Oh, after closer examniation it appears the crashes are actually different: the former has "double free or corruption (!prev)" as its reason and has happened in garbage_collect() while the second has "corrupted size vs. prev_size" and happened in win_free_lsize(). Still, both appear to relate to memory management.