[Dovecot] Panic when using QRESYNC

[Michael M. Slusarz]

Been seeing these occasionally for the last few weeks.  Only way to  
fix is to remove cache files in the affected mailbox.  Reproduced with  
both 1.2.5 and 1.2.6.

IMAP transaction:
-----------------

* PREAUTH [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID  
ENABLE SORT THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT IDLE  
CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC  
ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH] Logged in as slusarz
1 enable qresync
* ENABLED QRESYNC
1 OK Enabled.
2 EXAMINE "INBOX" (QRESYNC (1254166848 789  
1,2,6,7,109,113,193,230,231,279,284))

Log output:
-----------
Oct  9 12:49:30 bigworm EXT(slusarz): :  
/home/slusarz/Maildir/dovecot.index.log: Transaction log changed  
unexpectedly, can't get modseq
Oct  9 12:49:30 bigworm EXT(slusarz): : Panic: file imap-fetch.c: line  
227 (get_expunges_fallback): assertion failed: (mail->uid > next_uid)
Oct  9 12:49:30 bigworm EXT(slusarz): : Raw backtrace:  
/usr/lib/dovecot/imap [0x4a199b] ->  
/usr/lib/dovecot/imap(i_syslog_fatal_handler+0x2b) [0x4a1a5b] ->  
/usr/lib/dovecot/imap [0x4a10f6] ->  
/usr/lib/dovecot/imap(imap_fetch_begin+0x6bb) [0x42415b] ->  
/usr/lib/dovecot/imap(cmd_select_full+0x54a) [0x41e5ba] ->  
/usr/lib/dovecot/imap [0x420b4d] -> /usr/lib/dovecot/imap [0x420c2d]  
-> /usr/lib/dovecot/imap(client_handle_input+0x135) [0x420e55] ->  
/usr/lib/dovecot/imap(client_input+0x5c) [0x42192c] ->  
/usr/lib/dovecot/imap(io_loop_handler_run+0xbd) [0x4a988d] ->  
/usr/lib/dovecot/imap(io_loop_run+0x18) [0x4a8d08] ->  
/usr/lib/dovecot/imap(main+0x531) [0x429441] ->  
/lib/libc.so.6(__libc_start_main+0xfd) [0x7ffff76a09ed] ->  
/usr/lib/dovecot/imap [0x4199f9]
Oct  9 12:49:30 bigworm dovecot: dovecot: child 9556 (imap) killed  
with signal 6 (core dumps disabled)

GDB output:
-----------
Program received signal SIGABRT, Aborted.
0x00007ffff76b3f15 in raise () from /lib/libc.so.6
(gdb) bt full
#0  0x00007ffff76b3f15 in raise () from /lib/libc.so.6
No symbol table info available.
#1  0x00007ffff76b5340 in abort () from /lib/libc.so.6
No symbol table info available.
#2  0x00000000004a19ad in ?? ()
No symbol table info available.
#3  0x00000000004a1a5b in i_syslog_fatal_handler ()
No symbol table info available.
#4  0x00000000004a10f6 in i_panic ()
No symbol table info available.
#5  0x000000000042415b in imap_fetch_begin ()
No symbol table info available.
#6  0x000000000041e5ba in cmd_select_full ()
No symbol table info available.
#7  0x0000000000420b4d in ?? ()
No symbol table info available.
#8  0x0000000000420c2d in ?? ()
No symbol table info available.
#9  0x0000000000420e55 in client_handle_input ()
No symbol table info available.
#10 0x000000000042192c in client_input ()
No symbol table info available.
#11 0x00000000004a988d in io_loop_handler_run ()
No symbol table info available.
#12 0x00000000004a8d08 in io_loop_run ()
No symbol table info available.
#13 0x0000000000429441 in main ()
No symbol table info available.