Crash in lcbvb_destroy

Possible memory corruption or double delete.

 

#0 0x00007f9a66b16207 in raise () from /usr/lib64/libc.so.6
No symbol table info available.
#1 0x00007f9a66b178f8 in abort () from /usr/lib64/libc.so.6
No symbol table info available.
#2 0x00000000010a2758 in memfence_check (size=0x0, ptr=<optimized out>) at src/tcmalloc.cc:228
hdr = <optimized out>
foot = <optimized out>
#3 free_fast_path (ptr=<optimized out>) at src/tcmalloc.cc:2132
No locals.
#4 tc_free (ptr=<optimized out>) at src/tcmalloc.cc:2139
No locals.
#5 0x00007f9a68cb1eff in lcbvb_destroy (conf=0x5378ec08) at /usr/src/debug/libcouchbase-2.10.3/src/vbucket/vbucket.c:847
srv = 0x836f0008
ii = 4
#6 0x00007f9a68cd7648 in decref (this=0x8297cf98) at /usr/src/debug/libcouchbase-2.10.3/src/bucketconfig/clconfig.h:545
this = 0x8297cf98
#7 CccpProvider::update (this=this@entry=0x51f7d7a8, host=host@entry=0x527e2008 "192.168.6.23", data=<optimized out>)
at /usr/src/debug/libcouchbase-2.10.3/src/bucketconfig/bc_cccp.cc:207
vbc = <optimized out>
rv = <optimized out>
#8 0x00007f9a68cd77ca in lcb::clconfig::cccp_update (cookie_=<optimized out>, err=LCB_SUCCESS, bytes=0x533bc023, nbytes=14177, origin=0x527e2008)
at /usr/src/debug/libcouchbase-2.10.3/src/bucketconfig/bc_cccp.cc:233
ss = "

{\"rev\":9647,\"name\":\"vcmFcapsDb\",\"uri\":\"/pools/default/buckets/vcmFcapsDb?bucket_uuid=9881075225fe867d300d04851f8cd4ea\",\"streamingUri\":\"/pools/default/bucketsStreaming/vcmFcapsDb?bucket_uuid=9881075225"... cookie = <optimized out> cccp = 0x51f7d7a8 was_active = true #9 0x00007f9a68ce5345 in ext_callback_proxy (pl=<optimized out>, req=<optimized out>, rc=<optimized out>, resdata=<optimized out>) at /usr/src/debug/libcouchbase-2.10.3/src/getconfig.cc:32 server = <optimized out> rd = 0x8547f008 #10 0x00007f9a68ce7129 in H_config (immerr=LCB_SUCCESS, response=0x7f9a58315140, request=0x533ac008, pipeline=0x527bf688) at /usr/src/debug/libcouchbase-2.10.3/src/handler.cc:905 dummy = \{cookie = 0x0, key = 0x0, nkey = 0, cas = 0, rc = LCB_SUCCESS, version = 0, rflags = 0}

exdata = 0x8547f008
#11 mcreq_dispatch_response (pipeline=0x527bf688, req=0x533ac008, res=0x7f9a58315140, immerr=LCB_SUCCESS) at /usr/src/debug/libcouchbase-2.10.3/src/handler.cc:1021
No locals.
#12 0x00007f9a68d147ea in lcb::Server::try_read (this=this@entry=0x527bf688, ctx=ctx@entry=0x53083d48, ior=ior@entry=0x53083d90)
at /usr/src/debug/libcouchbase-2.10.3/src/mcserver/mcserver.cc:397
mcresp = {res = {response =

{magic = 24 '\030', opcode = 181 '\265', keylen = 3, extlen = 0 '\000', datatype = 1 '\001', status = 0, bodylen = 1681326080, opaque = 2849, cas = 0}

, bytes = "\030\265\003\000\000\001\000\000\000\000\067d!\v\000\000\000\000\000\000\000\000\000"}, payload = 0x533bc020,
bufh = 0x530ff098}
request = 0x533ac008
is_last = 1
err_override = LCB_SUCCESS
rdstate = lcb::Server::PKT_READ_COMPLETE
pktsize = 14204
unknown_err_rv = <optimized out>
#13 0x00007f9a68d14c5e in on_read (ctx=0x53083d48) at /usr/src/debug/libcouchbase-2.10.3/src/mcserver/mcserver.cc:460
ior = 0x53083d90
rv = <optimized out>
#14 0x00007f9a68cbe167 in invoke_read_cb (nb=14204, ctx=0x53083d48) at /usr/src/debug/libcouchbase-2.10.3/src/lcbio/ctx.c:274
No locals.
#15 E_handler (sock=<optimized out>, which=<optimized out>, arg=0x53083d48) at /usr/src/debug/libcouchbase-2.10.3/src/lcbio/ctx.c:303
nb = 14204
ctx = 0x53083d48
status = LCBIO_PENDING
#16 0x00007f99dbebb3a4 in event_base_loop () from /usr/lib64/libevent_core-2.0.so.5
No symbol table info available.
#17 0x00007f9a68d20857 in lcb_wait (instance=0x527bea08) at /usr/src/debug/libcouchbase-2.10.3/src/wait.cc:103
No locals.