(gdb) bt full
#0  0x00ae3416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x00348460 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
        resultvar = <value optimized out>
        pid = 4771828
        selftid = 9300
#2  0x00349e28 in abort () at abort.c:88
        act = {__sigaction_handler = {sa_handler = 0xb5443fcc, sa_sigaction = 0xb5443fcc}, sa_mask = {__val = {4444825, 3252800, 
      0, 3252800, 0, 3041149016, 4198478, 3087254848, 1011, 22723, 3330565, 4260521, 4771828, 3041148876, 4165311, 9, 3041148944, 
      2, 0, 4771828, 9, 7, 3041149060, 4291288, 2, 3041148944, 9, 0, 4578933, 4578929, 4573884, 4583575}}, sa_flags = 4583619, 
  sa_restorer = 0x45f0bf}
        sigs = {__val = {32, 0 <repeats 31 times>}}
#3  0x00385fed in __libc_message (do_abort=2, fmt=0x460e68 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
        ap = 0xb54446f4 "@\017F"
        fd = 2
        on_2 = <value optimized out>
        list = <value optimized out>
        nlist = 7
        cp = <value optimized out>
        written = 6
#4  0x0038c3a4 in malloc_printerr (action=2, str=0x460f40 "double free or corruption (out)", ptr=0xb63b7388) at malloc.c:5994
        buf = "b63b7388"
        cp = 0x2454 <Address 0x2454 out of bounds>
#5  0x0038e356 in __libc_free (mem=0xb63b7388) at malloc.c:3625
        ar_ptr = (struct malloc_state *) 0x48e140
        p = (mchunkptr) 0xb63b7380
        hook = (void (*)(void *, const void *)) 0x6
#6  0x0037bda4 in _IO_new_fclose (fp=0xb63b7388) at iofclose.c:88
        status = 0
#7  0x080e2756 in filestream_destructor (arg=0xb5d580e8) at file.c:329
        size = 1
        __PRETTY_FUNCTION__ = "filestream_destructor"
#8  0x0807fd5a in ao2_ref (user_data=0xb5d580e8, delta=-1) at astobj2.c:227
        current_value = <value optimized out>
        ret = 1
        obj = (struct astobj2 *) 0xb5d58000
        __PRETTY_FUNCTION__ = "ao2_ref"
#9  0x080e2220 in ast_filestream_frame_freed (fr=0xb5d58118) at file.c:1309
No locals.
#10 0x080e93f8 in __frame_free () at frame.c:338
No locals.
#11 ast_frame_free (frame=0xb5d58118, cache=1) at frame.c:380
        next = (struct ast_frame *) 0x0
#12 0x01afc382 in moh_files_generator (chan=0xb5bd10d8, data=0xb63c7760, len=40, samples=320) at res_musiconhold.c:302
        state = (struct moh_files_state *) 0xb63c7760
        f = (struct ast_frame *) 0xb5d58118
        res = 0
        __PRETTY_FUNCTION__ = "moh_files_generator"
#13 0x0809b2bc in ast_read_generator_actions (chan=0xb5bd10d8, f=0xb5b004ec) at channel.c:2500
        tmp = (void *) 0xb63c7760
        res = <value optimized out>
        samples = 320
        __PRETTY_FUNCTION__ = "ast_read_generator_actions"
#14 0x080a360d in __ast_read (chan=0xb5bd10d8, dropaudio=0) at channel.c:2987
        readq_tail = (struct ast_frame *) 0x0
        f = (struct ast_frame *) 0xb5b004ec
        blah = -1253815580
        count = <value optimized out>
        __PRETTY_FUNCTION__ = "__ast_read"
#15 0x080a60fd in ast_generic_bridge () at channel.c:4774
No locals.
