ra_serf pool cleanup SEGV

Julian Foad <julianfoad_at_btopenworld.com> writes:

> which is better, but a trunk build using Serf just says:
>
>> svn: XML parsing failed: (405 Method Not Allowed)

It's worse than that. My full valgrind build gives a SEGV, but only
after a whole slew of valgrind warnings like:

$ valgrind -q subversion/svn/.libs/lt-svn ls http://svn.collab.net/repos/svn/trunk/COMMITTERS
svn: XML parsing failed: (405 Method Not Allowed)
==3696== Invalid read of size 4
==3696== at 0x9AEAF2A: serf_bucket_mem_free (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE9AF3: serf_response_destroy_and_data (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE5EC0: cancel_request (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE76BD: serf_request_cancel (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE72DC: serf_connection_close (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE594C: clean_conn (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x5E1329A: run_cleanups (apr_pools.c:2071)
==3696== by 0x5E12398: pool_clear_debug (apr_pools.c:1409)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== Address 0xa8b4688 is 32 bytes inside a block of size 64 free'd
==3696== at 0x4C2130F: free (vg_replace_malloc.c:323)
==3696== by 0x5E12469: pool_clear_debug (apr_pools.c:1432)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1266D: apr_pool_destroy_debug (apr_pools.c:1536)
==3696== by 0x414B27: main (main.c:2262)
==3696==
==3696== Invalid write of size 4
==3696== at 0x9AEAF34: serf_bucket_mem_free (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE9AF3: serf_response_destroy_and_data (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE5EC0: cancel_request (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE76BD: serf_request_cancel (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE72DC: serf_connection_close (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x9AE594C: clean_conn (in /usr/local/serf/lib/libserf-0.so.0.0.0)
==3696== by 0x5E1329A: run_cleanups (apr_pools.c:2071)
==3696== by 0x5E12398: pool_clear_debug (apr_pools.c:1409)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== Address 0xa8b4688 is 32 bytes inside a block of size 64 free'd
==3696== at 0x4C2130F: free (vg_replace_malloc.c:323)
==3696== by 0x5E12469: pool_clear_debug (apr_pools.c:1432)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1237E: pool_clear_debug (apr_pools.c:1406)
==3696== by 0x5E12599: pool_destroy_debug (apr_pools.c:1494)
==3696== by 0x5E1266D: apr_pool_destroy_debug (apr_pools.c:1536)
==3696== by 0x414B27: main (main.c:2262)

-- 
Philip