SIGSEGV during lua 4.0 GC

[paul@...]

I am debugging my program (which embeds lua) with dmalloc, attached
is the output from gdb.

As dmalloc guards all memory allocation & deallocation, I cannot
think of any other reason except within lua's source. It seems to
me that the GC link list is somehow messed up.

I never had any memory problem with lua, but this sounds suspecious... 

Someone please enlighten me? Thanks in advance!

Regards
.paul.

	... output from gdb ...

debug-malloc library: dumping program, fatal error
   Error: pointer is not pointing to heap data space (err 21)

Program received signal SIGABRT, Aborted.
[Switching to Thread 1024 (LWP 1504)]
0x40250271 in __kill () from /lib/libc.so.6
Current language:  auto; currently c
(gdb) where
#0  0x40250271 in __kill () from /lib/libc.so.6
#1  0x4019398e in pthread_kill (thread=1024, signo=6) at signals.c:65
#2  0x40193e41 in raise (sig=6) at signals.c:232
#3  0x402516b1 in abort () at ../sysdeps/generic/abort.c:88
#4  0x80842a4 in _dmalloc_die (silent_b=0) at ./error.c:391
#5  0x8084309 in dmalloc_error (func=0x8092b99 "_chunk_free")
    at ./error.c:427
#6  0x8088d88 in _chunk_free (file=0x8076c53 "ë-\203ûüv\021\203Äøh", 
    line=0, pnt=0x1, realloc_b=0) at ./chunk.c:3134
#7  0x80849c9 in _loc_free (file=0x8076c53 "ë-\203ûüv\021\203Äøh", 
    line=0, pnt=0x1) at ./malloc.c:756
#8  0x8084ad9 in free (pnt=0x1) at ./malloc.c:912
#9  0x8076c53 in luaM_realloc (L=0x81bb008, block=0x1, size=0)
    at lmem.c:157
#10 0x8079a0a in luaH_free (L=0x81bb008, t=0x827e908) at ltable.c:229
#11 0x8076841 in collecttable (L=0x81bb008) at lgc.c:280
#12 0x8076b2b in luaC_collect (L=0x81bb008, all=0) at lgc.c:414
#13 0x8076b72 in luaC_collectgarbage (L=0x81bb008) at lgc.c:425
#14 0x8076bb6 in luaC_checkGC (L=0x81bb008) at lgc.c:436
#15 0x8075f27 in luaD_call (L=0x81bb008, func=0x81be1e8, nResults=-1)
    at ldo.c:230
#16 0x807b5a2 in luaV_execute (L=0x81bb008, cl=0x81d0268, base=0x81be1b8)
    at lvm.c:463

	... lots of stack backtrace ...

(gdb) frame 11
#11 0x8076841 in collecttable (L=0x81bb008) at lgc.c:280
280                 luaH_free (L, next);
(gdb) print next
$1 = (Hash *) 0x4019f13c
(gdb) print next->next
$2 = (struct Hash *) 0x40250c90
(gdb) print next->next->next
$3 = (struct Hash *) 0x8b000dc0
(gdb) print *next            
$4 = {node = 0x15394, htag = 1074239448, size = 1073792880, 
  firstfree = 0x40298530, next = 0x40250c90, mark = 0x4018ea46}
(gdb) print *next->node
Cannot access memory at address 0x15394
(gdb) print *next->next      
$5 = {node = 0x83e58955, htag = -397208340, size = 0, 
  firstfree = 0x3cc3815b, next = 0x8b000dc0, mark = 0xc0850845}
(gdb) print *next->next->node
Cannot access memory at address 0x83e58955
(gdb) print *next->next->next      
Cannot access memory at address 0x8b000dc0