I just have read the implemention related to  boost::asio::detail::time_queue, and can't find any problem.  Then re-implement log4cplus::helpers::Time::getFormattedTime instead of before. Never crash again.
So, it's bug of log4cplus. Thanks all.

2009/8/19 zong jinliang <zongjinliang@gmail.com>
My code use boost::asio and log4cplus.
There is any memory write error(as follow) which is detected by valgrind. And i can't fix the question.
I have used log4cplus for a long time, and detect my program in valgrind in time, havn't found that there is memory error in log4cplus.
This is the first time to use boost::asio.  Anybody meet crash in boost::asio::detail::time_queue?
 
==4743==
==4743== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 18 from 1)
==4743==
==4743== 1 errors in context 1 of 2:
==4743== Invalid write of size 4
==4743==    at 0x805BD6B: boost::asio::detail::timer_queue<boost::asio::time_traits<boost::posix_time::ptime> >::remove_timer(boost::asio::detail::timer_queue<boost::asio::time_traits<boost::posix_time::ptime> >::timer_base*) (timer_queue.hpp:401)
==4743==    by 0x805C1D2: boost::asio::detail::timer_queue<boost::asio::time_traits<boost::posix_time::ptime> >::dispatch_timers() (timer_queue.hpp:119)
==4743==    by 0x80619C9: boost::asio::detail::epoll_reactor<false>::run(bool) (epoll_reactor.hpp:553)
==4743==    by 0x8061D4F: boost::asio::detail::task_io_service<boost::asio::detail::epoll_reactor<false> >::do_one(boost::asio::detail::scoped_lock<boost::asio::detail::posix_mutex>&, boost::asio::detail::task_io_service<boost::asio::detail::epoll_reactor<false> >::idle_thread_info*, boost::system::error_code&) (task_io_service.hpp:260)
==4743==    by 0x8061F49: boost::asio::detail::task_io_service<boost::asio::detail::epoll_reactor<false> >::run(boost::system::error_code&) (task_io_service.hpp:103)
==4743==    by 0x8061FFD: boost::asio::io_service::run() (io_service.ipp:58)
==4743==    by 0x8050392: CohService::start() (CohService.cpp:29)
==4743==    by 0x8064101: boost::_mfi::mf0<void, CohService>::operator()(CohService*) const (mem_fn_template.hpp:49)
==4743==    by 0x8064151: void boost::_bi::list1<boost::_bi::value<CohService*> >::operator()<boost::_mfi::mf0<void, CohService>, boost::_bi::list0>(boost::_bi::type<void>, boost::_mfi::mf0<void, CohService>&, boost::_bi::list0&, int) (bind.hpp:246)
==4743==    by 0x8064194: boost::_bi::bind_t<void, boost::_mfi::mf0<void, CohService>, boost::_bi::list1<boost::_bi::value<CohService*> > >::operator()() (bind_template.hpp:20)
==4743==    by 0x80641AD: boost::detail::thread_data<boost::_bi::bind_t<void, boost::_mfi::mf0<void, CohService>, boost::_bi::list1<boost::_bi::value<CohService*> > > >::run() (thread.hpp:56)
==4743==    by 0x80B0F4C: thread_proxy (in /home/zjl/test/trunk/cohcommand/test)
==4743==  Address 0x4f2d2f8 is 32 bytes inside a block of size 33 free'd
==4743==    at 0x40052BC: operator delete(void*) (vg_replace_malloc.c:342)
==4743==    by 0x57A813C: std::string::_Rep::_M_destroy(std::allocator<char> const&) (in /usr/lib/libstdc++.so.6.0.8)
==4743==    by 0x57A9F64: std::string::_M_mutate(unsigned int, unsigned int, unsigned int) (in /usr/lib/libstdc++.so.6.0.8)
==4743==    by 0x57A9FB9: std::string::_M_replace_safe(unsigned int, unsigned int, char const*, unsigned int) (in /usr/lib/libstdc++.so.6.0.8)
