jemalloc+zeromq segfault

[Peter Bourgon]

I'm running jemalloc 2.2.4 with ØMQ 2.1.7. I've got a very sporadic
segfault occurring in zmq_msg_close, while freeing a previously
allocated message structure. The allocating and deallocating threads
may be different, but the memory is definitely protected by a mutex.
The segfault is only occurring under high load, and is unfortunately
not (yet) easily reproducible.

Just a shot in the dark, but has anyone seen anything like this?

Backtrace follows. Thanks.

__________
#0  0x00007f6850cdd81a in free (ptr=0x7f6623688780) at
include/jemalloc/internal/tcache.h:373
373 include/jemalloc/internal/tcache.h: No such file or directory.
    in include/jemalloc/internal/tcache.h
(gdb) bt
#0  0x00007f6850cdd81a in free (ptr=0x7f6623688780) at
include/jemalloc/internal/tcache.h:373
#1  0x00007f68501763f9 in zmq_msg_close (msg_=0x47d70bc0) at zmq.cpp:153
#2  0x0000000000423206 in buffer_read_message_from_socket
(socket=0x7f684180e200) at ../src/broker.c:579
#3  0x0000000000423d77 in broker_thread (arg=0x0) at ../src/broker.c:828
#4  0x00007f68507c5fc7 in start_thread () from /lib/libpthread.so.0
#5  0x00007f684e26e64d in clone () from /lib/libc.so.6
#6  0x0000000000000000 in ?? ()