This is the backtrace of the crash itself. APR was built with the APR_POOL_DEBUG directive and the 'allocator_free' call at the top of the stackframe attempts to access freed chunk of memory. That memory chunk is filled with POOL_POISON_BYTE (41): #0 allocator_free(allocator = 0x4141414141414141, node = 0x662fd0) at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:369 #1 apr_allocator_free(allocator = 0x4141414141414141, node = 0x662fd0) at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:444 #2 serf_bucket_mem_free(allocator = 0x657a50, block = 0x663008) at buckets/allocator.c:272 #3 free_copied_data(baton = 0x657a50, data = 0x663008 "OPTIONS / HTTP/1.1\\r\\nHost: svn.apache.org\\r\\nUser-Agent: SVN/1.9.0-dev (x86_64-unknown-linux-gnu) serf/1.3.0\\r\\nContent-Type: text/xml\\r\\nConnection: keep-alive\\r\\nAccept-Encoding: gzip\\r\\nDAV: http://subversion"...) at buckets/simple_buckets.c:35 #4 serf_simple_destroy(bucket = 0x65e2e8) at buckets/simple_buckets.c:144 #5 cleanup_aggregate(ctx = 0x633778, allocator = 0x62c6a0) at buckets/aggregate_buckets.c:51 #6 serf_aggregate_destroy_and_data(bucket = 0x6337f8) at buckets/aggregate_buckets.c:122 #7 serf_ssl_encrypt_destroy_and_data(bucket = 0x637798) at buckets/ssl_buckets.c:1696 #8 serf_aggregate_destroy_and_data(bucket = 0x6335f8) at buckets/aggregate_buckets.c:116 #9 destroy_ostream(conn = 0x62c7e0) at outgoing.c:188 #10 serf_connection_close(conn = 0x62c7e0) at outgoing.c:1395 #11 clean_conn(data = 0x62c7e0) at outgoing.c:79 #12 run_cleanups(cref = 0x628980) at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:2405 #13 pool_clear_debug(pool = 0x628960, file_line = 0x7ffff6d7c978 "/home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1553 #14 pool_destroy_debug(pool = 0x628960, file_line = 0x7ffff6d7c978 "/home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1691 #15 pool_clear_debug(pool = 0x628100, file_line = 0x7ffff6d7c978 "/home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1550 #16 pool_destroy_debug(pool = 0x628100, file_line = 0x7ffff6d7c978 "/home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1691 #17 pool_clear_debug(pool = 0x6134a0, file_line = 0x7ffff6d7c978 "/home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1550 #18 pool_destroy_debug(pool = 0x6134a0, file_line = 0x7ffff6d7c978 "/home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1691 #19 pool_clear_debug(pool = 0x611fe0, file_line = 0x7ffff6d7c978 "/home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1550 #20 pool_destroy_debug(pool = 0x611fe0, file_line = 0x7ffff6d7c978 "/home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1691 #21 apr_pool_destroy_debug(pool = 0x611fe0, file_line = 0x7ffff6d7c978 "/home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1733 #22 apr_pool_terminate() at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1445 #23 apr_terminate() at /home/evgeny/apr-1.4.6/misc/unix/start.c:82 #24 __run_exit_handlers(status = 1, listp = 0x7ffff6b286a8 <__exit_funcs>, run_list_atexit = true, run_list_atexit@entry = true) at exit.c:77 #25 __GI_exit(status = ) at exit.c:99 This is the backtrace of the ALLOCATOR creation during 