ep-engine crashed when reading data through TAP

Steps:
1. Single node
2. Load 20M x 2KB items (light DGM) or 10M x 2KB items (non-DGM), wait for persistence.
3. Try to read all data through TAP (like cbbackup)

Result:
memcached crash (100% reproducible)

#0 0x00007ff895a5ef34 in std::_Rb_tree_rotate_left(std::_Rb_tree_node_base*, std::_Rb_tree_node_base*&) () from /usr/lib64/libstdc++.so.6
#1 0x00007ff895a5f0d4 in std::_Rb_tree_insert_and_rebalance(bool, std::_Rb_tree_node_base*, std::_Rb_tree_node_base*, std::_Rb_tree_node_base&) ()
from /usr/lib64/libstdc++.so.6
#2 0x00007ff8806e8bf1 in std::_Rb_tree<unsigned short, std::pair<unsigned short const, unsigned long>, std::_Select1st<std::pair<unsigned short const, unsigned long> >, std::less<unsigned short>, std::allocator<std::pair<unsigned short const, unsigned long> > >::insert_unique (this=0x76d9a10, __position=<value optimized out>,
__v=...) at /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../include/c++/4.1.2/bits/stl_tree.h:821
#3 0x00007ff880755d11 in insert (this=0x76d9740, vbid=552) at /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../include/c++/4.1.2/bits/stl_map.h:420
#4 operator[] (this=0x76d9740, vbid=552) at /usr/lib/gcc/x86_64-redhat-linux/4.1.2/../../../../include/c++/4.1.2/bits/stl_map.h:348
#5 CouchKVStore::getNumPersistedDeletes (this=0x76d9740, vbid=552)
at /home/buildbot/centos-5-x64-300-builder/build/build/cmake/ep-engine/src/couch-kvstore/couch-kvstore.cc:2009
#6 0x00007ff88069fa15 in BackfillDiskLoad::run (this=0x1b6887e10) at /home/buildbot/centos-5-x64-300-builder/build/build/cmake/ep-engine/src/backfill.cc:111
#7 0x00007ff8806fec99 in ExecutorThread::run (this=0x2ddce90) at /home/buildbot/centos-5-x64-300-builder/build/build/cmake/ep-engine/src/executorthread.cc:93
#8 0x00007ff8806ff196 in launch_executor_thread (arg=0x1dcfa4370) at /home/buildbot/centos-5-x64-300-builder/build/build/cmake/ep-engine/src/executorthread.cc:33
#9 0x00007ff896388b7f in platform_thread_wrap (arg=0x2dcbb80) at /home/buildbot/centos-5-x64-300-builder/build/build/cmake/platform/src/cb_pthreads.c:19
#10 0x0000003854c079d1 in start_thread () from /lib64/libpthread.so.0
#11 0x00000038548e8b6d in clone () from /lib64/libc.so.6