#16 ast_channel_bridge (c0=0xb5bd10d8, c1=0xb61537c0, config=0xb54469d0, fo=0xb5444d88, rc=0xb5444d84) at channel.c:5145
        to = -1
        res = <value optimized out>
        nativefailed = 0
---Type <return> to continue, or q <return> to quit--- 
        firstpass = 1
        o0nativeformats = 256
        o1nativeformats = 4
        time_left_ms = -1245900584
        caller_warning = 0 '\0'
        callee_warning = 0 '\0'
        __PRETTY_FUNCTION__ = "ast_channel_bridge"
#17 0x080dacd7 in ast_bridge_call (chan=0xb5bd10d8, peer=0xb61537c0, config=0xb54469d0) at features.c:2330
        other = (struct ast_channel *) 0xb5444b8c
        f = (struct ast_frame *) 0x0
        who = (struct ast_channel *) 0xb5bd10d8
        chan_featurecode = '\0' <repeats 11 times>
        peer_featurecode = '\0' <repeats 11 times>
        orig_channame = "SIP/EXT-THSMSW-b5b7c130\000\000\000\000\000µÿL\000(\"­\000x_\035\bT$\000\000L\021\027\b\000\000\000\000P\006\027\bT$\000\000ôÏH\000\200²X\td\021½µhMDµf\000A"
        orig_peername = "SIP/360-098852e0\000àL", '\0' <repeats 13 times>, "|àL\000\bMDµT$\000\000\000\000\000\000\001\000\000\000\030MDµe\a9\000ôÏH\000\000\000\000\000 Ý\034\b\030MDµ¦\000A"
        res = 156414712
        diff = <value optimized out>
        hasfeatures = 0
        aoh = <value optimized out>
        backup_config = {features_caller = {flags = 0}, features_callee = {flags = 0}, start_time = {tv_sec = 0, tv_usec = 0}, 
  nexteventts = {tv_sec = 0, tv_usec = 0}, partialfeature_timer = {tv_sec = 0, tv_usec = 0}, feature_timer = 0, timelimit = 0, 
  play_warning = 0, warning_freq = 0, warning_sound = 0x0, end_sound = 0x0, start_sound = 0x0, firstpass = 0, flags = 0, 
  end_bridge_callback = 0, end_bridge_callback_data = 0x0, end_bridge_callback_data_fixup = 0}
        bridge_cdr = (struct ast_cdr *) 0xb57f3030
        chan_cdr = (struct ast_cdr *) 0xb562b940
        peer_cdr = (struct ast_cdr *) 0x952b2f8
        new_chan_cdr = <value optimized out>
        new_peer_cdr = <value optimized out>
        __PRETTY_FUNCTION__ = "ast_bridge_call"
#18 0x00ac43c8 in try_calling (qe=0xb5446c08, options=0xb5446b6e "", announceoverride=0xb5446b70 "", url=0xb5446b6f "", 
    tries=0xb5446dcc, noption=0xb5446dc8, agi=0x0, macro=0x0, gosub=0x0, ringing=0) at app_queue.c:3956
        cur = (struct member *) 0x0
        outgoing = (struct callattempt *) 0xb4bea470
        to = 8366
        orig = 10000
        oldexten = "s", '\0' <repeats 78 times>
        oldcontext = "FunctionRouteQueue", '\0' <repeats 61 times>
        queuename = "qTHS-Sales", '\0' <repeats 245 times>
        interfacevar = '\0' <repeats 255 times>
        peer = (struct ast_channel *) 0xb61537c0
        which = (struct ast_channel *) 0x5f736572
        lpeer = (struct callattempt *) 0xb4bea2c0
        member = (struct member *) 0xb5becc00
        app = (struct ast_app *) 0x6c696176
        res = 0
        bridge = <value optimized out>
        numbusies = 0
        x = 13
        announce = 0x0
        digit = 0 '\0'
        callstart = 1252350237
        now = 1252350234
        bridge_config = {features_caller = {flags = 2}, features_callee = {flags = 2}, start_time = {tv_sec = 1252350237, 
    tv_usec = 674363}, nexteventts = {tv_sec = 0, tv_usec = 0}, partialfeature_timer = {tv_sec = 0, tv_usec = 0}, 
  feature_timer = 0, timelimit = 0, play_warning = 0, warning_freq = 0, warning_sound = 0x0, end_sound = 0x0, start_sound = 0x0, 
  firstpass = 0, flags = 3, end_bridge_callback = 0xab0340 <end_bridge_callback>, end_bridge_callback_data = 0xb5bebac0, 
  end_bridge_callback_data_fixup = 0xaabd70 <end_bridge_callback_data_fixup>}
        nondataquality = 1 '\001'
        macroexec = <value optimized out>
        gosubexec = 0xb5444de0 ""
        monitorfilename = <value optimized out>
        monitor_exec = 0x0
        monitor_options = 0xacbbb2 ""
        tmpid = "/var/spool/asterisk/monitor/raw/monitor.ippbx01v2.queue.qTHS-Sales.2009-09-07 19-03-26.54\000\000\000\002\000\000\0---Type <return> to continue, or q <return> to quit---
00$§8\000$ò\215\tºgDµ\000\001\000\000ñç8\000|hDµ\004F;\000u3\023¶zhDµ\002\000\000\000\033Æ5\000ôÏH\000w3\023¶\210gDµ\026áE\0004ÌE\000EÌE\000À¿H\000\a\000\000\000\000\000\000\000\027\000\000\000yÿ:¶\000\000\000\000\000\000\000\000¤gDµX\036\034\b"...
