Description of problem:

While attempting to reproduce a Pulseaudio daemon crash I noticed that Rawhide Pulseaudio can be crashed rather easily, by spawning an amount of client that play sound concurrently.

Version-Release number of selected component (if applicable):

pulseaudio-0.9.16-13.test7.fc12.i686
kernel-2.6.31-0.190.rc8.fc12.i686
alsa-lib-1.0.21-1.fc12.i686
glibc-2.10.90-19.i686

How reproducible:

Always been able to reproduce the crash with 100 clients on an IBM T41 laptop.

Steps to Reproduce:

for i in $(seq 1 50); do aplay /usr/share/sounds/alsa/Noise.wav & done
  
Actual results:

[lkundrak@localhost ~]$ pulseaudio
N: alsa-sink.c: Device hw:1 is modem, refusing further initialization.
N: alsa-source.c: Device hw:1 is modem, refusing further initialization.
N: alsa-sink.c: Increasing wakeup watermark to 30.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 40.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 50.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 60.00 ms
N: alsa-source.c: Increasing wakeup watermark to 30.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 70.00 ms
N: alsa-source.c: Increasing wakeup watermark to 40.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 80.00 ms
N: alsa-source.c: Increasing wakeup watermark to 50.00 ms
E: mainloop.c: Assertion '*_head == _item' failed at pulse/mainloop.c:538, function cleanup_io_events(). Aborting.
Aborted

[lkundrak@localhost ~]$ pulseaudio
W: pid.c: Stale PID file, overwriting.
N: alsa-sink.c: Device hw:1 is modem, refusing further initialization.
N: alsa-source.c: Device hw:1 is modem, refusing further initialization.
N: alsa-sink.c: Increasing wakeup watermark to 30.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 40.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 50.00 ms
N: alsa-source.c: Increasing wakeup watermark to 30.00 ms
N: alsa-source.c: Increasing wakeup watermark to 40.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 60.00 ms
Segmentation fault

[lkundrak@localhost ~]$ ulimit -c
unlimited

[lkundrak@localhost ~]$ pulseaudio
W: pid.c: Stale PID file, overwriting.
N: alsa-sink.c: Device hw:1 is modem, refusing further initialization.
N: alsa-source.c: Device hw:1 is modem, refusing further initialization.
N: alsa-sink.c: Increasing wakeup watermark to 30.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 40.00 ms
N: alsa-sink.c: Increasing wakeup watermark to 50.00 ms
N: alsa-source.c: Increasing wakeup watermark to 30.00 ms
*** glibc detected *** pulseaudio: free(): invalid next size (fast): 0x0830ffa0 ***
*** glibc detected *** pulseaudio: corrupted double-linked list: 0x0830ff98 ***

I'm not attaching stack traces since the installation is too disk-space constrained to install the -debuginfo packages and I believe you'll be able to reproduce easily.