Index: trunk/psModules/src/imcombine/pmSubtraction.c
===================================================================
--- trunk/psModules/src/imcombine/pmSubtraction.c	(revision 19357)
+++ trunk/psModules/src/imcombine/pmSubtraction.c	(revision 19482)
@@ -1141,5 +1141,5 @@
                     psMutexLock(subMask);
                 }
-                psArrayAdd(args, 1, (psImage*)subMask); // Casting away const
+                psArrayAdd(args, 1, subMask);
                 if (subMask) {
                     psMutexUnlock(subMask);
@@ -1166,11 +1166,22 @@
     }
 
-    if (!psThreadPoolWait(true)) {
+    if (!psThreadPoolWait(false)) {
         psError(PS_ERR_UNKNOWN, false, "Error waiting for threads.");
         return false;
     }
 
-    if (subMask && threaded) {
-        psMutexDestroy(subMask);
+    // We don't rely on psThreadPoolWait to harvest the jobs because the job contains a reference to the
+    // subMask, which is being changed on a thread, and psThreadPoolWait doesn't know that it needs to be
+    // locked before freeing.  After psThreadPoolWait, however, the jobs are completed, the threads are idle,
+    // and so there's no need to lock the subMask when we're blowing away the jobs.
+    if (threaded) {
+        psThreadJob *job;               // Completed job
+        while ((job = psThreadJobGetDone())) {
+            psFree(job);
+        }
+
+        if (subMask) {
+            psMutexDestroy(subMask);
+        }
     }