I'm certainly concerned by that but as far as I can tell now, it might not be the cause of the bug as although we do an out of bounds SPECIAL area, we are only doing it in reading and for reading some integer value. The wrong reading is only causing a computation to return an integer value of one more than required, meaning they are holes in our register allocation but really I doubt it causes the kind of crash. I would know more in 15 minutes as I'm retesting with the fix included. We do run eweasel once in a while with assertions enabled but not always.