Ghostscript r8669 segfaults on page six of the ps3cet file 09-34.PS:

$ debugobj/gs -sDEVICE=ppmraw -o /dev/null -r300
../private/tests_private/ps/ps3cet/09-34.PS
[...]
9-34 SYNTAX 6 

Program received signal SIGSEGV, Segmentation fault.

0x00000000004a53aa in gx_dc_pattern_write (pdevc=0x1719a88, 
    psdc=0x2b9d9a124810, dev=0x1473748, offset=0, data=0x0, 
    psize=0x7fff133eb4b0) at ./src/gsptype1.c:1266
1266        if (ptile->cdev == NULL) {


This is a color test file, but the problem seems to predate r8664.

Partial Backtrace:

#0  0x00000000004a53aa in gx_dc_pattern_write (pdevc=0x1719a88, 
    psdc=0x2b9d9a124810, dev=0x1473748, offset=0, data=0x0, 
    psize=0x7fff133eb4b0) at ./src/gsptype1.c:1266
#1  0x0000000000627dad in cmd_put_drawing_color (cldev=0x1473748, 
    pcls=0x2b9d9a124800, pdcolor=0x1719a88) at ./src/gxclpath.c:127
#2  0x0000000000622c2f in clist_fill_mask (dev=0x1473748, data=0x1765ce0 "", 
    data_x=0, raster=8, id=323, rx=1715, ry=309, rwidth=30, rheight=30, 
    pdcolor=0x1719a88, depth=1, lop=252, pcpath=0x1719510)
    at ./src/gxclimag.c:141
#3  0x000000000086ff57 in gx_image_fill_masked (dev=0x1473748, 
    data=0x1765ce0 "", data_x=0, raster=8, id=323, x=1715, y=309, width=30, 
    height=30, pdc=0x1719a88, depth=1, lop=252, pcpath=0x1719510)
    at ./src/gximask.c:100
#4  0x000000000082e0df in gx_image_cached_char (penum=0x171a3e8, cc=0x1765c60)
    at ./src/gxccache.c:389
#5  0x0000000000834a07 in show_proceed (penum=0x171a3e8) at ./src/gxchar.c:1144
#6  0x0000000000833ab2 in continue_show (penum=0x171a3e8) at ./src/gxchar.c:783
#7  0x0000000000833a4a in gx_show_text_process (pte=0x171a3e8)
    at ./src/gxchar.c:760

pdevc->colors here is allocated, but all zero, hence the NULL dereference of ptile.