valgrind report - TapProducer::next(bool&) (stdlib.h:390) invalid read of size 1

full report from valgrind attach.

valgrid was ran during mutations and rebalancing in/out of 1->3 and 3>1 nodes.

==23434== Thread 8:
==23434== Invalid read of size 1
==23434== at 0x35AFA34AF4: ____strtoul_l_internal (in /lib64/libc-2.5.so)
==23434== by 0x9F26B6F: TapProducer::next(bool&) (stdlib.h:390)
==23434== by 0x9F06BF4: EventuallyPersistentEngine::doWalkTapQueue(void const*, void*, void, unsigned short, unsigned char*, unsigned short*, unsigned int*, unsigned short*, TapProducer*, bool&) (ep_engine.cc:2031)
==23434== by 0x9EF3EE0: EventuallyPersistentEngine::walkTapQueue(void const*, void*, void, unsigned short, unsigned char*, unsigned short*, unsigned int*, unsigned short*) (ep_engine.cc:2196)
==23434== by 0x6A75D45: bucket_tap_iterator_shim (bucket_engine.c:1554)
==23434== by 0x40F9C1: conn_ship_log (memcached.c:2377)
==23434== by 0x412EA6: libevent_tap_process (thread.c:532)
==23434== by 0x4E22DF8: event_base_loop (event.c:1308)
==23434== by 0x413393: worker_libevent (thread.c:304)
==23434== by 0x35B06064A6: start_thread (in /lib64/libpthread-2.5.so)
==23434== by 0x35AFAD3C2C: clone (in /lib64/libc-2.5.so)
==23434== Address 0xc2303b9 is 0 bytes after a block of size 9 alloc'd
==23434== at 0x4A06DC7: operator new(unsigned long) (vg_replace_malloc.c:261)
==23434== by 0x9EBE97B: CheckpointManager::addNewCheckpoint_UNLOCKED(unsigned long) (item.hh:35)
==23434== by 0x9EC0CE9: CheckpointManager::clear() (checkpoint.cc:673)
==23434== by 0x9ECEAEB: EventuallyPersistentStore::reset() (ep.cc:1315)
==23434== by 0x9EE64E8: EventuallyPersistentEngine::flush(void const*, long) (ep_engine.cc:1754)
==23434== by 0x6A76229: bucket_flush (bucket_engine.c:1472)
==23434== by 0x410804: complete_nread_binary (memcached.c:3272)
==23434== by 0x411790: conn_nread (memcached.c:3471)
==23434== by 0x4073F3: event_handler (memcached.c:5576)
==23434== by 0x4E22DF8: event_base_loop (event.c:1308)
==23434== by 0x413393: worker_libevent (thread.c:304)
==23434== by 0x35B06064A6: start_thread (in /lib64/libpthread-2.5.so)