==4743==    by 0x80AF5B5: std::string& std::string::_M_replace_dispatch<__gnu_cxx::__normal_iterator<char*, std::vector<char, std::allocator<char> > > >(__gnu_cxx::__normal_iterator<char*, std::string>, __gnu_cxx::__normal_iterator<char*, std::string>, __gnu_cxx::__normal_iterator<char*, std::vector<char, std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, std::vector<char, std::allocator<char> > >, __false_type) (basic_string.tcc:643)
==4743==    by 0x80AEF19: log4cplus::helpers::Time::getFormattedTime(std::string const&, bool) const (basic_string.h:1374)
==4743==    by 0x80A236D: log4cplus::pattern::DatePatternConverter::convert(log4cplus::spi::InternalLoggingEvent const&) (patternlayout.cxx:385)
==4743==    by 0x80A4AC7: log4cplus::pattern::PatternConverter::formatAndAppend(std::ostream&, log4cplus::spi::InternalLoggingEvent const&) (patternlayout.cxx:234)
==4743==    by 0x80A4E57: log4cplus::PatternLayout::formatAndAppend(std::ostream&, log4cplus::spi::InternalLoggingEvent const&) (patternlayout.cxx:742)
==4743==    by 0x8093078: log4cplus::RollingFileAppender::append(log4cplus::spi::InternalLoggingEvent const&) (fileappender.cxx:315)
==4743==    by 0x8083F72: log4cplus::Appender::doAppend(log4cplus::spi::InternalLoggingEvent const&) (appender.cxx:207)
==4743==    by 0x80826BD: log4cplus::helpers::AppenderAttachableImpl::appendLoopOnAppenders(log4cplus::spi::InternalLoggingEvent const&) const (appenderattachableimpl.cxx:159)
==4743==
==4743== 1 errors in context 2 of 2:
==4743== Thread 1:
==4743== Invalid write of size 4
==4743==    at 0x807CB59: bool boost::asio::detail::timer_queue<boost::asio::time_traits<boost::posix_time::ptime> >::enqueue_timer<boost::asio::detail::deadline_timer_service<boost::asio::time_traits<boost::posix_time::ptime>, boost::asio::detail::epoll_reactor<false> >::wait_handler<boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> > > >(boost::posix_time::ptime const&, boost::asio::detail::deadline_timer_service<boost::asio::time_traits<boost::posix_time::ptime>, boost::asio::detail::epoll_reactor<false> >::wait_handler<boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> > >, void*) (timer_queue.hpp:80)
==4743==    by 0x807CCC6: void boost::asio::detail::epoll_reactor<false>::schedule_timer<boost::asio::time_traits<boost::posix_time::ptime>, boost::asio::detail::deadline_timer_service<boost::asio::time_traits<boost::posix_time::ptime>, boost::asio::detail::epoll_reactor<false> >::wait_handler<boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> > > >(boost::asio::detail::timer_queue<boost::asio::time_traits<boost::posix_time::ptime> >&, boost::asio::time_traits<boost::posix_time::ptime>::time_type const&, boost::asio::detail::deadline_timer_service<boost::asio::time_traits<boost::posix_time::ptime>, boost::asio::detail::epoll_reactor<false> >::wait_handler<boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> > >, void*) (epoll_reactor.hpp:414)
==4743==    by 0x807CD9F: void boost::asio::detail::deadline_timer_service<boost::asio::time_traits<boost::posix_time::ptime>, boost::asio::detail::epoll_reactor<false> >::async_wait<boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> > >(boost::asio::detail::deadline_timer_service<boost::asio::time_traits<boost::posix_time::ptime>, boost::asio::detail::epoll_reactor<false> >::implementation_type&, boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> >) (deadline_timer_service.hpp:185)
