Double segfault in id custom heap allocator.

[phire]

This is not very reproducible. It seamed to happen 2 out of 15 times when I approached the guy on the bench right near the start of mars_city1.

64bit cmake build, revision 9d762e7

Backtrace (entry 15 contains the first segfault):

(gdb) bt
#0  0x00000000005c9c5f in idBlockAlloc<idSampleDecoderLocal, 64>::Shutdown (
    this=0x18400e0)
    at /home/phire/projects/doom3/doom3.gpl/neo/sound/../idlib/../idlib/Heap.h:227
#1  0x00000000005ca780 in idBlockAlloc<idSampleDecoderLocal, 64>::~idBlockAlloc
    (this=0x18400e0, __in_chrg=<optimized out>)
    at /home/phire/projects/doom3/doom3.gpl/neo/sound/../idlib/../idlib/Heap.h:193
#2  0x00007ff98af794b1 in ?? () from /lib/libc.so.6
#3  0x00007ff98af79535 in exit () from /lib/libc.so.6
#4  0x0000000000636b9d in Posix_Exit (ret=11)
    at /home/phire/projects/doom3/doom3.gpl/neo/sys/posix/posix_main.cpp:101
#5  0x0000000000638be9 in sig_handler (signum=11, info=0x7fff59cb1bb0, 
    context=0x7fff59cb1a80)
    at /home/phire/projects/doom3/doom3.gpl/neo/sys/posix/posix_signal.cpp:100
#6  <signal handler called>
#7  0x00000000005c9c5f in idBlockAlloc<idSampleDecoderLocal, 64>::Shutdown (
    this=0x18400e0)
    at /home/phire/projects/doom3/doom3.gpl/neo/sound/../idlib/../idlib/Heap.h:227
#8  0x00000000005c8ea8 in idSampleDecoder::Shutdown ()
    at /home/phire/projects/doom3/doom3.gpl/neo/sound/snd_decoder.cpp:331
#9  0x00000000005d1eb6 in idSoundSystemLocal::Shutdown (this=0x1840ee0)
    at /home/phire/projects/doom3/doom3.gpl/neo/sound/snd_system.cpp:486
#10 0x00000000004e1406 in idCommonLocal::ShutdownGame (this=0xd65b40, 
    reloading=false)
    at /home/phire/projects/doom3/doom3.gpl/neo/framework/Common.cpp:3072
#11 0x00000000004e0bd7 in idCommonLocal::Shutdown (this=0xd65b40)
    at /home/phire/projects/doom3/doom3.gpl/neo/framework/Common.cpp:2881
#12 0x00000000004d9188 in idCommonLocal::Quit (this=0xd65b40)
    at /home/phire/projects/doom3/doom3.gpl/neo/framework/Common.cpp:786
#13 0x0000000000638c6a in sig_handler (signum=11, info=0x7fff59cb21b0, 
    context=0x7fff59cb2080)
    at /home/phire/projects/doom3/doom3.gpl/neo/sys/posix/posix_signal.cpp:120
#14 <signal handler called>
#15 0x00000000005c9ebc in idBlockAlloc<idSampleDecoderLocal, 64>::Alloc (
    this=0x18400e0)
    at /home/phire/projects/doom3/doom3.gpl/neo/sound/../idlib/../idlib/Heap.h:210
#16 0x00000000005c8ebc in idSampleDecoder::Alloc ()
    at /home/phire/projects/doom3/doom3.gpl/neo/sound/snd_decoder.cpp:340
#17 0x00000000005cbd4f in idSoundChannel::Start (this=0x16097110)
    at /home/phire/projects/doom3/doom3.gpl/neo/sound/snd_emitter.cpp:202
#18 0x00000000005cdae4 in idSoundEmitterLocal::StartSound (this=0x160970b0, 
    shader=0xb8ef5d0, channel=0, diversity=0.928833008, soundShaderFlags=0, 
    allowSlow=true)
    at /home/phire/projects/doom3/doom3.gpl/neo/sound/snd_emitter.cpp:838
#19 0x00007ff97e0a6933 in idEntity::StartSoundShader (this=0xce7acd4, 
    shader=0xb8ef5d0, channel=0, soundShaderFlags=0, broadcast=false, 
    length=0x0)
    at /home/phire/projects/doom3/doom3.gpl/neo/game/Entity.cpp:1605
#20 0x00007ff97e0c25c4 in idEntityFx::Run (this=0xce7acd4, time=111360)
    at /home/phire/projects/doom3/doom3.gpl/neo/game/Fx.cpp:446
#21 0x00007ff97e0c3425 in idEntityFx::Think (this=0xce7acd4)
    at /home/phire/projects/doom3/doom3.gpl/neo/game/Fx.cpp:606
#22 0x00007ff97e0d18d1 in idGameLocal::RunFrame (this=0x7ff97e630cc0, 
    clientCmds=0x7fff59cb3880)
    at /home/phire/projects/doom3/doom3.gpl/neo/game/Game_local.cpp:2269
#23 0x000000000053a64a in idSessionLocal::RunGameTic (this=0xdf6520)
    at /home/phire/projects/doom3/doom3.gpl/neo/framework/Session.cpp:2777
#24 0x000000000053a34b in idSessionLocal::Frame (this=0xdf6520)
    at /home/phire/projects/doom3/doom3.gpl/neo/framework/Session.cpp:2723
#25 0x00000000004dfe0f in idCommonLocal::Frame (this=0xd65b40)
    at /home/phire/projects/doom3/doom3.gpl/neo/framework/Common.cpp:2465
#26 0x000000000063a521 in main (argc=1, argv=0x7fff59cb3ac8)
    at /home/phire/projects/doom3/doom3.gpl/neo/sys/linux/main.cpp:578

It looks like the block/free lists are getting corrupted.