The function PtsToRegion is called internally from XPolygonRegion.
If the Polygon consists e.g of the following points:
####### point #0 at 990, 825
####### point #1 at 991, 825
####### point #2 at 990, 825

the function PtsToRegion is called with numFullPtBlocks = 0 and iCurPtBlock = 0. 

This leads to numRects=0 and causes a memory corruption, because the
following call in PolyReg.c, line 410ff
    if (!(reg->rects = (BOX *)Xrealloc((char *)reg->rects, 
	    (unsigned) (sizeof(BOX) * numRects))))  {
	Xfree(prevRects);
	return(0);
    }

performs the deallocation in Xrealloc and again in Xfree
-> the data structures of the allocator are corrupted!

The reason for this behaviour is desribed in the man page of
realloc:
"if size is equal to zero, the call is equivalent to free(ptr)."

From my point of view, this behaviour is a problem of all
X-functions using Xrealloc because it is assumed that 
it never returns NULL on success (see definition of macro Xrealloc).

There are two solutions:
- global solution: either change macro realloc 
  (I don't know if there are any draw backs of this solution, so 
   I did not try that one...)
- local solution:
  only perform deallocation if numRects != 0
  this gives:
    if (!(reg->rects = (BOX *)Xrealloc((char *)reg->rects, 
	    (unsigned) (sizeof(BOX) * numRects))))  {
	if (numRects != 0) {
	  Xfree(prevRects); 
	}
	reg->size = 0;
	return(0);
    }

Note: it is obvious that the coordinates of the example are not typical,
nevertheless the function should never corrupt the memory....