==4743==    by 0x807CE01: void boost::asio::deadline_timer_service<boost::posix_time::ptime, boost::asio::time_traits<boost::posix_time::ptime> >::async_wait<boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> > >(boost::asio::detail::deadline_timer_service<boost::asio::time_traits<boost::posix_time::ptime>, boost::asio::detail::epoll_reactor<false> >::implementation_type&, boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> >) (deadline_timer_service.hpp:157)
==4743==    by 0x807CE35: void boost::asio::basic_deadline_timer<boost::posix_time::ptime, boost::asio::time_traits<boost::posix_time::ptime>, boost::asio::deadline_timer_service<boost::posix_time::ptime, boost::asio::time_traits<boost::posix_time::ptime> > >::async_wait<boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> > >(boost::_bi::bind_t<void, boost::_mfi::mf1<void, CohClientConn, boost::system::error_code const&>, boost::_bi::list2<boost::_bi::value<CohClientConn*>, boost::arg<1> (*)()> >) (basic_deadline_timer.hpp:374)
==4743==    by 0x80720B3: CohClientConn::CohClientConn(ICohCommand*, boost::asio::io_service&, std::string const&, unsigned int, std::string const&, int, int) (CohClientConn.cpp:28)
==4743==    by 0x80500D2: CohService::start_conn(ICohCommand*, std::string const&, unsigned int, std::string const&) (CohService.cpp:34)
==4743==    by 0x8064C3A: ICohCommand::DoRequest(std::string const&, unsigned int, std::string const&) (ICohCommand.cpp:5)
==4743==    by 0x804C9C8: GetConfig::Run() (GetConfig.cpp:18)
==4743==    by 0x804D0E5: ICohAgent::DoGetConfig(void*, std::string const&, std::string const&, std::string const&, std::string const&, std::string const&, std::string const&) (ICohAgent.cpp:7)
==4743==    by 0x804D64D: main (test.cpp:23)
==4743==  Address 0x4f2d2f8 is 32 bytes inside a block of size 33 free'd
==4743==    at 0x40052BC: operator delete(void*) (vg_replace_malloc.c:342)
==4743==    by 0x57A813C: std::string::_Rep::_M_destroy(std::allocator<char> const&) (in /usr/lib/libstdc++.so.6.0.8)
==4743==    by 0x57A9F64: std::string::_M_mutate(unsigned int, unsigned int, unsigned int) (in /usr/lib/libstdc++.so.6.0.8)
==4743==    by 0x57A9FB9: std::string::_M_replace_safe(unsigned int, unsigned int, char const*, unsigned int) (in /usr/lib/libstdc++.so.6.0.8)
==4743==    by 0x80AF5B5: std::string& std::string::_M_replace_dispatch<__gnu_cxx::__normal_iterator<char*, std::vector<char, std::allocator<char> > > >(__gnu_cxx::__normal_iterator<char*, std::string>, __gnu_cxx::__normal_iterator<char*, std::string>, __gnu_cxx::__normal_iterator<char*, std::vector<char, std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, std::vector<char, std::allocator<char> > >, __false_type) (basic_string.tcc:643)
==4743==    by 0x80AEF19: log4cplus::helpers::Time::getFormattedTime(std::string const&, bool) const (basic_string.h:1374)
==4743==    by 0x80A236D: log4cplus::pattern::DatePatternConverter::convert(log4cplus::spi::InternalLoggingEvent const&) (patternlayout.cxx:385)
==4743==    by 0x80A4AC7: log4cplus::pattern::PatternConverter::formatAndAppend(std::ostream&, log4cplus::spi::InternalLoggingEvent const&) (patternlayout.cxx:234)
==4743==    by 0x80A4E57: log4cplus::PatternLayout::formatAndAppend(std::ostream&, log4cplus::spi::InternalLoggingEvent const&) (patternlayout.cxx:742)
==4743==    by 0x8093078: log4cplus::RollingFileAppender::append(log4cplus::spi::InternalLoggingEvent const&) (fileappender.cxx:315)
==4743==    by 0x8083F72: log4cplus::Appender::doAppend(log4cplus::spi::InternalLoggingEvent const&) (appender.cxx:207)
==4743==    by 0x80826BD: log4cplus::helpers::AppenderAttachableImpl::appendLoopOnAppenders(log4cplus::spi::InternalLoggingEvent const&) const (appenderattachableimpl.cxx:159)