'ssl_init_context'. Allocator mentioned in first backtrace (#2) is clearly from this pool (0x6579b0 is the address of the POOL and 0x657a50 is the address of the ALLOCATOR. So, when POOL is destroyed, ALLOCATOR points to invalid memory and accessing it results in a crash in first backtrace (#0). #0 apr_palloc_debug(pool = 0x6579b0, size = 72, file_line = 0x7ffff6d7cb65 "undefined") at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:1510 #1 apr_palloc(pool = 0x6579b0, size = 72) at /home/evgeny/apr-1.4.6/memory/unix/apr_pools.c:2639 #2 serf_bucket_allocator_create(pool = 0x6579b0, unfreed = 0x0, unfreed_baton = 0x0) at buckets/allocator.c:124 #3 ssl_init_context() at buckets/ssl_buckets.c:1210 #4 serf_bucket_ssl_create(ssl_ctx = 0x0, allocator = 0x629d50, type = 0x7ffff453dbc0 ) at buckets/ssl_buckets.c:1303 #5 serf_bucket_ssl_decrypt_create(stream = 0x637598, ssl_ctx = 0x0, allocator = 0x629d50) at buckets/ssl_buckets.c:1376 #6 conn_setup(sock = 0x6332a0, read_bkt = 0x62c870, write_bkt = 0x7fffffffd888, baton = 0x629d10, pool = 0x628960) at subversion/libsvn_ra_serf/util.c:371 #7 svn_ra_serf__conn_setup(sock = 0x6332a0, read_bkt = 0x62c870, write_bkt = 0x7fffffffd888, baton = 0x629d10, pool = 0x628960) at subversion/libsvn_ra_serf/util.c:429 #8 do_conn_setup(conn = 0x62c7e0) at outgoing.c:218 #9 prepare_conn_streams(conn = 0x62c7e0, istream = 0x62c870, ostreamt = 0x7fffffffd900, ostreamh = 0x7fffffffd908) at outgoing.c:263 #10 serf__open_connections(ctx = 0x628a00) at outgoing.c:385 #11 serf_context_prerun(ctx = 0x628a00) at context.c:185 #12 serf_context_run(ctx = 0x628a00, duration = 500000, pool = 0x632db0) at context.c:273 #13 svn_ra_serf__context_run_wait(done = 0x630d0c, sess = 0x628700, scratch_pool = 0x628100) at subversion/libsvn_ra_serf/util.c:737 #14 svn_ra_serf__context_run_one(handler = 0x630cf0, scratch_pool = 0x628100) at subversion/libsvn_ra_serf/util.c:810 #15 svn_ra_serf__exchange_capabilities(serf_sess = 0x628700, corrected_url = 0x7fffffffdc70, pool = 0x628100) at subversion/libsvn_ra_serf/options.c:491 #16 svn_ra_serf__open(session = 0x6286d0, corrected_url = 0x7fffffffdc70, session_URL = 0x613e50 "https://svn.apache.org", callbacks = 0x6280a0, callback_baton = 0x628070, config = 0x614b00, pool = 0x628100) at subversion/libsvn_ra_serf/serf.c:518 #17 svn_ra_open4(session_p = 0x6139d8, corrected_url_p = 0x0, repos_URL = 0x613e50 "https://svn.apache.org", uuid = 0x0, callbacks = 0x6280a0, callback_baton = 0x628070, config = 0x614b00, pool = 0x6134a0) at subversion/libsvn_ra/ra_loader.c:479 #18 svn_client__open_ra_session_internal(ra_session = 0x6139d8, corrected_url = 0x0, base_url = 0x613e50 "https://svn.apache.org", base_dir_abspath = 0x0, commit_items = 0x0, write_dav_props = 0, read_dav_props = 0, ctx = 0x6148c0, result_pool = 0x6134a0, scratch_pool = 0x6134a0) at subversion/libsvn_client/ra.c:425 #19 svn_client_open_ra_session2(session = 0x6139d8, url = 0x613e50 "https://svn.apache.org", wri_abspath = 0x0, ctx = 0x6148c0, result_pool = 0x6134a0, scratch_pool = 0x6134a0) at subversion/libsvn_client/ra.c:442 #20 main(argc = 3, argv = 0x7fffffffe198) at subversion/svnrdump/svnrdump.c:1154