        tmpid2 = "/var/spool/asterisk/monitor/raw/monitor.ippbx01v2.queue.qTHS-Sales.2009-09-07 19-03-26.54.wav\000DµÀ¿H\000\a\000\000\000\000\000\000\000\b\000\000\0003ÌE\000\000\000\000\000\000\000\000\000\002\000\000\000\000\000\000\000P\006\027\bÚfDµÿÿÿÿ\200²X\t\000\000\000\000xfDµf\000A\000|àL\000\000\000\000\000¨fDµ\000\000\000\000\001\000\000\000¼gDµ\004F;\000ñiDµo.\023¶\002\000\000\000"...
        meid = "\000ÿÿÿ¨W\033\b§W\033\b\000\000\000\000àfDµ", '\0' <repeats 12 times>, "ÿÿÿÿ\\\036\034\bX\036\034\b\000\000\000\000\000gDµ", '\0' <repeats 20 times>, "\n\000\000\000ýfDµ", '\0' <repeats 28 times>, "\001", '\0' <repeats 15 times>, "0\000\000\000ÿÿÿÿ\231iDµ\220iDµ\000\000\000d`gDµ\001", '\0' <repeats 15 times>, "\224bDµ£¨8\000ôÏH", '\0' <repeats 25 times>, "£¨8\000ë\210±\t\034¯±µ\027\000\000\000\002\211±\t©W\033\bÀiDµâ\001\033\b£¨8\000\003\000\000\000\002\000\000\000DiDµÆà4¶ôÏH"...
        meid2 = "3ÌE\000\000\000\000\000\000\000\000\000\002\000\000\000\000\000\000\000G_Dµj^Dµÿÿÿÿ+ÌE\000\000\000\000\000G_Dµ\200ÓH\000hv\036¶8Ô'\000(^Dµ\026áE\0004ÌE\000EÌE\000\001\000\000\00081o\000§î=¶P^Dµl^Dµh\016F\000ÈÜE\000¡ÜE\000\237\017o\000\000\001\000\000ñç8\000h^Dµß»8\000<\0000¶\b\000\000\000\000\000\000\000@\0000¶ôÏH\000ÿÿÿÿ\210^Dµ2051ôÏH\000\237î=¶×_Dµ¼_DµÌ2;\000+ÌE\000h`Dµ×_Dµ\200ÓH\000¤^DµX\036\034\b"...
        mixmonargs = "/var/spool/asterisk/monitor/raw/monitor.ippbx01v2.queue.qTHS-Sales.2009-09-07 19-03-26.54.wav,b\000d³5\000ôÏH\000\000\000\000\000]\036\034\b\210^Dµ\003Í5\000¤^Dµ]\036\034\b\000\000\000\000\000\000\000\0002hY\027rP0@Àÿÿÿ5\003\000\000\000\000\000\000\000\000ð?£¨8\000ú\210±\t\204cDµl\000\000\000f\211±\t\000\000ð?°_Dµ\000^Dµ£¨8\000\001\000\000\000"...
        mixmonapp = <value optimized out>
        p = <value optimized out>
        vars = "t_fallback_two_available res_ext_fallback_two_number res_ext_fallback_two_timeout\000Îló\214\033ÀMÈË\201ÏÌ\037ÀJuÚ·«\222\034À\217\002/hÉ`\031ÀÔѶ\230L9\026ÀÐÿ§\210U\036\023ÀßGI\200þ\021\020À\nõíÓa(\021À\205knæÒ\221\003Àµ¸\207ó\036×û¿x\205µ\213\003æð¿G\004[yr]Ù¿\026éñ5µqÎ?¤\n\n6¾½\t@*ÐìqT\a\r@"...
