Apache segfault when +MultiViews Option Directive set using <Location>

I tried setting up a tile server using mod_tile and ran into this issue in the process. It turns out that if in the Apache virtual host conf file you use a <Location> section for the Options +MultiViews directive:

<Location />
  Options +MultiViews
</Location>

...instead of a <Directory> section...

<Directory /var/www>
  Options +MultiViews
</Directory>

...you get a segfault when mod_tile attempts to serve the tile data. Renderd appears to have generated and rendered the tile correctly and wrote the metadata file to disk, and the Apache segfault appears somewhere between the file load and output to the client.

This is happening on the latest commit (774fc7a4470f655393ad6dd76c5c8bf3efe7923d), on an Ubuntu 14.04 box running Apache 2.4.7 and Mapnik v2.2.0.

Apache log when segfault happens (using <Location />):

[Fri Jan 16 11:27:55.051453 2015] [tile:debug] [pid 21410] ./src/mod_tile.c(1278): [client REDACTED:44475] tile_translate: uri(/osm_tiles/0/0/0.png)
[Fri Jan 16 11:27:55.051523 2015] [tile:debug] [pid 21410] ./src/mod_tile.c(1296): [client REDACTED:44475] tile_translate: testing baseuri(/osm_tiles/) name(default) extension(png)
[Fri Jan 16 11:27:55.051563 2015] [tile:debug] [pid 21410] ./src/mod_tile.c(1341): [client REDACTED:44475] tile_translate: request for default was 0 0 1
[Fri Jan 16 11:27:55.052017 2015] [tile:debug] [pid 21410] ./src/mod_tile.c(315): [client REDACTED:44475] get_storage_backend: Retrieving storage back end for tile layer 0 in pool 7fbbfdede028 and thread 140445397591936
[Fri Jan 16 11:27:55.052047 2015] [tile:debug] [pid 21410] ./src/mod_tile.c(328): [client REDACTED:44475] get_storage_backend: No storage backends for this lifecycle 7fbbfdede028, creating it in thread 140445397591936
[Fri Jan 16 11:27:55.052061 2015] [tile:debug] [pid 21410] ./src/mod_tile.c(344): [client REDACTED:44475] get_storage_backend: No storage backend in current lifecycle 7fbbfdede028 in thread 140445397591936 for current tile layer 0
[Fri Jan 16 11:27:55.052134 2015] [tile:debug] [pid 21410] ./src/mod_tile.c(1381): [client REDACTED:44475] tile_translate: op(tile_serve) xml(default) mime(image/png) z(0) x(0) y(0)
[Fri Jan 16 11:27:55.052145 2015] [tile:info] [pid 21410] [client REDACTED:44475] tile_storage_hook: handler(tile_serve), uri(/osm_tiles/0/0/0.png)
[Fri Jan 16 11:27:55.052229 2015] [tile:debug] [pid 21410] ./src/mod_tile.c(365): [client REDACTED:44475] tile_state: determined state of default 0 0 0 on store 7fbc00628790: Tile size: 8419, expired: 0 created: 1421366421
[Fri Jan 16 11:27:55.052322 2015] [authz_core:debug] [pid 21410] mod_authz_core.c(828): [client REDACTED:44475] AH01628: authorization result: granted (no directives)
[Fri Jan 16 11:27:56.010389 2015] [core:notice] [pid 21403] AH00051: child pid 21410 exit signal Segmentation fault (11), possible coredump in /etc/apache2

And when it doesn't (using <Directory /var/www>):

