[Monotone-devel] Double-free crash in 0.30 checking out nvm

[Jack Lloyd]

I'm seeing crashes attempting a fresh checkout of nvm using 0.30. Any
ideas? It seems repeatable, pops up every couple of hundred
revisions. I could concievably believe it was hardware/heat related,
but figured I should let you guys know.

-Jack

mtn --full-version
monotone 0.30 (base revision: unknown)
Running on          : Linux 2.6.17-gentoo-r8 #4 Mon Sep 25 11:25:57 EDT 2006 
i686
C++ compiler        : GNU C++ version 3.4.6 (Gentoo 3.4.6-r1, ssp-3.4.5-1.0, 
pie-8.7.9)
C++ standard library: GNU libstdc++ version 20060306
Boost version       : 1_33_1
Changes since base revision:
unknown


 mtn -d monotone.mtn pull venge.net 'net.venge.monotone.*'
mtn: doing anonymous pull; use -kKEYNAME if you need authentication
mtn: connecting to venge.net
mtn: finding items to synchronize:
mtn: certificates | keys | revisions
mtn:          885 |    9 |       292
mtn: bytes in | bytes out | certs in | revs in
mtn:  526.7 k |   221.8 k |        0 |       0
mtn: bytes in | bytes out |    certs in |   revs in
mtn:    2.8 M |   221.8 k |   624/24502 |  192/7103*** glibc detected *** mtn: 
double free or corruption (fasttop): 0x09119908 ***
======= Backtrace: =========
/lib/libc.so.6[0xb7c10dea]
/lib/libc.so.6(__libc_free+0x8c)[0xb7c1187d]
/usr/lib/gcc/i686-pc-linux-gnu/4.1.1/libstdc++.so.6(_ZdlPv+0x21)[0xb7da1909]
/usr/lib/gcc/i686-pc-linux-gnu/4.1.1/libstdc++.so.6(_ZNSs4_Rep10_M_destroyERKSaIcE+0x1d)[0xb7d7f96f]
/usr/lib/gcc/i686-pc-linux-gnu/4.1.1/libstdc++.so.6(_ZNSsD1Ev+0x50)[0xb7d8202c]
mtn[0x8157f30]
mtn[0x816ab60]
mtn[0x816b8cb]
mtn[0x816bb39]
mtn[0x81b42a9]
mtn[0x81db730]
mtn[0x81f3303]
mtn[0x81f4102]
mtn[0x81f6cb0]
mtn[0x81f722c]
mtn[0x80be8ad]
mtn[0x80b8274]
mtn[0x82e8f95]
mtn[0x82eda9a]
/lib/libc.so.6(__libc_start_main+0xe6)[0xb7bc4866]
mtn(__gxx_personality_v0+0x185)[0x8053a41]
======= Memory map: ========
08048000-08528000 r-xp 00000000 03:08 168109     /usr/bin/mtn
08528000-08529000 rw-p 004e0000 03:08 168109     /usr/bin/mtn
08529000-0916b000 rw-p 08529000 00:00 0          [heap]
b7a00000-b7a21000 rw-p b7a00000 00:00 0 
b7a21000-b7b00000 ---p b7a21000 00:00 0 
b7b09000-b7b4c000 rw-p b7b09000 00:00 0 
b7b84000-b7baf000 rw-p b7b84000 00:00 0 
b7baf000-b7cc1000 r-xp 00000000 03:05 24219      /lib/libc-2.4.so
b7cc1000-b7cc3000 r--p 00111000 03:05 24219      /lib/libc-2.4.so
b7cc3000-b7cc5000 rw-p 00113000 03:05 24219      /lib/libc-2.4.so
b7cc5000-b7cc8000 rw-p b7cc5000 00:00 0 
b7cc8000-b7cd1000 r-xp 00000000 03:05 26854      /lib/libgcc_s.so.1
b7cd1000-b7cd2000 rw-p 00008000 03:05 26854      /lib/libgcc_s.so.1
b7cd2000-b7cf4000 r-xp 00000000 03:05 24218      /lib/libm-2.4.so
b7cf4000-b7cf6000 rw-p 00021000 03:05 24218      /lib/libm-2.4.so
b7cf6000-b7dc4000 r-xp 00000000 03:08 863341     
/usr/lib/gcc-lib/i686-pc-linux-gnu/4.1.1/libstdc++.so.6.0.8
b7dc4000-b7dc7000 r--p 000ce000 03:08 863341     
/usr/lib/gcc-lib/i686-pc-linux-gnu/4.1.1/libstdc++.so.6.0.8
b7dc7000-b7dc9000 rw-p 000d1000 03:08 863341     
/usr/lib/gcc-lib/i686-pc-linux-gnu/4.1.1/libstdc++.so.6.0.8
b7dc9000-b7dcf000 rw-p b7dc9000 00:00 0 
b7dda000-b7de1000 r--s 00000000 03:08 2836       
/usr/lib/gconv/gconv-modules.cache
b7de1000-b7df1000 r-xp 00000000 03:05 6300       /lib/libz.so.1.2.3
b7df1000-b7df2000 rw-p 0000f000 03:05 6300       /lib/libz.so.1.2.3
b7df2000-b7df3000 rw-p b7df2000 00:00 0 
b7df3000-b7e03000 r-xp 00000000 03:08 109281     
/usr/lib/libboost_filesystem.so.1.33.1
b7e03000-b7e04000 rw-p 0000f000 03:08 109281     
/usr/lib/libboost_filesystem.so.1.33.1
b7e04000-b7e12000 r-xp 00000000 03:08 483526     
/usr/lib/libboost_date_time.so.1.33.1
b7e12000-b7e13000 rw-p 0000e000 03:08 483526     
/usr/lib/libboost_date_time.so.1.33.1
b7e13000-b7ea8000 r-xp 00000000 03:08 483529     
/usr/lib/libboost_regex.so.1.33.1
b7ea8000-b7eaa000 rw-p 00095000 03:08 483529     
/usr/lib/libboost_regex.so.1.33.1
b7eaa000-b7ee8000 r-xp 00000000 03:08 121582     
/usr/lib/libboost_program_options.so.1.33.1
b7ee8000-b7ee9000 rw-p 0003e000 03:08 121582     
/usr/lib/libboost_program_options.so.1.33.1
b7ee9000-b7eea000 rw-p b7ee9000 00:00 0 
b7eea000-b7f03000 r-xp 00000000 03:05 24216      /lib/ld-2.4.so
b7f03000-b7f04000 r--p 00018000 03:05 24216      /lib/ld-2.4.so
b7f04000-b7f05000 rw-p 00019000 03:05 24216      /lib/ld-2.4.so
bfce7000-bfd2d000 rw-p bfce7000 00:00 0          [stack]
ffffe000-fffff000 ---p 00000000 00:00 0          [vdso]
mtn: fatal signal: Aborted
this is almost certainly a bug in monotone.
please send this error message, the output of 'mtn --full-version',
and a description of what you were doing to address@hidden
do not send a core dump, but if you have one, 
please preserve it in case we ask you for information from it.
Aborted


