invalid write and read in btCollisionDispatcher in 2.73

[zzcn]

i am running bullet on ibm cell blade, the version is 2.73.
i found some invalid write and read problem in my program, so i test it with valgrind with the following simple test code:

#include "btBulletDynamicsCommon.h"
#include "btBulletCollisionCommon.h"
#include <stdio.h>

#define MAXOBJS 1024

main () {
btDefaultCollisionConfiguration* m_collisionConfiguration;
btDiscreteDynamicsWorld* m_dynamicsWorld;
btBroadphaseInterface* m_broadphase;
btCollisionDispatcher* m_dispatcher;
btConstraintSolver* m_solver;


printf("initiation\n");
m_collisionConfiguration = new btDefaultCollisionConfiguration();
m_dispatcher = new btCollisionDispatcher(m_collisionConfiguration);

btVector3 worldAabbMin(-10000,-10000,-10000);
btVector3 worldAabbMax(10000,10000,10000);

m_broadphase = new btAxisSweep3(worldAabbMin,worldAabbMax,MAXOBJS);
btSequentialImpulseConstraintSolver* solver = new btSequentialImpulseConstraintSolver();

m_solver = solver;

btDiscreteDynamicsWorld* world = new btDiscreteDynamicsWorld(m_dispatcher,m_broadphase,m_solver,m_collisionConfiguration);
m_dynamicsWorld = world;

m_dynamicsWorld->setGravity(btVector3(0,0,-10));
}

here is part of the log file from valgrind:


==26908== Invalid write of size 4
==26908== at 0x10026AA4: btCollisionDispatcher::btCollisionDispatcher(btCollisionConfiguration*) (in /home/zhaokun/bullet_server/testOnly)
==26908== by 0x10000B84: main (testOnly.cc:17)
==26908== Address 0x727f954 is 12 bytes after a block of size 4,304 alloc'd
==26908== at 0xFF6B264: operator new(unsigned) (vg_replace_malloc.c:224)
==26908== by 0x10000B6C: main (testOnly.cc:17)
==26908==
==26908== Invalid read of size 4
==26908== at 0x10026AF0: btCollisionDispatcher::btCollisionDispatcher(btCollisionConfiguration*) (in /home/zhaokun/bullet_server/testOnly)
==26908== by 0x10000B84: main (testOnly.cc:17)
==26908== Address 0x727f954 is 12 bytes after a block of size 4,304 alloc'd
==26908== at 0xFF6B264: operator new(unsigned) (vg_replace_malloc.c:224)
==26908== by 0x10000B6C: main (testOnly.cc:17)
==26908==
==26908== Invalid write of size 4
==26908== at 0x10026B14: btCollisionDispatcher::btCollisionDispatcher(btCollisionConfiguration*) (in /home/zhaokun/bullet_server/testOnly)
==26908== by 0x10000B84: main (testOnly.cc:17)
==26908== Address 0x727f948 is 0 bytes after a block of size 4,304 alloc'd
==26908== at 0xFF6B264: operator new(unsigned) (vg_replace_malloc.c:224)
==26908== by 0x10000B6C: main (testOnly.cc:17)
==26908==

if i do a malloc just after this test code like this:
#include "btBulletDynamicsCommon.h"
#include "btBulletCollisionCommon.h"
#include <stdio.h>

#define MAXOBJS 1024

main () {
btDefaultCollisionConfiguration* m_collisionConfiguration;
btDiscreteDynamicsWorld* m_dynamicsWorld;
btBroadphaseInterface* m_broadphase;
btCollisionDispatcher* m_dispatcher;
btConstraintSolver* m_solver;


printf("initiation\n");
m_collisionConfiguration = new btDefaultCollisionConfiguration();
m_dispatcher = new btCollisionDispatcher(m_collisionConfiguration);

btVector3 worldAabbMin(-10000,-10000,-10000);
btVector3 worldAabbMax(10000,10000,10000);

m_broadphase = new btAxisSweep3(worldAabbMin,worldAabbMax,MAXOBJS);
btSequentialImpulseConstraintSolver* solver = new btSequentialImpulseConstraintSolver();

m_solver = solver;

btDiscreteDynamicsWorld* world = new btDiscreteDynamicsWorld(m_dispatcher,m_broadphase,m_solver,m_collisionConfiguration);
m_dynamicsWorld = world;

m_dynamicsWorld->setGravity(btVector3(0,0,-10));

//test
char *temp = (char*)malloc(3000000);
free(temp);

}

then there will be a segmentation fault directly comes from the call of malloc!
if i run it with valgrind, there is no segmentation fault.
is this a bullet bug or something wrong with my code?
can anyone give me somthing advices or know somthing about this problem

thx for any suggestions!

kun