On CURRENT r309302 with debuggin on I'm getting assertions like here:
They seem to happen randomly on key presses.
Is the second "MPASS(tib != NULL);" needed? Is it possible that "tib->tib_next" is NULL on the last loop iteration (i.e. offset gets incremented to ti->ti_end)? The first MPASS should be enough.