Running test 260 sometimes but not always crashes. The problematic code seems to be in scan.c (merger_add) :
Although the comment says, that OUT need not be initialised, this code: case 3: if (in->type == T_STRING) { out->string = concat (out->string, in->string); return -1; } can segfault if out->string.string == 0 and out->string.length > 0 This can happen because in lexer.c (lex_source_get_lookahead) passes the address of a variable declared on the stack: struct token out; int retval = merger_add (&m, &lex_stage_nth (&src->merge, i)->token, &out); J'