Random crashes in detectSingleScale (Bug #2628)

When running a simple attached MWE, I frequently get crashes with this code. When I set parameter outputRejectLevels to false when calling detectMultiScale(), crashes do not occur.

In a more complicated program (which calls detectMultiScale multiple times), a crash always occurs. Below are exception and stack trace. I tried two different cascade.xml files, and it makes no difference. The more complicated program uses different images than the one attached.

---------------------------
Microsoft Visual C++ Debug Library
---------------------------
Debug Assertion Failed!

Program: D:\Repo\bugTester\Debug\bugTester.exe
File: f:\dd\vctools\crt_bld\self_64_amd64\crt\src\dbgdel.cpp
Line: 52

Expression: _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)

For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.

(Press Retry to debug the application)
---------------------------
Abort Retry Ignore
---------------------------

Call Stack:

msvcr100d.dll!operator delete(void * pUserData=0x0000000003005b50) Line 52 + 0x65 bytes C++

opencv_objdetect243d.dll!std::allocator<double>::deallocate(double * Ptr=0x0000000003005b50, unsigned __int64 __formal=19) Line 183 C++
opencv_objdetect243d.dll!std::vector<double,std::allocator<double> >::reserve(unsigned __int64 _Count=28) Line 768 C++
opencv_objdetect243d.dll!std::vector<double,std::allocator<double> >::_Reserve(unsigned __int64 _Count=1) Line 1298 C++
opencv_objdetect243d.dll!std::vector<double,std::allocator<double> >::push_back(const double & _Val=3.0000000000000000) Line 992 C++
opencv_objdetect243d.dll!cv::CascadeClassifierInvoker::operator()(const cv::Range & range={...}) Line 999 C++
opencv_core243d.dll!`anonymous namespace'::ParallelLoopBodyWrapper::operator()(const cv::Range & sr={...}) Line 143 C++
opencv_core243d.dll!`anonymous namespace'::ProxyLoopBody::operator()(const tbb::blocked_range<int> & range={...}) Line 163 C++
opencv_core243d.dll!tbb::interface6::internal::start_for<tbb::blocked_range<int>,`anonymous namespace'::ProxyLoopBody,tbb::auto_partitioner>::run_body(tbb::blocked_range<int> & r={...}) Line 110 + 0x39 bytes C++
opencv_core243d.dll!tbb::interface6::internal::partition_type_base<tbb::interface6::internal::auto_partition_type>::execute<tbb::interface6::internal::start_for<tbb::blocked_range<int>,`anonymous namespace'::ProxyLoopBody,tbb::auto_partitioner>,tbb::blocked_range<int> >(tbb::interface6::internal::start_for<tbb::blocked_range<int>,`anonymous namespace'::ProxyLoopBody,tbb::auto_partitioner> & start={...}, tbb::blocked_range<int> & range={...}) Line 248 C++
opencv_core243d.dll!tbb::interface6::internal::start_for<tbb::blocked_range<int>,`anonymous namespace'::ProxyLoopBody,tbb::auto_partitioner>::execute() Line 117 C++
tbb_debug.dll!tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task & parent={...}, tbb::task * child=0x0000000002bd8840) Line 440 + 0x10 bytes C++
tbb_debug.dll!tbb::internal::generic_scheduler::local_spawn_root_and_wait(tbb::task & first={...}, tbb::task * & next=0x0000000000000000) Line 621 + 0x35 bytes C++
tbb_debug.dll!tbb::internal::generic_scheduler::spawn_root_and_wait(tbb::task & first={...}, tbb::task * & next=0x0000000000000000) Line 630 C++
opencv_core243d.dll!tbb::task::spawn_root_and_wait(tbb::task & root={...}) Line 694 C++
opencv_core243d.dll!tbb::interface6::internal::start_for<tbb::blocked_range<int>,`anonymous namespace'::ProxyLoopBody,tbb::auto_partitioner>::run(const tbb::blocked_range<int> & range={...}, const `anonymous-namespace'::ProxyLoopBody & body={...}, const tbb::auto_partitioner & partitioner={...}) Line 94 + 0xd bytes C++
opencv_core243d.dll!tbb::parallel_for<tbb::blocked_range<int>,`anonymous namespace'::ProxyLoopBody>(const tbb::blocked_range<int> & range={...}, const `anonymous-namespace'::ProxyLoopBody & body={...}) Line 163 C++
opencv_core243d.dll!cv::parallel_for(const cv::Range & range={...}, const cv::ParallelLoopBody & body={...}, double nstripes=-1.0000000000000000) Line 282 C++
opencv_objdetect243d.dll!cv::CascadeClassifier::detectSingleScale(const cv::Mat & image={...}, int stripCount=62, cv::Size_<int> * processingRectSize=0x00000000009ff538, int stripSize=6, int yStep=1, double factor=2.1435888100000016, std::vector<cv::Rect_<int>,std::allocator<cv::Rect_<int> > > & candidates=[0](), std::vector<int,std::allocator<int> > & levels=[0](), std::vector<double,std::allocator<double> > & weights=[0](), bool outputRejectLevels=true) Line 1050 + 0xe9 bytes C++
opencv_objdetect243d.dll!cv::CascadeClassifier::detectMultiScale(const cv::Mat & image={...}, std::vector<cv::Rect_<int>,std::allocator<cv::Rect_<int> > > & objects=[0](), std::vector<int,std::allocator<int> > & rejectLevels=[0](), std::vector<double,std::allocator<double> > & levelWeights=[0](), double scaleFactor=1.1000000000000001, int minNeighbors=4, int flags=0, cv::Size_<int> * minObjectSize=0x00000000009ffae8, cv::Size_<int> * maxObjectSize=0x00000000009ffad8, bool outputRejectLevels=true) Line 1178 + 0xb6 bytes C++
bugTester.exe!main(int argc=4, char * * argv=0x0000000002944cb0) Line 25 C++
bugTester.exe!__tmainCRTStartup() Line 555 + 0x19 bytes C
bugTester.exe!mainCRTStartup() Line 371 C
kernel32.dll!0000000076c7652d()
[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]
ntdll.dll!0000000076f0c521()