bug#3778: 23.1.50; segfault

I don't know what if anything I did to trigger this -- I attempted to
connect to a running emacs server by doing

ssh -t 192.168.0.8 /usr/local/src/emacs/lib-src/emacsclient --tty

... and when that hung, I noticed that the server process had broken
into the debugger.
SIGINT is used by the debugger.
Are you sure you want to change it? (y or n) [answered Y; input not
from terminal]
DISPLAY = localhost:10.0
TERM = screen-bce
Breakpoint 1 at 0x8117a56: file emacs.c, line 433.
Breakpoint 2 at 0x8134a19: file sysdep.c, line 1141.
Starting program: /usr/local/src/emacs/src/emacs -nw
[Thread debugging using libthread_db enabled]
[New Thread 0xb72738c0 (LWP 29398)]
[Switching to Thread 0xb72738c0 (LWP 29398)]

Program received signal SIGSEGV, Segmentation fault.
0x0805d334 in update_frame (f=0x927d100, force_p=0,
inhibit_hairy_id_p=0) at dispnew.c:2695
2695	  for (i = FRAME_TOP_MARGIN (f); i < f->desired_matrix->nrows; ++i)
#0  0x0805d334 in update_frame (f=0x927d100, force_p=0, inhibit_hairy_id_p=0)
    at dispnew.c:2695
#1  0x0808ad4f in redisplay_internal (preserve_echo_area=<value optimized out>)
    at xdisp.c:11845
#2  0x0808bb77 in redisplay_preserve_echo_area (from_where=13) at xdisp.c:12056
#3  0x081bfc8b in status_notify (deleting_process=0x9b05680) at process.c:6923
#4  0x081c54e8 in Fdelete_process (process=162551428) at process.c:818
#5  0x0818702c in Ffuncall (nargs=2, args=0xbfd805d0) at eval.c:3045
#6  0x081bbfc0 in Fbyte_code (bytestr=141952643, vector=142284260,
    maxdepth=<value optimized out>) at bytecode.c:678
#7  0x08188de3 in funcall_lambda (fun=143965268, nargs=1, arg_vector=0xbfd807b8)
    at eval.c:3232
#8  0x08186d1b in Ffuncall (nargs=2, args=0xbfd807b4) at eval.c:3102
#9  0x08188441 in Fapply (nargs=2, args=0xbfd807b4) at eval.c:2478
#10 0x08186eb6 in Ffuncall (nargs=3, args=0xbfd807b0) at eval.c:3026
#11 0x081bbfc0 in Fbyte_code (bytestr=136915779, vector=136915804,
    maxdepth=<value optimized out>) at bytecode.c:678
#12 0x08188984 in Feval (form=136915765) at eval.c:2382
#13 0x08189511 in internal_lisp_condition_case (var=137914569,
bodyform=136915765,
    handlers=136915837) at eval.c:1457
#14 0x081bc8ea in Fbyte_code (bytestr=136915635, vector=136915652,
    maxdepth=<value optimized out>) at bytecode.c:868
#15 0x08188de3 in funcall_lambda (fun=136915596, nargs=1, arg_vector=0xbfd80af4)
    at eval.c:3232
#16 0x08186d1b in Ffuncall (nargs=2, args=0xbfd80af0) at eval.c:3102
#17 0x08187f09 in call1 (fn=137947553, arg1=154199268) at eval.c:2830
#18 0x081217df in timer_check (do_it_now=1) at keyboard.c:4676
#19 0x08121a53 in readable_events (flags=3) at keyboard.c:3664
#20 0x08121ad7 in get_input_pending (addr=0x8372adc, flags=3) at keyboard.c:6967
#21 0x08121b88 in Finput_pending_p () at keyboard.c:10779
#22 0x08187039 in Ffuncall (nargs=1, args=0xbfd80c20) at eval.c:3042
#23 0x081bbfc0 in Fbyte_code (bytestr=141595587, vector=141994940,
    maxdepth=<value optimized out>) at bytecode.c:678
#24 0x08188de3 in funcall_lambda (fun=141995148, nargs=0, arg_vector=0xbfd80df8)
    at eval.c:3232
#25 0x08186d1b in Ffuncall (nargs=1, args=0xbfd80df4) at eval.c:3102
#26 0x0818835d in Fapply (nargs=2, args=0xbfd80df4) at eval.c:2474
#27 0x08186eb6 in Ffuncall (nargs=3, args=0xbfd80df0) at eval.c:3026
#28 0x081bbfc0 in Fbyte_code (bytestr=136915779, vector=136915804,
    maxdepth=<value optimized out>) at bytecode.c:678
#29 0x08188984 in Feval (form=136915765) at eval.c:2382
#30 0x08189511 in internal_lisp_condition_case (var=137914569,
bodyform=136915765,
    handlers=136915837) at eval.c:1457
#31 0x081bc8ea in Fbyte_code (bytestr=136915635, vector=136915652,
    maxdepth=<value optimized out>) at bytecode.c:868
#32 0x08188de3 in funcall_lambda (fun=136915596, nargs=1, arg_vector=0xbfd81134)
    at eval.c:3232
#33 0x08186d1b in Ffuncall (nargs=2, args=0xbfd81130) at eval.c:3102
#34 0x08187f09 in call1 (fn=137947553, arg1=141958196) at eval.c:2830
#35 0x081217df in timer_check (do_it_now=1) at keyboard.c:4676
#36 0x08121a53 in readable_events (flags=1) at keyboard.c:3664
#37 0x08121ad7 in get_input_pending (addr=0x8372adc, flags=1) at keyboard.c:6967
#38 0x08121db6 in swallow_events (do_display=1) at keyboard.c:4439
#39 0x08058a7a in sit_for (timeout=240, reading=1, do_display=1) at
dispnew.c:6609
#40 0x0812656a in read_char (commandflag=1, nmaps=6, maps=0xbfd814f0,
    prev_event=137914569, used_mouse_menu=0xbfd815b4, end_time=0x0) at
keyboard.c:2952
#41 0x08127b31 in read_key_sequence (keybuf=0xbfd81664, bufsize=30,
prompt=137914569,
    dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1)
    at keyboard.c:9535
#42 0x08129c54 in command_loop_1 () at keyboard.c:1642
#43 0x08186320 in internal_condition_case (bfun=0x8129a70 <command_loop_1>,
    handlers=137957737, hfun=0x81242d0 <cmd_error>) at eval.c:1512
#44 0x08123825 in command_loop_2 () at keyboard.c:1359
#45 0x081863fa in internal_catch (tag=137953761, func=0x8123800
<command_loop_2>,
    arg=137914569) at eval.c:1248
#46 0x0812411f in command_loop () at keyboard.c:1338
#47 0x081244ab in recursive_edit_1 () at keyboard.c:953
#48 0x081245f4 in Frecursive_edit () at keyboard.c:1015
#49 0x08118a8f in main (argc=2, argv=0xbfd81ce4) at emacs.c:1854

Lisp Backtrace:
"delete-process" (0xbfd805d4)
"erc-server-send-ping" (0xbfd807b8)
"apply" (0xbfd807b4)
"byte-code" (0xbfd80850)
"timer-event-handler" (0xbfd80af4)
"input-pending-p" (0xbfd80c24)
"auto-revert-buffers" (0xbfd80df8)
"apply" (0xbfd80df4)
"byte-code" (0xbfd80e90)
"timer-event-handler" (0xbfd81134)
Undefined command: "uit".  Try "help".
The program is running.  Exit anyway? (y or n)
(For my own reference, this came from d0e0dc6)