In INIT, EXIT and some gc callbacks the fun in Pike_fp is set to FUNCTION_BUILTIN. there are some places in the code (e.g. ADT.List()->_get_iterator) where ->fun is used in INHERIT_FROM_INT et al, which segfaults (except with PIKE_DEBUG). I am not sure where to fix this. Should the *_FROM_INT macros check for FUNCTION_BUILTIN or is this better to be handled in the individual INIT/EXIT methods ?

Are you talking about the PUSH_FRAME macros in object.c where it constructs "fake" frames for the sake of various C callbacks? If so, it seems to me that the bug is in List__get_iterator_find_parent if it doesn't cope with the call from INIT.