[Dovecot] v2.2.8 released / service(imap):child 6167 killed with signal 11

[Marcin Mirosław]

Another one coredump:
> # gdb -q /usr/libexec/dovecot/imap 'core-1385046907-8-11-!usr!libexec!dovecot!imap-22603'
> Reading symbols from /usr/libexec/dovecot/imap...Reading symbols from /usr/lib64/debug/usr/libexec/dovecot/imap.debug...done.
> done.
> [New LWP 22603]
> 
> warning: Could not load shared library symbols for linux-vdso.so.1.
> Do you need "set solib-search-path" or "set sysroot"?
> b[Thread debugging using libthread_db enabled]
> Using host libthread_db library "/lib64/libthread_db.so.1".
> tCore was generated by `dovecot/imap'.
> Program terminated with signal 11, Segmentation fault.
> #0  array_count_i (array=0x501010df786488e) at array.h:140
> 140             return array->buffer->used / array->element_size;
> (gdb) bt
> #0  array_count_i (array=0x501010df786488e) at array.h:140
> #1  array_get_modifiable_i (count_r=<synthetic pointer>, array=0x501010df786488e) at array.h:206
> #2  priorityq_remove_idx (pq=0x501010df7864886, idx=2660296736) at priorityq.c:121
> #3  0x00006e2b586ac78f in priorityq_remove (pq=<optimized out>, item=item at entry=0x7c69e989370) at priorityq.c:138
> #4  0x00006e2b5869b6bf in timeout_remove (_timeout=<optimized out>) at ioloop.c:189
> #5  0x00006e2b587455c7 in imapc_client_mailbox_close (_box=_box at entry=0x7c69e9728f8) at imapc-client.c:341
> #6  0x00006e2b58744837 in imapc_mailbox_close (box=0x7c69e972650) at imapc-storage.c:536
> #7  0x00006e2b587578d2 in mailbox_close (box=0x7c69e972650) at mail-storage.c:1184
> #8  0x00006e2b587579a7 in mailbox_free (_box=_box at entry=0x7a0f60c375d0) at mail-storage.c:1199
> #9  0x000007c69e5aecc5 in close_selected_mailbox (client=0x7c69e8f11b0) at cmd-select.c:387
> #10 close_selected_mailbox (client=0x7c69e8f11b0) at cmd-select.c:376
> #11 0x000007c69e5af3f4 in cmd_select_full (cmd=<optimized out>, readonly=<optimized out>) at cmd-select.c:431
> #12 0x000007c69e5b646c in command_exec (cmd=cmd at entry=0x7c69e8f19c0) at imap-commands.c:158
> #13 0x000007c69e5b4e20 in client_command_input (cmd=0x7c69e8f19c0) at imap-client.c:780
> #14 0x000007c69e5b4f22 in client_command_input (cmd=0x7c69e8f19c0) at imap-client.c:841
> #15 0x000007c69e5b52e5 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x7c69e8f11b0) at imap-client.c:879
> #16 client_handle_input (client=client at entry=0x7c69e8f11b0) at imap-client.c:891
> #17 0x000007c69e5b57ae in client_input (client=0x7c69e8f11b0) at imap-client.c:933
> #18 0x00006e2b5869be37 in io_loop_call_io (io=0x7c69e8e4630) at ioloop.c:388
> #19 0x00006e2b5869d2ef in io_loop_handler_run (ioloop=ioloop at entry=0x7c69e89e760) at ioloop-epoll.c:220
> #20 0x00006e2b5869b738 in io_loop_run (ioloop=0x7c69e89e760) at ioloop.c:412
> #21 0x00006e2b58631957 in master_service_run (service=0x7c69e89e5f0, callback=callback at entry=0x7c69e5c1f50 <client_connected>) at master-service.c:566
> #22 0x000007c69e5c2604 in main (argc=1, argv=0x7c69e89e3b0) at main.c:400