Crash after cancelling Subversion operation with temporary pool

crash

$ pacman -Q subversion apr serf expat
subversion 1.8.5-2
apr 1.5.0-1
serf 1.3.2-1
expat 2.1.0-3
$ gdb --args ./svn.exe http://gmapcatcher.googlecode.com/svn/trunk
GNU gdb (GDB) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /media/disk/home/proj/vcs-tools/svn.exe...done.
(gdb) run
Starting program: /media/disk/home/proj/vcs-tools/svn.exe http://gmapcatcher.googlecode.com/svn/trunk
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
open http://gmapcatcher.googlecode.com/svn/trunk
cancel? 0
cancel? 0
cancel? 0
cancel? 0
get location segments with separate pool
cancel? 1
location segments error 200015: Cancelling location segments operation [intentional]
svn_error_clear() called
freeing separate location segments pool
get log limit=1
cancel? 0
cancel? 0

Program received signal SIGSEGV, Segmentation fault.
0x0000000000000004 in ?? ()
(gdb) bt
#0  0x0000000000000004 in ?? ()
#1  0x00007ffff7bc615e in apr_pool_destroy () from /usr/lib/libapr-1.so.0
#2  0x00007ffff7bc63e5 in apr_pool_clear () from /usr/lib/libapr-1.so.0
#3  0x00007ffff5262375 in svn_ra_serf__xml_cb_start ()
   from /usr/lib/libsvn_ra_serf-1.so.0
#4  0x00007ffff525f0c8 in ?? () from /usr/lib/libsvn_ra_serf-1.so.0
#5  0x00007ffff4bf4d1f in ?? () from /usr/lib/libexpat.so.1
#6  0x00007ffff4bf5a1e in ?? () from /usr/lib/libexpat.so.1
#7  0x00007ffff4bf3db1 in ?? () from /usr/lib/libexpat.so.1
#8  0x00007ffff4bf453d in ?? () from /usr/lib/libexpat.so.1
#9  0x00007ffff4bf79af in XML_ParseBuffer () from /usr/lib/libexpat.so.1
#10 0x00007ffff525f77a in ?? () from /usr/lib/libsvn_ra_serf-1.so.0
#11 0x00007ffff5260a00 in ?? () from /usr/lib/libsvn_ra_serf-1.so.0
#12 0x00007ffff502fdc6 in serf__process_connection ()
   from /usr/lib/libserf-1.so.1
#13 0x00007ffff502e806 in serf_event_trigger () from /usr/lib/libserf-1.so.1
#14 0x00007ffff502e909 in serf_context_run () from /usr/lib/libserf-1.so.1
#15 0x00007ffff525f3d4 in svn_ra_serf__context_run_wait ()
   from /usr/lib/libsvn_ra_serf-1.so.0
#16 0x00007ffff52604e4 in svn_ra_serf__context_run_one ()
   from /usr/lib/libsvn_ra_serf-1.so.0
#17 0x00007ffff5253f5e in svn_ra_serf__wait_for_props ()
   from /usr/lib/libsvn_ra_serf-1.so.0
#18 0x00007ffff5254022 in svn_ra_serf__retrieve_props ()
   from /usr/lib/libsvn_ra_serf-1.so.0
#19 0x00007ffff525408a in svn_ra_serf__fetch_node_props ()
   from /usr/lib/libsvn_ra_serf-1.so.0
#20 0x00007ffff5260c83 in svn_ra_serf__discover_vcc ()
   from /usr/lib/libsvn_ra_serf-1.so.0
#21 0x00007ffff5255085 in svn_ra_serf__get_stable_url ()
   from /usr/lib/libsvn_ra_serf-1.so.0
#22 0x00007ffff5251650 in svn_ra_serf__get_log ()
   from /usr/lib/libsvn_ra_serf-1.so.0
#23 0x0000000000400e08 in main ()

no-crash

$ ./svn.exe http://gmapcatcher.googlecode.com/svn/trunk
open http://gmapcatcher.googlecode.com/svn/trunk
cancel? 0
cancel? 0
cancel? 0
cancel? 0
get location segments with separate pool
cancel? 1
location segments error 200015: Cancelling location segments operation [intentional]
svn_error_clear() called
NOT freeing temp location segments pool :(
get log limit=1
cancel? 0
cancel? 0
cancel? 0
cancel? 0
cancel? 0
cancel? 0
cancel? 0
log revision 1 [only if temp pool not freed]
get log success [only if temp pool not freed]

svn.c

/*
Compile with
    gcc -Wall svn.c -o svn.exe \
        -I{"$(apr-1-config --includedir)",/usr/include/subversion-1/} \
        $(apr-1-config --link-ld) -lsvn_ra-1 -lsvn_subr-1
*/

