[Dovecot] panic with 2.2.10 and GETMETADATA

[Michael Cramer]

i have in my configs the following lines:

10-mail.conf:mail_attribute_dict =  
file:/srv/vmail/dovecot/metadata/%d/%n/attributes
20-imap.conf:imap_metadata = yes

when i test GETMETADATA with telnet i got a pannic in my error.log  
file and no attributes file in the given location is created

root at i920:/etc/dovecot/conf.d# telnet localhost imap
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE  
IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready.
01 LOGIN tester at domain.com *********
01 OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE  
IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS  
THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIA
L CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED  
I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN  
CONTEXT=SEARCH LIST-STATUS SPECIAL-USE BINARY
MOVE SEARCH=FUZZY NOTIFY METADATA COMPRESS=DEFLATE QUOTA ACL  
RIGHTS=texk] Logged in
02 GETMETADATA "*" (/shared/test)
Connection closed by foreign host.


in error.log i have these lines:
Dec 23 17:20:00 imap(tester at domain.com): Panic: file imap-client.c:  
line 634 (client_command_free): assertion failed:  
(client->output_cmd_lock == NULL)
Dec 23 17:20:00 imap(tester at domain.com): Error: Raw backtrace:  
/usr/lib/dovecot/libdovecot.so.0(+0x5e900) [0x7fb053bea900] ->  
/usr/lib/dovecot/libdovecot.so.0(+0x5e9de) [0x7fb053bea9de] ->  
/usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fb053ba5bfe] ->  
dovecot/imap() [0x415c17] -> dovecot/imap() [0x415d8a] ->  
dovecot/imap() [0x415e15] -> dovecot/imap(client_handle_input+0x115)  
[0x416115] -> dovecot/imap(client_input+0x72) [0x4164a2] ->  
/usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x27)  
[0x7fb053bfa8f7] ->  
/usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0xd7)  
[0x7fb053bfb687] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38)  
[0x7fb053bfa498] ->  
/usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13)  
[0x7fb053baadf3] -> dovecot/imap(main+0x2af) [0x40b06f] ->  
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)  
[0x7fb0537e5de5] -> dovecot/imap() [0x40b1cc]


gdb with bt full gives:
#0  0x00007f174b6bdf77 in raise () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#1  0x00007f174b6c15e8 in abort () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#2  0x00007f174baad8f6 in default_fatal_finish (type=<optimized out>,  
status=status at entry=0) at failures.c:193
         backtrace = 0x1801040  
"/usr/lib/dovecot/libdovecot.so.0(+0x5e900) [0x7f174baad900] ->  
/usr/lib/dovecot/libdovecot.so.0(+0x5e9de) [0x7f174baad9de] ->  
/usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f174ba68bfe] ->  
dovecot/im"...
#3  0x00007f174baad9de in i_internal_fatal_handler  
(ctx=0x7fffe2002eb0, format=<optimized out>, args=<optimized out>) at  
failures.c:657
         status = 0
#4  0x00007f174ba68bfe in i_panic (format=format at entry=0x423040 "file  
%s: line %d (%s): assertion failed: (%s)") at failures.c:267
         ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0}
         args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area =  
0x7fffe2002fa0, reg_save_area = 0x7fffe2002ee0}}
#5  0x0000000000415c17 in client_command_free  
(_cmd=_cmd at entry=0x7fffe2002fc8) at imap-client.c:634
         cmd = 0x183a2d0
         client = 0x18396f0
         state = CLIENT_COMMAND_STATE_WAIT_INPUT
         __FUNCTION__ = "client_command_free"
#6  0x0000000000415d8a in client_command_input (cmd=0x0) at imap-client.c:783
         client = 0x18396f0
         command = <optimized out>
         __FUNCTION__ = "client_command_input"
#7  0x0000000000415e15 in client_command_input (cmd=0x183a2d0) at  
imap-client.c:841
         client = 0x18396f0
         command = <optimized out>
         __FUNCTION__ = "client_command_input"
#8  0x0000000000416115 in client_handle_next_command  
(remove_io_r=<synthetischer Zeiger>, client=0x18396f0) at  
imap-client.c:879
No locals.
#9  client_handle_input (client=client at entry=0x18396f0) at imap-client.c:891
         _data_stack_cur_id = 3
         remove_io = false
         handled_commands = false
         __FUNCTION__ = "client_handle_input"
#10 0x00000000004164a2 in client_input (client=0x18396f0) at imap-client.c:933
         cmd = 0x181db70
         output = 0x183a120
         bytes = 35
         __FUNCTION__ = "client_input"
#11 0x00007f174babd8f7 in io_loop_call_io (io=0x183a1f0) at ioloop.c:388
         ioloop = 0x1808730
         t_id = 2
#12 0x00007f174babe687 in io_loop_handler_run  
(ioloop=ioloop at entry=0x1808730) at ioloop-epoll.c:220
         ctx = 0x18093c0
         list = 0x180adf0
         io = <optimized out>
         tv = {tv_sec = 1799, tv_usec = 999100}
         events_count = <optimized out>
         msecs = <optimized out>
         ret = 1
         i = 0
         call = <optimized out>
         __FUNCTION__ = "io_loop_handler_run"
#13 0x00007f174babd498 in io_loop_run (ioloop=0x1808730) at ioloop.c:412
         __FUNCTION__ = "io_loop_run"
#14 0x00007f174ba6ddf3 in master_service_run (service=0x18085c0,  
callback=callback at entry=0x41eea0 <client_connected>) at  
master-service.c:566
No locals.
#15 0x000000000040b06f in main (argc=1, argv=0x1808390) at main.c:400
         set_roots = {0x426d00 <imap_setting_parser_info>, 0x0}
         login_set = {auth_socket_path = 0x1800048 "\001",  
postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback =  
0x41f250 <login_client_connected>,
           failure_callback = 0x41ef80 <login_client_failed>,  
request_auth_token = 1}
         service_flags = <optimized out>
         storage_service_flags = <optimized out>
         username = 0x0
         c = <optimized out>