(gdb) bt full
#0  0x00866416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x00348460 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
        resultvar = <value optimized out>
        pid = 4771828
        selftid = 21177
#2  0x00349e28 in abort () at abort.c:88
        act = {__sigaction_handler = {sa_handler = 0xb633688c, sa_sigaction = 0xb633688c}, sa_mask = {__val = {4444825, 3252800, 
      0, 3252800, 0, 3056822552, 4198478, 3087398208, 1011, 22723, 3330565, 4260521, 4771828, 3056822412, 4165311, 9, 3056822480, 
      2, 0, 4771828, 9, 7, 3056822596, 4291288, 2, 3056822480, 9, 0, 4578933, 4578929, 4573884, 4583575}}, sa_flags = 4583619, 
  sa_restorer = 0x45f0bf}
        sigs = {__val = {32, 0 <repeats 31 times>}}
#3  0x00385fed in __libc_message (do_abort=2, fmt=0x460e68 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
        ap = 0xb6336fb4 "@\017F"
        fd = 2
        on_2 = <value optimized out>
        list = <value optimized out>
        nlist = 7
        cp = <value optimized out>
        written = 6
#4  0x0038c3a4 in malloc_printerr (action=2, str=0x460f40 "double free or corruption (out)", ptr=0xb742f090) at malloc.c:5994
        buf = "b742f090"
        cp = 0x52b9 <Address 0x52b9 out of bounds>
#5  0x0038e356 in __libc_free (mem=0xb742f090) at malloc.c:3625
        ar_ptr = (struct malloc_state *) 0x48e140
        p = (mchunkptr) 0xb742f088
        hook = (void (*)(void *, const void *)) 0x6
#6  0x0037bda4 in _IO_new_fclose (fp=0xb742f090) at iofclose.c:88
        status = -1
#7  0x080d5b7d in filestream_destructor (arg=0xb627fd10) at file.c:329
        cmd = 0x0
        size = 0
        f = (struct ast_filestream *) 0xb627fd10
        __PRETTY_FUNCTION__ = "filestream_destructor"
#8  0x080806b0 in ao2_ref (user_data=0xb627fd10, delta=-1) at astobj2.c:227
        current_value = 0
        ret = 1
        obj = (struct astobj2 *) 0xb627fc28
        __PRETTY_FUNCTION__ = "ao2_ref"
#9  0x080d8813 in ast_filestream_frame_freed (fr=0xb627fd40) at file.c:1309
        fs = (struct ast_filestream *) 0xb627fd10
#10 0x080d9ca8 in __frame_free (fr=0xb627fd40, cache=1) at frame.c:338
        __PRETTY_FUNCTION__ = "__frame_free"
#11 0x080d9e06 in ast_frame_free (frame=0xb627fd40, cache=1) at frame.c:380
        next = (struct ast_frame *) 0x0
#12 0x087856e5 in moh_files_generator (chan=0x95ecec8, data=0xb5c16658, len=0, samples=160) at res_musiconhold.c:302
        state = (struct moh_files_state *) 0xb5c16658
        f = (struct ast_frame *) 0xb627fd40
        res = 0
        __PRETTY_FUNCTION__ = "moh_files_generator"
#13 0x0809706d in generator_force (data=0x95ecec8) at channel.c:1932
        tmp = (void *) 0xb5c16658
        res = 0
        generate = (int (*)(struct ast_channel *, void *, int, int)) 0x878563e <moh_files_generator>
        chan = (struct ast_channel *) 0x95ecec8
        __PRETTY_FUNCTION__ = "generator_force"
#14 0x08098897 in __ast_read (chan=0x95ecec8, dropaudio=0) at channel.c:2649
        func = (int (*)(const void *)) 0x8096f4b <generator_force>
         data = (void *) 0x95ecec8
        res = 0
        f = (struct ast_frame *) 0x0
        blah = 15
        prestate = 6
        count = 2
        __PRETTY_FUNCTION__ = "__ast_read"
#15 0x0809a2bd in ast_read (chan=0x95ecec8) at channel.c:3023
No locals.
