Segmentation fault in combination with PawnPlus since 4.20

[IS4Code]

Version 4.19.4 works fine, but all versions since 4.20 cause a crash in some situations.

Tested on both CentOS and Ubuntu, on vanilla SA-MP server R2 and R3 just with plugins crashdetect.so PawnPlus.so. Not affected by long_call_time 0. Crashlog is sometimes produced, sometimes not:

----------
Loaded log file: "server_log.txt".
----------

SA-MP Dedicated Server
----------------------
v0.3.7-R2, (C)2005-2015 SA-MP Team

[15:19:55] 
[15:19:55] Server Plugins
[15:19:55] --------------
[15:19:55]  Loading plugin: crashdetect.so
[15:19:55]   CrashDetect plugin 4.20
[15:19:55]   Loaded.
[15:19:55]  Loading plugin: PawnPlus.so
[15:19:55]  PawnPlus v1.4.2 loaded
[15:19:55]  Created by IllidanS4
[15:19:55]   Loaded.
[15:19:55]  Loaded 2 plugins.

[15:19:55] [debug] Server crashed due to an unknown error
[15:19:55] [debug] Native backtrace:
[15:19:55] [debug] #0 f7992f7f in _Z13GetStackTraceRSt6vectorI10StackFrameSaIS0_EEPv () in plugins/crashdetect.so
[15:19:55] [debug] #1 f798b81d in _ZN11CrashDetect20PrintNativeBacktraceERSoRKN2os7ContextE () in plugins/crashdetect.so
[15:19:55] [debug] #2 f798be48 in _ZN11CrashDetect20PrintNativeBacktraceERKN2os7ContextE () in plugins/crashdetect.so
[15:19:55] [debug] #3 f798d5dc in _ZN11CrashDetect7OnCrashERKN2os7ContextE () in plugins/crashdetect.so
[15:19:55] [debug] #4 f799279f in ?? () in plugins/crashdetect.so
[15:19:55] [debug] #5 f7f6a570 in __kernel_rt_sigreturn () in linux-gate.so.1
[15:19:55] [debug] Registers:
[15:19:55] [debug] EAX: 00000000 EBX: 08ddc050 ECX: 20646564 EDX: 08dae7fc
[15:19:55] [debug] ESI: f7b78a5b EDI: f7b7beae EBP: f7b7beae ESP: ffe7d25c
[15:19:55] [debug] EIP: 00000000 EFLAGS: 00010286
[15:19:55] [debug] Stack:
[15:19:55] [debug] ESP+00000000: f7990d43 00000000 08dbca50 0000ffff
[15:19:55] [debug] ESP+00000020: f76464ea f7b7beae f7b78a5b f796a000
[15:19:55] [debug] ESP+00000040: 00000010 00000006 00000001 f7646469
[15:19:55] [debug] ESP+00000060: f7b044a7 f7b7beae f7b78a5b 6c702032
[15:19:55] [debug] ESP+00000080: f7862a3e 00000003 00000005 f77acdc0
[15:19:55] [debug] ESP+000000a0: f7862b0c 00000006 f7f755fc f79daae1
[15:19:55] [debug] ESP+000000c0: f7862a1d 00000003 f7fa3000 f77acc00
[15:19:55] [debug] ESP+000000e0: 08d9e0d0 f7f652b0 f7f75996 00000001
[15:19:55] [debug] ESP+00000100: f7f652b0 ffe7d3b4 ffe7d3b0 00000008
[15:19:55] [debug] ESP+00000120: f747ab85 f79c86f4 0d39ad3d ffe7d3b0
[15:19:55] [debug] ESP+00000140: 01000001 00000003 00000001 f77af5d0
[15:19:55] [debug] ESP+00000160: f785db2d 00000004 08d9df2c f7a538c5
[15:19:55] [debug] ESP+00000180: f7be6000 00000208 f7be67f8 ffffffc0
[15:19:55] [debug] ESP+000001a0: 00000022 00000210 00000006 0000005c
[15:19:55] [debug] ESP+000001c0: f7beae94 ffe7d44c f7be6000 ffe7d478
[15:19:55] [debug] ESP+000001e0: f7b04440 f7a4b2e0 f7beae94 00000001
[15:19:55] [debug] ESP+00000200: 02446d00 08dae5e0 00000000 0000020c
[15:19:55] [debug] ESP+00000220: f7b04804 f7beae94 f7b04440 f747ab85
[15:19:55] [debug] ESP+00000240: f7b04fa1 08db7a90 08db7ac0 08db7af0
[15:19:55] [debug] ESP+00000260: 000017ff 00001000 ffe7d6ec 00000000
[15:19:55] [debug] ESP+00000280: 00000638 00000000 0000007f 00000000
[15:19:55] [debug] ESP+000002a0: 658ed16e 00000000 007a1200 00000000
[15:19:55] [debug] ESP+000002c0: 658ed162 00000000 040d9900 00000000
[15:19:55] [debug] ESP+000002e0: 00000000 00000000 000000fc 00000001
[15:19:55] [debug] ESP+00000300: 00000000 00000000 00000000 00000000
[15:19:55] [debug] ESP+00000320: 00000000 00000000 00000000 00000000
[15:19:55] [debug] ESP+00000340: 00000000 00000000 00000000 f7a538c5
[15:19:55] [debug] ESP+00000360: f7be6000 00000044 f7be67f8 ffffffc0
[15:19:55] [debug] ESP+00000380: 00000006 00000050 f7b7bf55 0000005b
[15:19:55] [debug] ESP+000003a0: f7be67c0 0000006e ffe7d610 f79daae1
[15:19:55] [debug] ESP+000003c0: 00000001 00000032 00000000 00000000
[15:19:55] [debug] ESP+000003e0: f7a587de 08f1a7d0 00000000 0000004c
[15:19:55] [debug] Loaded modules:
[15:19:55] [debug] 00000000 - 00187f43 samp03svr
[15:19:55] [debug] f7f6a000 - f7f6b3c0 linux-gate.so.1
[15:19:55] [debug] f7f59000 - f7f59ac8 /lib32/libdl.so.2
[15:19:55] [debug] f7f54000 - f7f55168 /lib32/libpthread.so.0
[15:19:55] [debug] f7d20000 - f7f60c59 /lib32/libstdc++.so.6
[15:19:55] [debug] f7c18000 - f7d1e3fc /lib32/libm.so.6
[15:19:55] [debug] f7bf1000 - f7c14eb0 /lib32/libgcc_s.so.1
[15:19:55] [debug] f79c0000 - f7bf8089 /lib32/libc.so.6
[15:19:55] [debug] f7f6c000 - f7fa3b09 /lib/ld-linux.so.2
[15:19:55] [debug] f7973000 - f79bb3d4 plugins/crashdetect.so
[15:19:55] [debug] f7437000 - f7999708 plugins/PawnPlus.so

This point of crash is somewhere before the banlist is loaded (otherwise it would show in log). One possibility points to the fopen hook, which is used in PawnPlus to load debug info from the AMX. There is a crashdetect-specific code in PP that essentially moves the hook one level up in case crashdetect hooks it already.

I can confirm that without the fopen hook in PawnPlus, the server launches fine, but I am not sure what causes the issue. It was also reported that moving to Debian or adding other plugins prevented the crash, but that might be just random behaviour.