A bug fix from Alexey V. Neyman:

    In case of vfork(), the parent was left with __exit_count of -1 and
    thus tried to find non-NULL value of __exit_function_table[-1].atexit,
    __exit_function_table[-2].atexit and call this function; of course, it
    leads to coredump.

libc/stdlib/atexit.c

@@ -147,8 +147,8 @@ void __exit_handler(int status)
 	struct exit_function *efp;
 
 	/* In reverse order */
-	for ( ; __exit_count-- ; ) {
-		efp = &__exit_function_table[__exit_count];
+	while ( __exit_count ) {
+		efp = &__exit_function_table[--__exit_count];
 		switch (efp->type) {
 		case ef_on_exit:
 			if (efp->funcs.on_exit.func) {