(gdb) backtrace 
#0  0xffffe410 in __kernel_vsyscall ()
#1  0xb7becaed in raise () from /lib/libc.so.6
#2  0xb7bee143 in abort () from /lib/libc.so.6
#3  0xb7c20373 in __fsetlocking () from /lib/libc.so.6
#4  0xb7c25dea in malloc_usable_size () from /lib/libc.so.6
#5  0xb7c2687d in free () from /lib/libc.so.6
#6  0xb7db6909 in operator delete () from 
/usr/lib/gcc/i686-pc-linux-gnu/4.1.1/libstdc++.so.6
#7  0xb7d9496f in std::string::_Rep::_M_destroy () from 
/usr/lib/gcc/i686-pc-linux-gnu/4.1.1/libstdc++.so.6
#8  0xb7d9702c in std::basic_string<char, std::char_traits<char>, 
std::allocator<char> >::~basic_string () from 
/usr/lib/gcc/i686-pc-linux-gnu/4.1.1/libstdc++.so.6
#9  0x08157f30 in boost::lexical_cast<std::string, bool> ()
#10 0x08165f72 in boost::lexical_cast<std::string, bool> ()
#11 0x081b5edd in std::_Rb_tree<std::string, std::string, 
std::_Identity<std::string>, std::less<std::string>, 
std::allocator<std::string> >::lower_bound ()
#12 0x081de6da in 
std::vector<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> >, 
std::allocator<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> > > >::operator= ()
#13 0x081f3434 in 
std::vector<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> >, 
std::allocator<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> > > >::operator= ()
#14 0x081f4102 in 
std::vector<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> >, 
std::allocator<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> > > >::operator= ()
#15 0x081f6cb0 in 
std::vector<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> >, 
std::allocator<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> > > >::operator= ()
#16 0x081f722c in 
std::vector<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> >, 
std::allocator<boost::sub_match<__gnu_cxx::__normal_iterator<char const*, 
std::string> > > >::operator= ()
#17 0x080be8ad in std::underflow_error::~underflow_error ()
#18 0x080b8274 in std::_Rb_tree<std::string, std::string, 
std::_Identity<std::string>, std::less<std::string>, 
std::allocator<std::string> >::find ()
#19 0x082e8f95 in boost::any::holder<std::string>::clone ()
#20 0x082eda9a in 
boost::program_options::invalid_option_value::~invalid_option_value ()
#21 0xb7bd9866 in __libc_start_main () from /lib/libc.so.6
#22 0x08053a41 in ?? ()