ZNC crashes with multiple keyxs too quickly, or a keyx w/ a timeout and another keyx

[cosmosified]

something is being freed that has already been freed.. i think.. i've been able to reproduce it and am now trying to get a debug version up and running so i can gdb it.

will keep this posted when i have more concrete evidence/ information.

This build is running on Mac OSX 10.7.2 w/ Xcode 4.2.1 ..

once i get a good bt from gdb, i'll post more.

thanks!

[dctrwatson]

Any luck with your debugging?

[cosmosified]

Process: znc [34689]
Path: /usr/local/bin/znc
Identifier: znc
Version: ??? (???)
Code Type: X86-64 (Native)
Parent Process: ??? [1]

Date/Time: 2012-02-23 08:17:23.917 -0600
OS Version: Mac OS X Server 10.7.3 (11D50b)
Report Version: 9

Crashed Thread: 0 Dispatch queue: com.apple.main-thread

Exception Type: EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000

Application Specific Information:
*** error for object 0x7fd28a812dd8: incorrect checksum for freed object - object was probably modified after being freed.

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0 libsystem_kernel.dylib 0x00007fff8d473ce2 __pthread_kill + 10
1 libsystem_c.dylib 0x00007fff8d5617d2 pthread_kill + 95
2 libsystem_c.dylib 0x00007fff8d552a7a abort + 143
3 libsystem_c.dylib 0x00007fff8d5744ac szone_error + 459
4 libsystem_c.dylib 0x00007fff8d5744e8 free_list_checksum_botch + 29
5 libsystem_c.dylib 0x00007fff8d57836c szone_free_definite_size + 1216
6 libsystem_c.dylib 0x00007fff8d5b1789 free + 194
7 libstdc++.6.dylib 0x00007fff8e3206b4 std::string::_Rep::_M_destroy(std::allocator const&) + 34
8 fish.so 0x000000010271b321 CFishMod::OnUserMsg(CString&, CString&) + 1521
9 znc 0x00000001022a1b5a CModules::OnUserMsg(CString&, CString&) + 234
10 znc 0x0000000102287029 CClient::ReadLine(CString const&) + 35577
11 znc 0x00000001022176aa Csock::PushBuff(char const*, unsigned long, bool) + 266
12 znc 0x000000010221df4f CSocketManager::Loop() + 1103
13 znc 0x0000000102212c91 CSocketManager::DynamicSelectLoop(unsigned long, unsigned long, long) + 49
14 znc 0x0000000102239fa4 CZNC::Loop() + 292
15 znc 0x0000000102204df0 main + 3232
16 znc 0x0000000102203674 start + 52

Thread 1:
0 libsystem_kernel.dylib 0x00007fff8d473bca __psynch_cvwait + 10
1 libsystem_c.dylib 0x00007fff8d563274 _pthread_cond_wait + 840
2 znc 0x00000001022f5588 CSockManager::TDNSThread(void*) + 200
3 libsystem_c.dylib 0x00007fff8d55f8bf _pthread_start + 335
4 libsystem_c.dylib 0x00007fff8d562b75 thread_start + 13

Thread 0 crashed with X86 Thread State (64-bit):
rax: 0x0000000000000000 rbx: 0x0000000000000006 rcx: 0x00007fff61dff9a8 rdx: 0x0000000000000000
rdi: 0x0000000000000203 rsi: 0x0000000000000006 rbp: 0x00007fff61dff9d0 rsp: 0x00007fff61dff9a8
r8: 0x00007fff73e04fb8 r9: 0x0000000000000000 r10: 0x00007fff8d473d0a r11: 0xffffff80002d8220
r12: 0x000000010239f000 r13: 0x0000000102401000 r14: 0x00007fff73e07960 r15: 0x00000001024010c0
rip: 0x00007fff8d473ce2 rfl: 0x0000000000000246 cr2: 0x0000000102404000
Logical CPU: 0