segfault in json-0.11.3, Rust 1.15

[brson]

https://github.com/maciejhirsz/json-rust 3bc4e49687bfaa541214d4a3371a543231e18069

I can only repro this on beta, not stable or nightly. Only happens ~10% tries.

brian@ip-10-145-43-250:/mnt2/dev⟫ rustc +beta -Vv
rustc 1.15.0-beta.3 (a035041ba 2017-01-07)
binary: rustc
commit-hash: a035041ba450ce3061d78a2bdb9c446eb5321d0d
commit-date: 2017-01-07
host: x86_64-unknown-linux-gnu
release: 1.15.0-beta.3
LLVM version: 3.9

brian@ip-10-145-43-250:~/dev/json-rust⟫ cargo +beta test --test value
    Finished debug [unoptimized + debuginfo] target(s) in 0.0 secs
     Running target/debug/deps/value-55ec8405f708d290

running 43 tests
test array_len ... ok
test array_members ... ok
test array_contains ... ok
test array_members_mut_rev ... ok
test array_members_mut ... ok
test array_members_rev ... ok
test array_push ... ok
test array_pop ... ok
test array_remove ... ok
test as_fixed_point ... ok
test error_unexpected_unicode_character ... ok
test error_unexpected_token ... ok
test error_unexpected_character ... ok
test fmt_array ... ok
test fmt_boolean ... ok
test fmt_object ... ok
test fmt_string ... ok
test index_by_str ... ok
test index_by_string ... ok
test index_by_string_ref ... ok
test index_mut_by_str ... ok
test index_mut_by_string ... ok
test index_mut_by_string_ref ... ok
test is_as_boolean ... ok
test is_as_number ... ok
test is_empty ... ok
test fmt_number ... ok
test fmt_null ... ok
test is_false ... ok
test is_as_string ... ok
test is_null ... ok
test is_true ... ok
test null_len ... ok
test object_dump_minified ... ok
test object_entries_mut ... ok
test object_dump_pretty ... ok
test object_len ... ok
test object_entries ... ok
test object_entries_mut_rev ... okerror: process didn't exit successfully: `/mnt2/dev/json-rust/target/debug/deps/value-55ec8405f708d290` (signal: 11, SIGSEGV: invalid memory reference)

To learn more, run the command again with --verbose.

cc @maciejhirsz

[nikomatsakis]

cc @rust-lang/compiler

[alexcrichton]

This was previously determined to be nondeterministic, it probably still is I think?

[brson]

Gah, yes I can repro on stable.