, or someone is scribbling addresses in a dillo data
structure.

I've seen something essentially the same where the scribble contained a URL.

I'm contemplating relinking with electric fence.

Regards,
James.