bug#3809: 23.1.50; crash in abbrev mode

My Emacs (compiled with CFLAGS='-g -DENABLE_CHECKING') has
just crashed as this:

cmds.c:495: Emacs fatal error: assertion failed: SYMBOLP(sym)
[Switching to Thread 0xb70e0700 (LWP 6775)]

Breakpoint 1, abort () at emacs.c:433
(gdb) bt full
#0  abort () at emacs.c:433
No locals.
#1  0x083202c2 in die (msg=0x85ae1ec "assertion failed: SYMBOLP(sym)", file=0x85acc8e "cmds.c", line=495) at alloc.c:6221
No locals.
#2  0x082ce57b in internal_self_insert (c=64, noautofill=0) at cmds.c:495
	modiff = 135
	sym = 164732765
	hairy = 1
	tem = -1080958120
	synt = Spunct
	overwrite = 142900505
	string = 0
	len = 1
	str = "@\000\000\000"
	chars_to_delete = 0
	spaces_to_insert = 0
[...]
(gdb) up 2
(gdb) list
490	      sym = call0 (Qexpand_abbrev);
491	
492	      /* If we expanded an abbrev which has a hook,
493		 and the hook has a non-nil `no-self-insert' property,
494		 return right away--don't really self-insert.  */
495	      if (! NILP (sym) && ! NILP (XSYMBOL (sym)->function)
496		  && SYMBOLP (XSYMBOL (sym)->function))
497		{
498		  Lisp_Object prop;
499		  prop = Fget (XSYMBOL (sym)->function, intern ("no-self-insert"));
(gdb) pp sym
(64 46 37 33 95 45)
(gdb)

FYI, (string 64 46 37 33 95 45) => "@.%!_-".

This is reproducible by this scenario:

% emacs -Q
C-x m
M-x message-mode
handa@

Emacs crashes when I type the last "@" (in To: subject
line).  It seems that "handa" can be any other string.  It
is reproducible with EMACS_23_1_RC branch too.

In the above code, at least we should have a ckeck of
SYMBOLP (sym).

---
Kenichi Handa
[email protected]

In GNU Emacs 23.1.50.2 (i686-pc-linux-gnu, GTK+ Version 2.14.4)
 of 2009-07-08 on etlken
Windowing system distributor `The X.Org Foundation', version 11.0.10502000
configured using `configure  'CFLAGS=-g''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: ja_JP.UTF-8
  value of $XMODIFIERS: @im=SCIM
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  display-time-mode: t
  tooltip-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t

Recent input:
<escape> x r e p o e r t <backspace> <backspace> <backspace> 
r t <tab> <return>

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.