#16 0x080a0487 in ast_generic_bridge (c0=0x95ecec8, c1=0xb7464c10, config=0xb6339540, fo=0xb6337a5c, rc=0xb6337a58, bridge_end=
      {tv_sec = 0, tv_usec = 0}) at channel.c:4751
        who = (struct ast_channel *) 0x95ecec8
        other = (struct ast_channel *) 0xb7464c10
        cs = {0x95ecec8, 0xb7464c10, 0xb7464c10}
        f = (struct ast_frame *) 0x81c0140
        res = AST_BRIDGE_COMPLETE
        o0nativeformats = 256
        o1nativeformats = 4
        watch_c0_dtmf = 1
        watch_c1_dtmf = 2
        pvt0 = (void *) 0x935a030
        pvt1 = (void *) 0xb5028d90
        frame_put_in_jb = 0
        jb_in_use = 0
        to = -1
        __PRETTY_FUNCTION__ = "ast_generic_bridge"
#17 0x080a1ebb in ast_channel_bridge (c0=0x95ecec8, c1=0xb7464c10, config=0xb6339540, fo=0xb6337a5c, rc=0xb6337a58)
    at channel.c:5122
        now = {tv_sec = 0, tv_usec = 0}
        to = -1
        who = (struct ast_channel *) 0x0
        res = AST_BRIDGE_COMPLETE
        nativefailed = 0
        firstpass = 1
        o0nativeformats = 256
        o1nativeformats = 4
        time_left_ms = 0
        caller_warning = 0 '\0'
        callee_warning = 0 '\0'
        __PRETTY_FUNCTION__ = "ast_channel_bridge"
#18 0x080cd47e in ast_bridge_call (chan=0x95ecec8, peer=0xb7464c10, config=0xb6339540) at features.c:2330
        other = (struct ast_channel *) 0x818e1c4
        f = (struct ast_frame *) 0x0
        who = (struct ast_channel *) 0xb6337a68
        chan_featurecode = '\0' <repeats 11 times>
        peer_featurecode = '\0' <repeats 11 times>
        orig_channame = "SIP/EXT-THSMSW-0935a030\000\000\000\000\000µÿL\000|àL\000\220ë3¶¹R\000\000\000\000\000\000\001\000\000\000L \025\b\000\000\000\000ôÏH\000\220ë3¶\200dY\tHz3¶¦\000A"
        orig_peername = "SIP/351-b5028d90\000\000\000\000\200dY\tÈy3¶ôÏH\000(\2329·\200dY\tØy3¶¦\000A\000\000Ë\033\b\220ë3¶(z3¶\224é\a\b\000Ë\033\bù\235\030\b(z3¶\217å\a\b"
        res = -1238140296
        diff = 4260006
        hasfeatures = 0
        hadfeatures = 0
        autoloopflag = -1238140216
        aoh = (struct ast_option_header *) 0x928fbc
        backup_config = {features_caller = {flags = 0}, features_callee = {flags = 0}, start_time = {tv_sec = 0, tv_usec = 0}, 
  nexteventts = {tv_sec = 0, tv_usec = 0}, partialfeature_timer = {tv_sec = 0, tv_usec = 0}, feature_timer = 0, timelimit = 0, 
  play_warning = 0, warning_freq = 0, warning_sound = 0x0, end_sound = 0x0, start_sound = 0x0, firstpass = 0, flags = 0, 
  end_bridge_callback = 0, end_bridge_callback_data = 0x0, end_bridge_callback_data_fixup = 0}
        bridge_cdr = (struct ast_cdr *) 0x9641d98
        orig_peer_cdr = (struct ast_cdr *) 0xb61d9f68
        chan_cdr = (struct ast_cdr *) 0x96b26e0
        peer_cdr = (struct ast_cdr *) 0xb61d9f68
        new_chan_cdr = (struct ast_cdr *) 0x0
        new_peer_cdr = (struct ast_cdr *) 0x0
        __PRETTY_FUNCTION__ = "ast_bridge_call"
#19 0x0093840b in try_calling (qe=0xb6339a70, options=0xb63399be "", announceoverride=0xb63399c0 "", url=0xb63399bf "", 
