Attempting to remove a shape from a body that's resting against another body causes a NULL dereference attempt as the contacts are cleaned up: (this is against SVN revision 97)
Code:
b2AABB aabb;
aabb.lowerBound.Set(-100, -100);
aabb.upperBound.Set(100, 100);
b2World w(aabb, b2Vec2(0, -10), true);
b2BodyDef bodydef;
bodydef.type = b2BodyDef::e_dynamicBody;
bodydef.position.Set(0, 0);
b2Body * body = w.Create(&bodydef);
b2PolygonDef boxdef;
boxdef.SetAsBox(1, 1, b2Vec2(0, 0), 0);
boxdef.density = 1;
body->Create(&boxdef);
boxdef.SetAsBox(1, 1, b2Vec2(1, 0), 0);
b2Shape * shape = body->Create(&boxdef);
body->SetMassFromShapes();
bodydef.type = b2BodyDef::e_staticBody;
bodydef.position.Set(0, -10);
b2Body * ground = w.Create(&bodydef);
boxdef.SetAsBox(100, 1, b2Vec2(0, 0), 0);
boxdef.density = 0;
ground->Create(&boxdef);
ground->SetMassFromShapes();
for (int i = 0; i < 500; i ++) {
w.Step(0.3f, 100);
if (i == 20) // b2ContactManager.cpp:189 can't derefence a NULL body1
body->Destroy(shape); // boom
TCHAR szDebug[100];
_stprintf_s(szDebug, _T("%d %f %f\n"), i,
body->GetWorldCenter().x, body->GetWorldCenter().y);
OutputDebugString(szDebug);
}