        forwardsallowed = 0
        callcompletedinsl = 1
        memi = {c = 0xb7eba350, flags = 0, bucket = 37, c_version = 80, obj = 0x0, version = 0}
        datastore = (struct ast_datastore *) 0xb6104a68
        transfer_ds = (struct ast_datastore *) 0xb5bc1b48
        __PRETTY_FUNCTION__ = "try_calling"
#19 0x00ac9a5c in queue_exec (chan=0xb5bd10d8, data=0xb5448ea8) at app_queue.c:4881
        stat = <value optimized out>
        exit = 11334472
        res = 0
        ringing = 0
        user_priority = <value optimized out>
        max_penalty_str = <value optimized out>
        min_penalty_str = <value optimized out>
        prio = 0
        qcontinue = 0
        max_penalty = 0
        min_penalty = 0
        reason = QUEUE_UNKNOWN
        tries = 0
        noption = 0
        makeannouncement = <value optimized out>
        args = {argc = 5, argv = 0xb5446da4, queuename = 0xb5446b60 "qTHS-Sales", options = 0xb5446b6b "itT", url = 0xb5446b6f "", 
  announceoverride = 0xb5446b70 "", queuetimeoutstr = 0xb5446b71 "1200", agi = 0x0, macro = 0x0, gosub = 0x0, rule = 0x0}
        qe = {parent = 0xb7eba048, moh = "qTHSSales", '\0' <repeats 70 times>, announce = '\0' <repeats 79 times>, 
  context = "IVR-THSSales-Day", '\0' <repeats 63 times>, digits = '\0' <repeats 79 times>, valid_digits = 0, pos = 1, prio = 0, 
  last_pos_said = 0, last_periodic_announce_time = 1252350231, last_periodic_announce_sound = 0, last_pos = 0, opos = 1, 
  handled = 1, pending = 1, max_penalty = 0, min_penalty = 0, linpos = 0, linwrapped = 0, start = 1252350231, expire = 1252351431, 
  chan = 0xb5bd10d8, qe_rules = {first = 0x0, last = 0x0}, pr = 0x0, next = 0x0}
        __PRETTY_FUNCTION__ = "queue_exec"
#20 0x08119d1e in pbx_exec (c=0xb5bd10d8, app=0x9510bd8, data=0xb5448ea8) at pbx.c:951
        res = <value optimized out>
        u = (struct ast_module_user *) 0xb63b3d18
        saved_c_appl = 0x0
        saved_c_data = 0x0
        __PRETTY_FUNCTION__ = "pbx_exec"
#21 0x08128859 in pbx_extension_helper (c=0xb5bd10d8, con=0x0, context=0xb5bd132c "FunctionRouteQueue", exten=0xb5bd137c "s", 
    priority=6, label=0x0, callerid=0x98910a0 "54", action=E_SPAWN, found=0xb544b2c8, combined_find_spawn=1) at pbx.c:3120
        e = <value optimized out>
        app = (struct ast_app *) 0x9510bd8
        res = <value optimized out>
        q = {incstack = {0x0 <repeats 128 times>}, stacklen = 0, status = 5, swo = 0x0, data = 0x0, 
  foundcontext = 0xb5bd132c "FunctionRouteQueue"}
        passdata = "qTHS-Sales,itT,,,1200\000rd-51\00030\000ord\000)\000pbx01v2.queue.qTHS-Sales.2009-09-07 19-03-26.54\000-26.54,)\---Type <return> to continue, or q <return> to quit---
000 19-03-26.54\000s_ext_timeout res_ext_user res_ext_routeset res_ext_record res_ext_svc_vm_available res_ext_s"...
        matching_action = 0
        __PRETTY_FUNCTION__ = "pbx_extension_helper"
#22 0x0812bc37 in __ast_pbx_run (c=0xb5bd10d8, args=0x0) at pbx.c:3671
        dst_exten = "T$\000\000\000\000\000\000\001\000\000\000ø±Dµe\a9\000ôÏH\000\220âH\000¦óE\000h\016F\000UÝE\000¡ÜE\000\001\000\000\000 Ý\034\b½ß\a\bxáH\000É\000\000\000\031\000\000\000À²ß\t\001\000\000\000°ºX\t\000\000\000\000\023\000\000\000îÉL\000\000\000\000\000\000\000\000\000:\000M\000\001\000\000\000\000\000\000\000páH\000páH\000îÉL\000\200²X\tT$\000\000\031\000\000\000\000\000\000\000\200²X\t\000\000\000\000µÿL\000|àL\000x_\035\bT$\000\000\000\000\000\000\001\000\000\000\230²Dµe\a9\000ôÏH\000\000\000\000\000 Ý\034\b\230²Dµ¦\000A\000"...
        pos = 0
        digit = 4584358
        found = 1
        res = 0
        error = 0
        __PRETTY_FUNCTION__ = "__ast_pbx_run"
#23 0x0812cf60 in pbx_thread (data=0xb5bd10d8) at pbx.c:3944
No locals.
#24 0x0817130d in dummy_start (data=0xb5b0cff8) at utils.c:861
        __cancel_buf = {__cancel_jmp_buf = {{__cancel_jmp_buf = {5095412, 0, 0, -1253788856, -690335967, 1905994331}, 
      __mask_was_saved = 0}}, __pad = {0xb544b410, 0x0, 0xb544b344, 0x48cff4}}
        __cancel_arg = (void *) 0xb544bb90
        not_first_call = <value optimized out>
        ret = <value optimized out>
        mutex_attr = {__size = "\001\000\000", __align = 1}
        __PRETTY_FUNCTION__ = "dummy_start"
#25 0x004cb51f in start_thread (arg=0xb544bb90) at pthread_create.c:297
        __res = <value optimized out>
        __ignore1 = <value optimized out>
        __ignore2 = <value optimized out>
        pd = (struct pthread *) 0xb544bb90
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {5095412, 0, 0, -1253788600, -690393311, -959025077}, mask_was_saved = 0}}, 
  priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
#26 0x0040104e in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
No locals.
(gdb)