    tries=0xb6339c34, noption=0xb6339c30, agi=0x0, macro=0x0, gosub=0x0, ringing=0) at app_queue.c:3956
        cur = (struct member *) 0x0
        outgoing = (struct callattempt *) 0x0
        to = 8722
        orig = 10000
        oldexten = "s", '\0' <repeats 78 times>
        oldcontext = "FunctionRouteQueue", '\0' <repeats 61 times>
        queuename = "qTHS-Sales", '\0' <repeats 245 times>
        interfacevar = '\0' <repeats 255 times>
        peer = (struct ast_channel *) 0xb7464c10
        which = (struct ast_channel *) 0xffffffff
        lpeer = (struct callattempt *) 0xb61eb410
        member = (struct member *) 0x95d3c68
        app = (struct ast_app *) 0x945b8a
        res = 0
        bridge = 0
        numbusies = 0
        x = 11
        announce = 0x0
        digit = 0 '\0'
        callstart = 1251410307
        now = 1251410304
        bridge_config = {features_caller = {flags = 2}, features_callee = {flags = 2}, start_time = {tv_sec = 1251410307, 
    tv_usec = 770774}, nexteventts = {tv_sec = 0, tv_usec = 0}, partialfeature_timer = {tv_sec = 0, tv_usec = 0}, 
  feature_timer = 0, timelimit = 0, play_warning = 0, warning_freq = 0, warning_sound = 0x0, end_sound = 0x0, start_sound = 0x0, 
  firstpass = 0, flags = 3, end_bridge_callback = 0x934812 <end_bridge_callback>, end_bridge_callback_data = 0x96c93b8, 
  end_bridge_callback_data_fixup = 0x9347d5 <end_bridge_callback_data_fixup>}
        nondataquality = 1 '\001'
        agiexec = 0x0
        macroexec = 0xb6337b60 ""
        gosubexec = 0xb6337b50 ""
        ret = 0
        monitorfilename = 0x960b681 "/var/spool/asterisk/monitor/raw/monitor.ippbx01v2.queue.qTHS-Sales.2009-08-27 21-57-57.17867154920"
        monitor_exec = 0x0
        monitor_options = 0x9452e1 ""
        tmpid = "/var/spool/asterisk/monitor/raw/monitor.ippbx01v2.queue.qTHS-Sales.2009-08-27 21-57-57.17867154920\000L\000ï\001\000\000h\2253¶\000\001\000\000îÉL\000\224øÿÿõ\000\000\000ôÏH\000îÉL\000\230\000\000\000\024Ú8\000ôÏH\000îÉL\000ø\2243¶\002\000\000\000\024\2253¶|àL\000À¿H\000\024Ú8\000\000\000\000\000À¿H\000\t\000\000\000\000\000\000\000\b\000\000\0003ÌE\000\000\000\000"...
        tmpid2 = "/var/spool/asterisk/monitor/raw/monitor.ippbx01v2.queue.qTHS-Sales.2009-08-27 21-57-57.17867154920.wav\000\000\000\000\000\000\000\b\000\000\0003ÌE\000\000\000\000\000\000\000\000\000\002\000\000\000\000\000\000\000L\2303¶J\2243¶ÿÿÿÿ|àL\000\000\000\000\000\b\2243¶\000\000\000\000\001\000\000\000(\b\000\000ø\2233¶ôÏH\000¿\2313¶,\2253¶\004F;\000\215\2273¶'´\036¶\002\000\000"...
        meid = "\000\214\2253¶\032\2273¶\001\000\000\000\000\000\000\000ÿÿÿÿEÝ\031\bDÝ\031\b\000\000\000\000ÿÿÿÿ`\024\033\b\\\024\033\b\000\000\000\000p\2243¶", '\0' <repeats 20 times>, "\n\000\000\000m\2243¶", '\0' <repeats 28 times>, "\001", '\0' <repeats 15 times>, "0\003\000s\000\000\000\000èäϵ£¨8\000\000\000\000dÿÿÿÿ\031\2273¶£¨8\000\000\000\000\000ð\2263¶\005\000\000\000Ö²\000¶\022\000\000\000ø\2263¶p\016^·d³5\000\003\000\000\000\002\000\000\000¦å\030\bd³5\000ôÏH\000\000\000\000\000a\024\033\bH\2263¶\003Í5\000d\2263¶a\024\033\b"...
