Eval bug: Crash at second prompt

[eiffel31]

Name and Version

version: 6975 (16bcc12)
built with cc (Ubuntu 11.4.0-1ubuntu1~22.04.2) 11.4.0 for x86_64-linux-gnu

Operating systems

Linux

GGML backends

CUDA, CPU, Vulkan

Hardware

AMD Ryzen 7 6800H
GeForce RTX 3070 Mobile

Models

No response

Problem description & steps to reproduce

https://huggingface.co/bartowski/nvidia_NVIDIA-Nemotron-Nano-9B-v2-GGUF/resolve/main/nvidia_NVIDIA-Nemotron-Nano-9B-v2-Q5_K_M.gguf

llama-cli -m nvidia_NVIDIA-Nemotron-Nano-9B-v2-Q5_K_M.gguf --jinja

The first prompt is fine. The second prompt generates a crash.
The same behaviour with CUDA, Vulkan, CPU

First Bad Commit

No response

Relevant log output

== Running in interactive mode. ==
 - Press Ctrl+C to interject at any time.
 - Press Return to return control to the AI.
 - To return control without starting a new line, end your input with '/'.
 - If you want to submit another line, end your input with '\'.
 - Not using system message. To change it, set a different value via -sys PROMPT


> go
Okay, the user just said "go". That's pretty vague. I need to figure out what they want me to do. Maybe they want me to start a conversation, but I should ask for clarification.

I should respond by asking them to specify what they need help with. That way, I can provide a more accurate and helpful response. Let me make sure my reply is friendly and open-ended to encourage them to give more details.
</think>

Sure! Could you clarify what you'd like me to do or help with? 

> go again
[New LWP 146064]
[New LWP 146063]
[New LWP 146062]
[New LWP 146061]
[New LWP 146060]

This GDB supports auto-downloading debuginfo from the following URLs:
  <https://debuginfod.ubuntu.com>
Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
Debuginfod has been disabled.
To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/liblber.so.2
warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/libbrotlidec.so.1
warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/libbrotlicommon.so.1
warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/libcap.so.2
warning: could not find '.gnu_debugaltlink' file for /usr/lib/x86_64-linux-gnu/libvulkan_intel_hasvk.so
warning: could not find '.gnu_debugaltlink' file for /usr/lib/x86_64-linux-gnu/libvulkan_intel.so
warning: could not find '.gnu_debugaltlink' file for /usr/lib/x86_64-linux-gnu/libvulkan_gfxstream.so
warning: could not find '.gnu_debugaltlink' file for /usr/lib/x86_64-linux-gnu/libvulkan_lvp.so
warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/libtinfo.so.6
warning: could not find '.gnu_debugaltlink' file for /usr/lib/x86_64-linux-gnu/libvulkan_nouveau.so
warning: could not find '.gnu_debugaltlink' file for /usr/lib/x86_64-linux-gnu/libvulkan_radeon.so
warning: could not find '.gnu_debugaltlink' file for /usr/lib/x86_64-linux-gnu/libvulkan_virtio.so
warning: could not find '.gnu_debugaltlink' file for /lib/x86_64-linux-gnu/libVkLayer_MESA_device_select.so
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
0x000077d214f10813 in __GI___wait4 (pid=146103, stat_loc=0x0, options=0, usage=0x0) at ../sysdeps/unix/sysv/linux/wait4.c:30
warning: 30     ../sysdeps/unix/sysv/linux/wait4.c: Aucun fichier ou dossier de ce nom
#0  0x000077d214f10813 in __GI___wait4 (pid=146103, stat_loc=0x0, options=0, usage=0x0) at ../sysdeps/unix/sysv/linux/wait4.c:30
30      in ../sysdeps/unix/sysv/linux/wait4.c
#1  0x000077d21586086b in ggml_print_backtrace () from /tmp/build/bin/libggml-base.so
#2  0x000077d21587356f in ggml_uncaught_exception() () from /tmp/build/bin/libggml-base.so
#3  0x000077d2152bb0da in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#4  0x000077d2152a5a55 in std::terminate() () from /lib/x86_64-linux-gnu/libstdc++.so.6
#5  0x000077d2152bb391 in __cxa_throw () from /lib/x86_64-linux-gnu/libstdc++.so.6
#6  0x000077d2152a94a0 in std::__throw_out_of_range_fmt(char const*, ...) () from /lib/x86_64-linux-gnu/libstdc++.so.6
#7  0x00006266dee284fc in common_chat_format_single[abi:cxx11](common_chat_templates const*, std::vector<common_chat_msg, std::allocator<common_chat_msg> > const&, common_chat_msg const&, bool, bool) ()
#8  0x00006266ded91755 in main::{lambda(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)#2}::operator()(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const ()
#9  0x00006266ded8e141 in main ()
[Inferior 1 (process 146053) detached]
terminate called after throwing an instance of 'std::out_of_range'
  what():  basic_string::substr: __pos (which is 564) > this->size() (which is 193)
Abandon (core dumped)

[CISC]

This happens with chat templates that rewrite history (remove thinking).

[whitespace-rebel]

Confirmed, this also happens with Qwen3-30B-A3B-Q4_K_M.gguf (only in thinking mode) on Debian 13.
It is a regression, it worked fine some weeks ago.