Issue 1:
The following consistently causes a segfault in 0.4 final release (as well as 0.4-rc1), and the same line of gf.c. I created a branch of ApproxFun that shows the bug. Note that the --check-bounds=yes appears necessary to reproduce.

Pkg.add("ApproxFun")
Pkg.checkout("ApproxFun","bug-segfaultjl")

[Macintosh:~/.julia/v0.4/ApproxFun/test] solver% julia --check-bounds=yes
_
_ _ _(_)_ | A fresh approach to technical computing
(_) | (_) (_) | Documentation: http://docs.julialang.org
_ _ _| |_ __ _ | Type "?help" for help.
| | | | | | |/ _` | |
| | |_| | | | (_| | | Version 0.4.0 (2015-10-08 06:20 UTC)
_/ |\__'_|_|_|\__'_| | Official http://julialang.org/ release
|__/ | x86_64-apple-darwin13.4.0

julia> versioninfo()
Julia Version 0.4.0
Commit 0ff703b* (2015-10-08 06:20 UTC)
Platform Info:
System: Darwin (x86_64-apple-darwin13.4.0)
CPU: Intel(R) Core(TM) i7-3820QM CPU @ 2.70GHz
WORD_SIZE: 64
BLAS: libopenblas (USE64BITINT DYNAMIC_ARCH NO_AFFINITY Sandybridge)
LAPACK: libopenblas64_
LIBM: libopenlibm
LLVM: libLLVM-3.3

julia> using ApproxFun

julia> x=Fun(identity,[-1.,1.])
Fun([0.0,1.0],Chebyshev(【-1.0,1.0】))

julia> f=x+sin(2x)*sqrt(1-x^2)

signal (11): Segmentation fault: 11
jl_method_table_assoc_exact at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/gf.c:251
jl_apply_generic at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/gf.c:1663
maxspace at /Users/solver/.julia/v0.4/ApproxFun/src/Fun/Space.jl:230
union at /Users/solver/.julia/v0.4/ApproxFun/src/Fun/Space.jl:297
isconvertible at /Users/solver/.julia/v0.4/ApproxFun/src/Fun/Space.jl:311
jlcall_isconvertible_22217 at (unknown line)
jl_apply at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/gf.c:1691
sumspacecoefficients at /Users/solver/.julia/v0.4/ApproxFun/src/Spaces/Modifier/Modifier.jl:102
coefficients at /Users/solver/.julia/v0.4/ApproxFun/src/Fun/Fun.jl:45
call at /Users/solver/.julia/v0.4/ApproxFun/src/Fun/constructors.jl:54
jlcall_call_22211 at (unknown line)
jl_apply at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/gf.c:1691
+ at /Users/solver/.julia/v0.4/ApproxFun/src/Fun/Fun.jl:181
jl_apply at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/gf.c:1691
jl_apply at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/interpreter.c:55
eval at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/interpreter.c:213
eval at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/interpreter.c:219
eval_body at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/interpreter.c:592
jl_toplevel_eval_body at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/interpreter.c:527
jl_toplevel_eval_flex at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/toplevel.c:521
jl_toplevel_eval_in at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/builtins.c:579
eval_user_input at REPL.jl:62
jlcall_eval_user_input_21258 at (unknown line)
jl_apply at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/./julia.h:1325
anonymous at REPL.jl:92
jl_apply at /Users/osx/buildbot/slave/package_osx10_9-x64/build/src/task.c:241
Segmentation fault: 11```

Issue 2:
I think I might have stumbled across a bug, possibly in type inference though I'm not sure.

I'd expect that running the following would print "ok" 3 times, instead it prints "ok" once then two blank lines.

function printit(x, _)
if _true()
z = id(x)
print("")
println(z)
:sym
elseif _false()
printit("ok", :foo)
end
end

function id(x)
if _false()
printit(unknowntype, :foo)
else
x
end
end

_false() = false
_true() = true

printit("ok", "foo")
printit("ok", :foo)
printit("ok", :foo)

Making any one of the following changes results in the expected output. Perhaps this will help point someone who understands Julia's internals at the cause of the unexpected behavior.

Remove the printit("ok", "foo") line. (Results in "ok" been printed twice as expected.)

Remove the :sym line.

Remove the print("") line.

Remove either of the if expressions leaving only the non-redundant branch.

Replace unknowntype with unknowntype::ASCIIString.

Remove either of the calls to printit within printit or id.

I've also just noticed that replacing println(z) with println(z==nothing ? "nothing" : z) causes a seg fault.

All of this is happening with the latest nightly build, details below. I get very similar results using v0.3.4, but not the seg fault.

Julia Version 0.4.0-dev+2689
Commit a418672 (2015-01-14 10:05 UTC)
Platform Info:
System: Darwin (x86_64-apple-darwin13.4.0)
CPU: Intel(R) Core(TM)2 Duo CPU T7700 @ 2.40GHz
WORD_SIZE: 64
BLAS: libopenblas (USE64BITINT DYNAMIC_ARCH NO_AFFINITY Core2)
LAPACK: libopenblas
LIBM: libopenlibm
LLVM: libLLVM-3.3