ZNC crashes with multiple keyxs too quickly, or a keyx w/ a timeout and another keyx

[cosmosified]

something is being freed that has already been freed.. i think.. i've been able to reproduce it and am now trying to get a debug version up and running so i can gdb it.

will keep this posted when i have more concrete evidence/ information.

This build is running on Mac OSX 10.7.2 w/ Xcode 4.2.1 ..

once i get a good bt from gdb, i'll post more.

thanks!

[dctrwatson]

Any luck with your debugging?

[cosmosified]

Process: znc [34689] Path: /usr/local/bin/znc Identifier: znc Version: ??? (???) Code Type: X86-64 (Native) Parent Process: ??? [1]

Date/Time: 2012-02-23 08:17:23.917 -0600 OS Version: Mac OS X Server 10.7.3 (11D50b) Report Version: 9

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000

Application Specific Information: *** error for object 0x7fd28a812dd8: incorrect checksum for freed object - object was probably modified after being freed.

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsystem_kernel.dylib 0x00007fff8d473ce2 __pthread_kill + 10 1 libsystem_c.dylib 0x00007fff8d5617d2 pthread_kill + 95 2 libsystem_c.dylib 0x00007fff8d552a7a abort + 143 3 libsystem_c.dylib 0x00007fff8d5744ac szone_error + 459 4 libsystem_c.dylib 0x00007fff8d5744e8 free_list_checksum_botch + 29 5 libsystem_c.dylib 0x00007fff8d57836c szone_free_definite_size + 1216 6 libsystem_c.dylib 0x00007fff8d5b1789 free + 194 7 libstdc++.6.dylib 0x00007fff8e3206b4 std::string::_Rep::_M_destroy(std::allocator const&) + 34 8 fish.so 0x000000010271b321 CFishMod::OnUserMsg(CString&, CString&) + 1521 9 znc 0x00000001022a1b5a CModules::OnUserMsg(CString&, CString&) + 234 10 znc 0x0000000102287029 CClient::ReadLine(CString const&) + 35577 11 znc 0x00000001022176aa Csock::PushBuff(char const*, unsigned long, bool) + 266 12 znc 0x000000010221df4f CSocketManager::Loop() + 1103 13 znc 0x0000000102212c91 CSocketManager::DynamicSelectLoop(unsigned long, unsigned long, long) + 49 14 znc 0x0000000102239fa4 CZNC::Loop() + 292 15 znc 0x0000000102204df0 main + 3232 16 znc 0x0000000102203674 start + 52

Thread 1: 0 libsystem_kernel.dylib 0x00007fff8d473bca __psynch_cvwait + 10 1 libsystem_c.dylib 0x00007fff8d563274 _pthread_cond_wait + 840 2 znc 0x00000001022f5588 CSockManager::TDNSThread(void*) + 200 3 libsystem_c.dylib 0x00007fff8d55f8bf _pthread_start + 335 4 libsystem_c.dylib 0x00007fff8d562b75 thread_start + 13

Thread 0 crashed with X86 Thread State (64-bit): rax: 0x0000000000000000 rbx: 0x0000000000000006 rcx: 0x00007fff61dff9a8 rdx: 0x0000000000000000 rdi: 0x0000000000000203 rsi: 0x0000000000000006 rbp: 0x00007fff61dff9d0 rsp: 0x00007fff61dff9a8 r8: 0x00007fff73e04fb8 r9: 0x0000000000000000 r10: 0x00007fff8d473d0a r11: 0xffffff80002d8220 r12: 0x000000010239f000 r13: 0x0000000102401000 r14: 0x00007fff73e07960 r15: 0x00000001024010c0 rip: 0x00007fff8d473ce2 rfl: 0x0000000000000246 cr2: 0x0000000102404000 Logical CPU: 0