[Fri Jan 16 11:31:54.509126 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(1278): [client REDACTED:38693] tile_translate: uri(/osm_tiles/0/0/0.png)
[Fri Jan 16 11:31:54.509198 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(1296): [client REDACTED:38693] tile_translate: testing baseuri(/osm_tiles/) name(default) extension(png)
[Fri Jan 16 11:31:54.509238 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(1341): [client REDACTED:38693] tile_translate: request for default was 0 0 1
[Fri Jan 16 11:31:54.509251 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(315): [client REDACTED:38693] get_storage_backend: Retrieving storage back end for tile layer 0 in pool 7f2cabfa7028 and thread 139829842360192
[Fri Jan 16 11:31:54.509265 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(328): [client REDACTED:38693] get_storage_backend: No storage backends for this lifecycle 7f2cabfa7028, creating it in thread 139829842360192
[Fri Jan 16 11:31:54.509275 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(344): [client REDACTED:38693] get_storage_backend: No storage backend in current lifecycle 7f2cabfa7028 in thread 139829842360192 for current tile layer 0
[Fri Jan 16 11:31:54.509328 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(1381): [client REDACTED:38693] tile_translate: op(tile_serve) xml(default) mime(image/png) z(0) x(0) y(0)
[Fri Jan 16 11:31:54.509342 2015] [tile:info] [pid 21926] [client REDACTED:38693] tile_storage_hook: handler(tile_serve), uri(/osm_tiles/0/0/0.png)
[Fri Jan 16 11:31:54.509423 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(365): [client REDACTED:38693] tile_state: determined state of default 0 0 0 on store 7f2cad89c790: Tile size: 8419, expired: 0 created: 1421366421
[Fri Jan 16 11:31:54.509485 2015] [authz_core:debug] [pid 21926] mod_authz_core.c(828): [client REDACTED:38693] AH01628: authorization result: granted (no directives)
[Fri Jan 16 11:31:54.509613 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(1183): [client REDACTED:38693] tile_handler_serve: xml(default) z(0) x(0) y(0)
[Fri Jan 16 11:31:54.510318 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(1208): [client REDACTED:38693] Read tile of length 7887 from file:///var/lib/mod_tile/default/0/0/0/0/0/0.meta: 
[Fri Jan 16 11:31:54.510409 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(365): [client REDACTED:38693] tile_state: determined state of default 0 0 0 on store 7f2cad89c790: Tile size: 8419, expired: 0 created: 1421366421
[Fri Jan 16 11:31:54.510425 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(442): [client REDACTED:38693] expires(tile_serve), uri(/osm_tiles/0/0/0.png),, path_info((null))\n
[Fri Jan 16 11:31:54.510435 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(485): [client REDACTED:38693] caching heuristics: zoom level based 518400; last modified 0\n
[Fri Jan 16 11:31:54.510443 2015] [tile:debug] [pid 21926] ./src/mod_tile.c(491): [client REDACTED:38693] Setting tiles maxAge to 524810\n

Here's a gdb stack trace of the crash:

#0  strrchr () at ../sysdeps/x86_64/strrchr.S:32
#1  0x000055555558dee9 in ap_make_dirstr_parent (p=0x7ffff7e26028, s=0x0) at util.c:641
#2  0x00007ffff4687633 in parse_accept_headers (r=r@entry=0x7ffff7e260a0) at mod_negotiation.c:578
#3  0x00007ffff468b183 in handle_multi (r=0x7ffff7e260a0) at mod_negotiation.c:3096
#4  0x00005555555a1140 in ap_run_type_checker (r=0x7ffff7e260a0) at request.c:84
#5  0x00005555555a3986 in ap_process_request_internal (r=r@entry=0x7ffff7e260a0) at request.c:305
#6  0x00005555555c0158 in ap_process_async_request (r=0x7ffff7e260a0) at http_request.c:315
#7  0x00005555555c0444 in ap_process_request (r=r@entry=0x7ffff7e260a0) at http_request.c:363
#8  0x00005555555bcf02 in ap_process_http_sync_connection (c=0x7ffff7e36290) at http_core.c:190
#9  ap_process_http_connection (c=0x7ffff7e36290) at http_core.c:231
#10 0x00005555555b3cc0 in ap_run_process_connection (c=0x7ffff7e36290) at connection.c:41
#11 0x00005555555b40a8 in ap_process_connection (c=c@entry=0x7ffff7e36290, csd=<optimized out>) at connection.c:202
#12 0x00007ffff4891767 in child_main (child_num_arg=child_num_arg@entry=0) at prefork.c:704
#13 0x00007ffff489196c in make_child (s=0x7ffff7fc2de0, slot=slot@entry=0) at prefork.c:746
#14 0x00007ffff48926b1 in prefork_run (_pconf=<optimized out>, plog=0x7ffff7fbe028, s=0x7ffff7fc2de0) at prefork.c:956
#15 0x000055555559169e in ap_run_mpm (pconf=0x7ffff7ff0028, plog=0x7ffff7fbe028, s=0x7ffff7fc2de0) at mpm_common.c:96
#16 0x000055555558ae36 in main (argc=2, argv=0x7fffffffe5f8) at main.c:777

When I took out the <Location> block in the Apache vhost config, the segfault stopped, and the tile images are served properly.

Reproduce the crash by comparing the and <Directory /var/www> configurations, then start with src/mod_tile.c around tile_handler_serve and the Apache mod_negotiation stack trace. Done means serving the tile with Options +MultiViews in a block no longer causes an Apache segmentation fault.