#include <apr_general.h>
#include <svn_types.h>
#include <svn_ra.h>
#include <assert.h>
#include <stdio.h>

static svn_error_t* location_segment_receiver(
    svn_location_segment_t* segment, void* baton, apr_pool_t* pool);
static svn_error_t* log_entry_receiver(void* baton,
    svn_log_entry_t* log_entry, apr_pool_t* pool);
static svn_error_t* cancel_check(void* cancel_baton);

int main(int argc, char** argv) {
    apr_pool_t* pool;
    svn_error_t* err;
    int cancel = 0;
    
    apr_initialize();
    assert(0 == apr_pool_create(&pool, NULL));
    svn_ra_initialize(pool);
    
    apr_array_header_t* providers;
    providers = apr_array_make(pool, 0,
        sizeof (svn_auth_provider_object_t*));
    assert(providers != NULL);
    svn_auth_baton_t* auth_baton;
    svn_auth_open(&auth_baton, providers, pool);
    
    char const* url;
    if(argc >= 2) {
        url = argv[1];
    } else {
        url = "http://gmapcatcher.googlecode.com/svn/trunk";
    }
    
    svn_ra_callbacks2_t* callbacks2;
    assert(NULL == svn_ra_create_callbacks(&callbacks2, pool));
    callbacks2->auth_baton = auth_baton;
    callbacks2->cancel_func = cancel_check;
    
    printf("open %s\n", url);
    svn_ra_session_t* ra;
    assert(NULL == svn_ra_open3(&ra,
        url, /* uuid */ NULL, callbacks2, &cancel, /* config */ NULL, pool));
    
    apr_pool_t* loc_pool;
    assert(0 == apr_pool_create(&loc_pool, NULL));
    printf("get location segments with separate pool\n");
    cancel = 1;
    err = svn_ra_get_location_segments(ra,
        "", SVN_INVALID_REVNUM, SVN_INVALID_REVNUM, SVN_INVALID_REVNUM,
        location_segment_receiver, 0, loc_pool);
    assert(NULL != err);
    assert(!cancel);
    printf("location segments error %i: %s [intentional]\n",
        err->apr_err, err->message);
    svn_error_clear(err);
    printf("svn_error_clear() called\n");
    
    if(1) {
        printf("freeing separate location segments pool\n");
        apr_pool_destroy(loc_pool);
    } else {
        printf("NOT freeing temp location segments pool :(\n");
    }
    
    printf("get log limit=1\n");
    err = svn_ra_get_log2(ra,
        /* paths */ NULL, /* start */ 1,
        /* end */ SVN_INVALID_REVNUM, /* limit */ 1,
        /* discover_changed_paths */ FALSE, /* strict_node_history */ FALSE,
        /* include_merged_revisions */ FALSE, /* revprops */ NULL,
        log_entry_receiver, 0, pool);
    assert(NULL == err);
    printf("get log success [only if temp pool not freed]\n");
    
    apr_pool_destroy(pool);
    return 0;
}

static svn_error_t* location_segment_receiver(
svn_location_segment_t* segment, void* baton, apr_pool_t* pool) {
    printf("location segment %s:%li-%li\n", segment->path, segment->range_start, segment->range_end);
    return SVN_NO_ERROR;
}

static svn_error_t* log_entry_receiver(void* baton,
svn_log_entry_t* log_entry, apr_pool_t* pool) {
    printf("log revision %li [only if temp pool not freed]\n", log_entry->revision);
    return SVN_NO_ERROR;
}

static svn_error_t* cancel_check(void* cancel_baton) {
    int* cancel = cancel_baton;
    printf("cancel? %i\n", *cancel);
    if(*cancel) {
        *cancel = 0;
        return svn_error_create(SVN_ERR_CANCELLED, NULL, "Cancelling location segments operation");
    }
    return SVN_NO_ERROR;
}