sigh.

I helpfully decided it'd be good if the copy constructor for the
intValues case initialized shortValues to all 0s to aid in debugging.

This forgets, of course, that shortValues is a union with intValues,
and so what we're really doing is stomping on the pointers of the
vector we just allocated and populated. Oops.

include/attribute_store.h

@@ -329,8 +329,6 @@ struct AttributeSet {
 		if (useVector) {
 			new (&intValues) std::vector<uint32_t>;
 			intValues = a.intValues;
-			for (int i = 0; i < sizeof(shortValues)/sizeof(shortValues[0]); i++)
-				shortValues[i] = 0;
 		} else {
 			for (int i = 0; i < sizeof(shortValues)/sizeof(shortValues[0]); i++)
 				shortValues[i] = a.shortValues[i];