Segfault in freeFeatureList called from msDrawVectorLayer at mapdraw.c:700

[sgillies@…]

I have a shapefile with 8320 features, all lines.  Rendering this layer,
whether by using the mapserver programs (shp2img, mapserv) or using
MapScript (mapobj.draw(), layerobj.draw()) results in a segmentation
fault.

However, I _can_ iterate over all 8320 shapes in the layer and then draw
using shapeobj.draw(), and this makes me certain that there isn't anything
wrong with the data.  The shapefile also checks out with OGR and ArcView.
I've drawn line layers with more features than this using the same mapserver
build.

Ran shp2img with the mapfile through gdb and when I hit the trouble spot,
did a 'where":

(gdb) where 
#0  0x00004d00 in freeFeatureList (list=0x313ce00) at mapfile.c:447
...
#6433 0x00004d10 in freeFeatureList (list=0xb4f410) at mapfile.c:449
#6434 0x00004d10 in freeFeatureList (list=0xb4f340) at mapfile.c:449
#6435 0x00004d10 in freeFeatureList (list=0x303fbf0) at mapfile.c:449
#6436 0x00004d10 in freeFeatureList (list=0x2ec73c0) at mapfile.c:449
#6437 0x0000fd2c in msDrawVectorLayer (map=0x2f5000, layer=0x245858,
image=0x36a100) at mapdraw.c:700
#6438 0x0000f7c4 in msDrawLayer (map=0x2f5000, layer=0x245858, image=0x36a100)
at mapdraw.c:515
#6439 0x0000efb0 in msDrawMap (map=0x2f5000) at mapdraw.c:269
#6440 0x00003188 in main (argc=5, argv=0xbffffbc0) at shp2img.c:159
#6441 0x000028dc in _start (argc=5, argv=0xbffffbc0, envp=0xbffffbd8) at
/SourceCache/Csu/Csu-45/crt.c:267
#6442 0x0000275c in start ()

Looking in msDrawLayerVector, I am stumped: I don't see how the code
at line 700 can be executed.  After all, the layer has one style and
so cache should remain MS_FALSE, shpcache should remain NULL and so
should never be freed.

The layer follows:

  LAYER
    NAME "sechwys"
    GROUP "Transportation"
    TILEINDEX "/Data/wms_data/navstreets_demo/tindex/sechwys"
    TYPE LINE
    STATUS DEFAULT

    PROJECTION
      "init=EPSG:4326"
    END

    LABELITEM "HIGHWAY_NM"
    LABELMAXSCALE 50000
    
    CLASS
      NAME "Secondary Highway"
      #STYLE
      #  COLOR 159 90 45
      #  SYMBOL 1
      #  SIZE 3
      #END
      STYLE
        COLOR 222 141 33
        SYMBOL 1
        SIZE 1
      END
      LABEL
        MINFEATURESIZE 10
        MINDISTANCE 100
        BUFFER 1
        BACKGROUNDCOLOR 255 255 255
        BACKGROUNDSHADOWCOLOR 102 102 102
        COLOR 0 0 0
        TYPE TRUETYPE
        FONT "LucidaSansRegular"
        SIZE 8
      END
    END
  END

[sgillies@…]

For now I am working around this bug by disabling the shape cache.

[sdlime]

I have new speedier code to replace this stuff anyway, so this may go away real 
soon...

Steve

[sgillies@…]

Let's close this bug.  If it still exists, I am no longer triggering it in
my app.