This is reproducible every time for me. It makes me think I'm missing something about malloc...

I started getting the error when I implemented the + operator.

g++ --version
g++ (GCC) 4.1.1 20061011 (Red Hat 4.1.1-30)
Copyright (C) 2006 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.


main.cpp:

#include <iostream>
using namespace std ;

template <class T>
class MyStack
{
public:
MyStack(int = 10);
~MyStack() { delete [] stackPtr ; }
int push(const T&);
int pop(T&);
int isEmpty() const { return topnum == -1; }
int isFull() const { return topnum == size - 1; }
MyStack operator + (MyStack);
int getSize() { return size; }
private:
int size;
int topnum;
T* stackPtr;
};


template <class T>
MyStack<T> MyStack<T>::operator+ (MyStack<T> param)
{
MyStack<T> retval(size+param.getSize());
T t;
while(!isEmpty())
{
pop(t);
retval.push(t);
}
while(!param.isEmpty())
{
param.pop(t);
retval.push(t);
}
return (retval);
}

//constructor with default size 10
template <class T>
MyStack<T>::MyStack(int s)
{
size = s > 0 && s < 1000 ? s : 10;
topnum = -1;
stackPtr = new T[size] ;
}

template <class T>
int MyStack<T>::push(const T& item)
{
if (!isFull())
{
stackPtr[++topnum] = item ;
return 1;
}
return 0;
}

template <class T>
int MyStack<T>::pop(T& popValue)
{
if (!isEmpty())
{
popValue = stackPtr[topnum--];
return 1;
}
return 0;
}

int main(int argc, char **argv)
{
typedef MyStack<int> IntMyStack ;
IntMyStack is ;
int i = 10 ;
cout << "Pushing elements onto is" << endl ;
while (is.push(i))
{
cout << i << ' ' ;
i += 1 ;
}
cout << endl;
IntMyStack js;
i = 20;
cout << "Pushing elements onto js" << endl ;
while (js.push(i))
{
cout << i << ' ' ;
i += 1;
}
cout << endl;
IntMyStack ks(21);
ks = is + js;
cout << endl << "MyStack Full." << endl
<< endl << "Popping elements from ks" << endl ;
while (ks.pop(i))
cout << i << ' ' ;
cout << endl << "ks empty\n";

}


Output:
Pushing elements onto is
10 11 12 13 14 15 16 17 18 19
Pushing elements onto js
20 21 22 23 24 25 26 27 28 29

MyStack Full.

Popping elements from ks
20 21 22 23 24 25 26 27 28 29 10 11 12 13 14 15 16 17 18 19
ks empty
*** glibc detected *** ./a.out: double free or corruption (top): 0x08b320c0 ***
======= Backtrace: =========
/lib/libc.so.6[0xc18efd]
/lib/libc.so.6(cfree+0x90)[0xc1c550]
/usr/lib/libstdc++.so.6(_ZdlPv+0x21)[0x3a0d871]
/usr/lib/libstdc++.so.6(_ZdaPv+0x1d)[0x3a0d8cd]
./a.out[0x8048c58]
./a.out(__gxx_personality_v0+0x3df)[0x8048a8b]
/lib/libc.so.6(__libc_start_main+0xdc)[0xbc8f2c]
./a.out(__gxx_personality_v0+0x45)[0x80486f1]
======= Memory map: ========
00b77000-00b82000 r-xp 00000000 fd:00 6750406 /lib/libgcc_s-4.1.1-20061011.so.1
00b82000-00b83000 rwxp 0000a000 fd:00 6750406 /lib/libgcc_s-4.1.1-20061011.so.1
00b96000-00baf000 r-xp 00000000 fd:00 6751890 /lib/ld-2.5.so
00baf000-00bb0000 r-xp 00018000 fd:00 6751890 /lib/ld-2.5.so
00bb0000-00bb1000 rwxp 00019000 fd:00 6751890 /lib/ld-2.5.so
00bb3000-00cea000 r-xp 00000000 fd:00 6751891 /lib/libc-2.5.so
00cea000-00cec000 r-xp 00137000 fd:00 6751891 /lib/libc-2.5.so
00cec000-00ced000 rwxp 00139000 fd:00 6751891 /lib/libc-2.5.so
00ced000-00cf0000 rwxp 00ced000 00:00 0
00cf2000-00d17000 r-xp 00000000 fd:00 6751898 /lib/libm-2.5.so
00d17000-00d18000 r-xp 00024000 fd:00 6751898 /lib/libm-2.5.so
00d18000-00d19000 rwxp 00025000 fd:00 6751898 /lib/libm-2.5.so
00e0f000-00e10000 r-xp 00e0f000 00:00 0 [vdso]
03959000-03a3a000 r-xp 00000000 fd:00 4615137 /usr/lib/libstdc++.so.6.0.8
03a3a000-03a3e000 r-xp 000e0000 fd:00 4615137 /usr/lib/libstdc++.so.6.0.8
03a3e000-03a3f000 rwxp 000e4000 fd:00 4615137 /usr/lib/libstdc++.so.6.0.8
03a3f000-03a45000 rwxp 03a3f000 00:00 0
08048000-08049000 r-xp 00000000 fd:00 4096028 /home/coble/work/template/a.out
08049000-0804a000 rw-p 00001000 fd:00 4096028 /home/coble/work/template/a.out
08b32000-08b53000 rw-p 08b32000 00:00 0
b7e00000-b7e21000 rw-p b7e00000 00:00 0
b7e21000-b7f00000 ---p b7e21000 00:00 0
b7f15000-b7f19000 rw-p b7f15000 00:00 0
bfef1000-bff07000 rw-p bfef1000 00:00 0 [stack]
Abort

The problem seems to be your member function definition:
MyStack operator + (MyStack);
It should use a reference of MyStack as the argument as follows:
MyStack operator + (MyStack&);
Without the &, a copy of MyStack object is made and it contains a pointer to the private data member T* stackPtr. When the copy of the MyStack goes out of scope in the member function, the destructor of the MyStack object copy is called and the stackPtr is deleted. This also deletes the stackPtr of the original object because your class does not define a copy constructor to make a deep copy of the stackPtr. Then when your original object's destructor is called later, it does "delete [] stackPtr" again on an already deleted pointer. Thus the error appears.