Double free(?) when returning owned self

[dotdash]

trait M {
  fn m(self) -> Self;
}

impl M for ~int {
  fn m(self) -> ~int {
    self
  }
}

fn main() {
  (~1).m();
}

This crashes in free().

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff7f85700 (LWP 10508)]
__GI___libc_free (mem=0xffffffffffffffff) at malloc.c:2892
2892    malloc.c: No such file or directory.
(gdb) bt
#0  __GI___libc_free (mem=0xffffffffffffffff) at malloc.c:2892
#1  0x00007ffff7a5b859 in libc::funcs::c95::stdlib::free::_e26c3f5a54e72c6::_07pre () from /home/bs/src/rust/../../rust/lib/rustc/x86_64-unknown-linux-gnu/lib/libcore-c3ca5d77d81b46c1-0.7-pre.so
#2  0x0000000000404f38 in ?? ()
#3  0x00007ffff7ae8bdc in __morestack () from /home/bs/src/rust/../../rust/lib/rustc/x86_64-unknown-linux-gnu/lib/libcore-c3ca5d77d81b46c1-0.7-pre.so
#4  0x0000000000000000 in ?? ()

[dotdash]

This is actually not related to the return value, but just passing self by value. The code ends up passing the stack address to glue_drop.

    .type   _ZN14__extensions__9meth_28651m17_7e6e9d6cd229cfd23_00E,@function
_ZN14__extensions__9meth_28651m17_7e6e9d6cd229cfd23_00E:
    .cfi_startproc
    cmpq    %fs:112, %rsp
    ja  .LBB0_0
    movabsq $40, %r10
    movabsq $0, %r11
    callq   __morestack
    ret
.LBB0_0:
    pushq   %rbp
.Ltmp2:
    .cfi_def_cfa_offset 16
.Ltmp3:
    .cfi_offset %rbp, -16
    movq    %rsp, %rbp
.Ltmp4:
    .cfi_def_cfa_register %rbp
    subq    $32, %rsp
    movq    %rdi, -16(%rbp)
    jmp .LBB0_2
.LBB0_1:
    addq    $32, %rsp
    popq    %rbp
    ret
.LBB0_2:
    movq    -16(%rbp), %rax
    movq    %rax, -24(%rbp)
    movabsq $0, %rax
    movq    %rax, %rdi
    movq    %rax, %rsi
    movq    -24(%rbp), %rdx
    callq   _ZN9_ubox_u3217_d8e692bd4656d07e14glue_drop_2877E
    jmp .LBB0_1
.Ltmp5:
    .size   _ZN14__extensions__9meth_28651m17_7e6e9d6cd229cfd23_00E, .Ltmp5-_ZN14__extensions__9meth_28651m17_7e6e9d6cd229cfd23_00E