        meid2 = "\000-\2173¶¨\2203¶\000\000\000\000\000\000\000\000\001\000\000\000\001\000\000\000\000\000\000\000Ý»\030\b\000\000\000\000S\2173¶\034\2213¶", '\0' <repeats 20 times>, "\033\003q\b", '\0' <repeats 12 times>, "$Dá·\000\000\000\000|\2213¶", '\0' <rep
eats 20 times>, "\025\000\000\000ÿÿÿÿ¨\2343¶ß_\020\b\020\2143¶Ëw\024·", '\0' <repeats 12 times>, "\f\2153¶£¨8\000l \f¶º6\035¶\034\000\000\000l \f¶\000\000\000\000\000\2233¶\000\000\000\000\026áE\000\034\000\000\000EÌE\000¦óE\000h\016F\000ôÏH\000\000\000\000\000äR\224\000H\2223¶\003Í5"...
        mixmonargs = "/var/spool/asterisk/monitor/raw/monitor.ippbx01v2.queue.qTHS-Sales.2009-08-27 21-57-57.17867154920.wav,b\000\000\000\000\000\000\000ð¿\000\000\000\000\000\000ð¿\000\000\000\000\000\000ð¿\000\000\000\000\000\000ð?\000\000\000\000\000\000ð¿\000\000\000\000\000\000ð¿²Vó8\223!P@Ùß= u\032R@u-k\232\227ÎR@±\021\000{\232ùQ@8L\222\023\226îN@=Ú>fÕÛI"...
        mixmonapp = (struct ast_app *) 0xb7e54670
        p = 0xb63393a1 ".wav"
        vars = "_context res_ext_svc_loop_available res_ext_svc_loop_status res_ext_svc_loop_count res_ext_fallback_one_available res_ext_fallback_one_number res_ext_fallback_one_timeout res_ext_fallback_two_availabl"...
        forwardsallowed = 0
        callcompletedinsl = 1
        memi = {c = 0x91716a8, flags = 0, bucket = 37, c_version = 62, obj = 0x0, version = 0}
        datastore = (struct ast_datastore *) 0xb5c21d50
        transfer_ds = (struct ast_datastore *) 0x9318b78
        queue_end_bridge = (struct queue_end_bridge *) 0x96c93b8
        __PRETTY_FUNCTION__ = "try_calling"
#20 0x0093c288 in queue_exec (chan=0x95ecec8, data=0xb633be38) at app_queue.c:4881
        stat = QUEUE_NORMAL
        exit = 0
        res = 0
        ringing = 0
        user_priority = 0x0
        max_penalty_str = 0x0
        min_penalty_str = 0x0
        prio = 0
        qcontinue = 0
        max_penalty = 0
        min_penalty = 0
        reason = QUEUE_UNKNOWN
        tries = 0
        noption = 0
        parse = 0xb63399b0 "qTHS-Sales"
        makeannouncement = 1
        args = {argc = 5, argv = 0xb6339c0c, queuename = 0xb63399b0 "qTHS-Sales", options = 0xb63399bb "itT", url = 0xb63399bf "", 
  announceoverride = 0xb63399c0 "", queuetimeoutstr = 0xb63399c1 "1200", agi = 0x0, macro = 0x0, gosub = 0x0, rule = 0x0}
        qe = {parent = 0x91713a0, moh = "qTHSSales", '\0' <repeats 70 times>, announce = '\0' <repeats 79 times>, 
  context = "IVR-THSSales-Day", '\0' <repeats 63 times>, digits = '\0' <repeats 79 times>, valid_digits = 0, pos = 1, prio = 0, 
  last_pos_said = 0, last_periodic_announce_time = 1251410302, last_periodic_announce_sound = 0, last_pos = 0, opos = 1, 
  handled = 1, pending = 1, max_penalty = 0, min_penalty = 0, linpos = 0, linwrapped = 0, start = 1251410302, expire = 1251411502, 
  chan = 0x95ecec8, qe_rules = {first = 0x0, last = 0x0}, pr = 0x0, next = 0x0}
        __PRETTY_FUNCTION__ = "queue_exec"
#21 0x080ff93c in pbx_exec (c=0x95ecec8, app=0x90e3b90, data=0xb633be38) at pbx.c:951
        res = -1238131632
        u = (struct ast_module_user *) 0xb5edd068
        saved_c_appl = 0x0
        saved_c_data = 0x0
        __PRETTY_FUNCTION__ = "pbx_exec"
#22 0x08106bf3 in pbx_extension_helper (c=0x95ecec8, con=0x0, context=0x95ed11c "FunctionRouteQueue", exten=0x95ed16c "s", 
    priority=6, label=0x0, callerid=0xb7ed9ad8 "17867154920", action=E_SPAWN, found=0xb633e27c, combined_find_spawn=1)
    at pbx.c:3120
        e = (struct ast_exten *) 0xb7147888
        app = (struct ast_app *) 0x90e3b90
        res = 403
        q = {incstack = {0x0 <repeats 128 times>}, stacklen = 0, status = 5, swo = 0x0, data = 0x0, 
  foundcontext = 0x95ed11c "FunctionRouteQueue"}
        passdata = "qTHS-Sales,itT,,,1200\000rd-51\00030\000ord\000)\000pbx01v2.queue.qTHS-Sales.2009-08-27 21-57-57.17867154920\000154920,)\000.17867154920\000eout res_ext_user res_ext_routeset res_ext_record res_ext_svc_vm_available res_ext_s"...
