Cannot insert breakpoint, cannot access memory

Sometimes, I do something that puts rr into a state where any attempt to step forward results in this:

Warning:
Cannot insert breakpoint -12.
Cannot access memory at address 0x7f74079ca0b0

I'm not exactly sure what I'm doing, but I have a trace where the bug can be consistently reproduced, and I've uploaded it here: https://tbodt.com/shits/rr-repro.tar.gz. Here's a log of me reproducing the bug using that trace:

Reading symbols from /home/tbodt/ish/build/ish-44/mmap_pack_7_ish...done.
Remote debugging using 127.0.0.1:21677
Reading symbols from /lib64/ld-linux-x86-64.so.2...(no debugging symbols found)...done.
0x00007f740ccfd000 in _start () from /lib64/ld-linux-x86-64.so.2
=> 0x00007f740ccfd000 <_start+0>:	48 89 e7	mov    %rsp,%rdi
(rr) c
Continuing.
[New Thread 19923.19925]
[New Thread 19923.19924]

Thread 1 received signal SIGSEGV, Segmentation fault.
0x00007f740ccb425f in raise () from /usr/lib/libpthread.so.0
=> 0x00007f740ccb425f <raise+271>:	48 8b 8c 24 08 01 00 00	mov    0x108(%rsp),%rcx
(rr) b sys_brk
Breakpoint 1 at 0x5577933877e6: file ../kernel/mmap.c, line 94.
(rr) rc
Continuing.

Thread 1 received signal SIGSEGV, Segmentation fault.
0x00007f740ccb425f in raise () from /usr/lib/libpthread.so.0
=> 0x00007f740ccb425f <raise+271>:	48 8b 8c 24 08 01 00 00	mov    0x108(%rsp),%rcx
(rr) rc
Continuing.

Thread 1 hit Breakpoint 1, sys_brk (new_brk=1448902656) at ../kernel/mmap.c:94
94	    if (new_brk != 0) {
(rr) rc
Continuing.
[New Thread 19923.19925]
[Switching to Thread 19923.19925]

Thread 4 hit Breakpoint 1, sys_brk (new_brk=1448833024) at ../kernel/mmap.c:94
94	    if (new_brk != 0) {
(rr) n
Warning:
Cannot insert breakpoint -12.
Cannot access memory at address 0x7f74079ca0b0

Command aborted.

Download the rr-repro.tar.gz trace and reproduce the failure using the command sequence in the issue, including the sys_brk breakpoint and next command. Start by inspecting rr's breakpoint insertion and memory-access handling around this replay state. Done means stepping forward no longer aborts with the breakpoint -12 and inaccessible-memory warning.