Created attachment 82425 [details]
Core dump

Fixed in 206.

This is still happening for me in systemd 206 (using a Mageia Cauldron package)

# gdb /bin/systemd /core.2139
GNU gdb (GDB) 7.6-5.mga4 (Mageia release 4)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-mageia-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/lib/systemd/systemd...Reading symbols from /usr/lib/debug/usr/lib/systemd/systemd.debug...done.
done.
[New LWP 2139]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/bin/systemd vga=788'.
Program terminated with signal 6, Aborted.
#0  0x00007f50437c7f4b in raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:38
38                               sig);   
Missing separate debuginfos, use: debuginfo-install lib64audit1-2.2.3-2.mga4.x86_64 lib64dbus1_3-1.6.12-1.mga4.x86_64 lib64kmod2-14-2.mga4.x86_64 li
b64lzma5-5.1.2-0.alpha.3.mga3.x86_64 lib64pam0-1.1.6-6.mga4.x86_64 lib64wrap0-7.6-43.mga3.x86_64 lib64zlib1-1.2.7-7.mga3.x86_64
(gdb) bt
#0  0x00007f50437c7f4b in raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:38
#1  0x000000000040bce3 in crash (sig=6) at src/core/main.c:144
#2  <signal handler called>
#3  0x00007f504343ba65 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56#4  0x00007f504343d0c8 in __GI_abort () at abort.c:90
#5  0x0000000000461eb3 in log_assert (text=text@entry=0x48839d "path", file=file@entry=0x4ba871 "src/shared/cgroup-util.c", line=line@entry=866,
    func=func@entry=0x4babc0 <__PRETTY_FUNCTION__.7883> "cg_is_empty_recursive",
    format=format@entry=0x4bbe58 "Assertion '%s' failed at %s:%u, function %s(). Aborting.") at src/shared/log.c:699
#6  0x0000000000462670 in log_assert_failed (text=text@entry=0x48839d "path", file=file@entry=0x4ba871 "src/shared/cgroup-util.c",
    line=line@entry=866, func=func@entry=0x4babc0 <__PRETTY_FUNCTION__.7883> "cg_is_empty_recursive") at src/shared/log.c:704
#7  0x0000000000459761 in cg_is_empty_recursive (controller=controller@entry=0x4b3320 "name=systemd", path=0x0, ignore_self=ignore_self@entry=true)
    at src/shared/cgroup-util.c:866
#8  0x000000000044c290 in manager_notify_cgroup_empty (m=m@entry=0xe8bca0, cgroup=<optimized out>) at src/core/cgroup.c:736
#9  0x000000000043d5ad in private_bus_message_filter (connection=0xed4da0, message=0xeab640, data=0xe8bca0) at src/core/dbus.c:491
#10 0x00007f5043becd5e in dbus_connection_dispatch () from /lib64/libdbus-1.so.3
#11 0x000000000043ed79 in bus_dispatch (m=m@entry=0xe8bca0) at src/core/dbus.c:525
#12 0x0000000000411b42 in manager_loop (m=0xe8bca0) at src/core/manager.c:1816
#13 0x0000000000409974 in main (argc=2, argv=0x7fff2e19cec8) at src/core/main.c:1706
(gdb) frame 8
#8  0x000000000044c290 in manager_notify_cgroup_empty (m=m@entry=0xe8bca0, cgroup=<optimized out>) at src/core/cgroup.c:736
736                     r = cg_is_empty_recursive(SYSTEMD_CGROUP_CONTROLLER, u->cgroup_path, true);
(gdb) p *u
$1 = {manager = 0xe8bca0, type = UNIT_TARGET, load_state = UNIT_LOADED, merged_into = 0x0, id = 0x1287fa0 "shutdown.target", instance = 0x0,
  names = 0x7f5044e2bc00, dependencies = {0x0, 0x0, 0x0, 0x0, 0xf39330, 0x0, 0x0, 0xfacf50, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f5044e34000,
    0x7f5044e33be0, 0xf051f0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f5044e51e80, 0xfe2950}, requires_mounts_for = 0x0, description = 0xe9c360 "Shutdown",
  documentation = 0x12a2a30, fragment_path = 0x12a7590 "/usr/lib/systemd/system/shutdown.target", source_path = 0x0, dropin_paths = 0x0,
  fragment_mtime = 1374924811000000, source_mtime = 0, dropin_mtime = 0, job = 0x0, nop_job = 0x0, job_timeout = 0, refs = 0x0, conditions = 0x0,
  condition_timestamp = {realtime = 0, monotonic = 0}, inactive_exit_timestamp = {realtime = 0, monotonic = 0}, active_enter_timestamp = {
    realtime = 0, monotonic = 0}, active_exit_timestamp = {realtime = 0, monotonic = 0}, inactive_enter_timestamp = {realtime = 0, monotonic = 0},
  cgroup_path = 0x0, cgroup_realized = false, cgroup_mask = (unknown: 0), slice = {unit = 0x0, refs_next = 0x0, refs_prev = 0x0},
  units_by_type_next = 0x1285750, units_by_type_prev = 0xeca4b0, has_requires_mounts_for_next = 0x0, has_requires_mounts_for_prev = 0x0,
  load_queue_next = 0x0, load_queue_prev = 0x0, dbus_queue_next = 0x0, dbus_queue_prev = 0x0, cleanup_queue_next = 0x0, cleanup_queue_prev = 0x0,
  gc_queue_next = 0x0, gc_queue_prev = 0x0, cgroup_queue_next = 0x0, cgroup_queue_prev = 0x0, gc_marker = 107622, deserialized_job = -1,
  load_error = 0, unit_file_state = _UNIT_FILE_STATE_INVALID, stop_when_unneeded = false, default_dependencies = false,
  refuse_manual_start = true, refuse_manual_stop = false, allow_isolate = false, on_failure_isolate = false, ignore_on_isolate = false,
  ignore_on_snapshot = false, condition_result = false, transient = false, in_load_queue = false, in_dbus_queue = false, in_cleanup_queue = false,
  in_gc_queue = false, in_cgroup_queue = false, sent_dbus_new_signal = true, no_gc = false, in_audit = false}

Fixed by Harald in http://cgit.freedesktop.org/systemd/systemd/commit/?id=b58b8e1 (well, as far as it's possible, I'm rather confident that it's that issue, but with memory corruption one can't be really ever sure).