        matching_action = 0

        __PRETTY_FUNCTION__ = "pbx_extension_helper"
#23 0x081086c9 in ast_spawn_extension (c=0x95ecec8, context=0x95ed11c "FunctionRouteQueue", exten=0x95ed16c "s", priority=6, 
    callerid=0xb7ed9ad8 "17867154920", found=0xb633e27c, combined_find_spawn=1) at pbx.c:3584
No locals.
#24 0x08108d7b in __ast_pbx_run (c=0x95ecec8, args=0x0) at pbx.c:3671
        dst_exten = "\000\000\000\000îÉL\000¦óE\000h\016F\000UÝE\000îÉL", '\0' <repeats 13 times>, "|àL\000±\b\000\000¹R\000\000\000\000\000\000|àL\000¸÷d\t¹R\000\000\000\000\000\000\001\000\000\000\000\000\000\0008á3¶ôÏH\000\000\000\000\000\000\000\000\000Há3¶¦\000A\000\000Ë\033\b\220ë3¶\230á3¶\224é\a\b\000Ë\033\bù\235\030\b\230á3¶\217å\a\b\000Ë\033\bù\235\030\bôÏH\000\000\000\000\000ñç8\000\230á3¶e\a9\000@áH\000¬\b\000\000@áH\000\000\000\000\000\000\000\000\000îÉL\000\000\000\000\000Øá3¶\212ì\a\bîÉL\000\206\000\000"...
        pos = 0
        digit = 0
        found = 1
        res = 0
        autoloopflag = 0
        error = 0
        __PRETTY_FUNCTION__ = "__ast_pbx_run"
#25 0x08109f92 in pbx_thread (data=0x95ecec8) at pbx.c:3944
        c = (struct ast_channel *) 0x95ecec8
#26 0x0815ad38 in dummy_start (data=0x9379da0) at utils.c:861
        __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {5095412, 0, 0, -1238113464, 1030197001, 1912214133}, 
      __mask_was_saved = 0}}, __pad = {0xb633e410, 0x0, 0x819a6a4, 0x38e2ce}}
        __cancel_routine = (void (*)(void *)) 0x8073781 <ast_unregister_thread>
        __cancel_arg = (void *) 0xb633eb90
        not_first_call = 0
        ret = (void *) 0x48b274
        a = {start_routine = 0x8109f73 <pbx_thread>, data = 0x95ecec8, 
  name = 0x9653248 "pbx_thread", ' ' <repeats 11 times>, "started at [ 3965] pbx.c ast_pbx_start()"}
        lock_info = (struct thr_lock_info *) 0x964f838
        mutex_attr = {__size = "\001\000\000", __align = 1}
        __PRETTY_FUNCTION__ = "dummy_start"
#27 0x004cb51f in start_thread (arg=0xb633eb90) at pthread_create.c:297
        __res = <value optimized out>
        __ignore1 = <value optimized out>
        __ignore2 = <value optimized out>
        pd = (struct pthread *) 0xb633eb90
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {5095412, 0, 0, -1238113208, 1030024969, -1010044827}, mask_was_saved = 0}}, 
  priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
#28 0x0040104e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
No locals.