[Dovecot] sig11 in 1.1rc5 fts

[Adam McDougall]

This happened from one user near noon on the 17th and 19th (today) of 
this month.  From the backtrace it looks like they were searching, but I 
won't know for sure unless I need to ask them.  Is this possibly fixed 
already?  I just haven't upgraded dovecot in a while due to lack of 
problems.  The sig11 happened a few dozen times, a few seconds apart 
each day.  I have one coredump from each day, and the size was the 
same.  This is a trace from only one.  The other backtrace looks pretty 
much the same.

Version: 1.1rc5
OS: FreeBSD 7.0-STABLE


#0  0x000000004101bf11 in node_read_children (trie=0x40c5a800, 
node=0x40c5a800, level=1) at squat-trie.c:461
        data = (const uint8_t *) 0x416b7f9a 
";\031\030\023\031\0305\031\030O\031\030\033\031\0309\031\030#\031\030"
        end = (const uint8_t *) 0x416b7ffe ""
        child_chars = (const unsigned char *) 0x414dbd25 <Address 
0x414dbd25 out of bounds>
        child = (struct squat_node *) 0x40c685f8
        children = (struct squat_node *) 0x40c68040
        node_offset = 1944868
        i = 61
        child_idx = 61
        child_count = 89
        base_offset = 1944314
        num = 25
        __PRETTY_FUNCTION__ = "node_read_children"
#1  0x000000004101f17f in squat_trie_map (trie=0x40c5a800, 
building=false) at squat-trie.c:1518
        file_lock = (struct file_lock *) 0x0
        dotlock = (struct dotlock *) 0x0
        changed = true
        ret = 0
#2  0x000000004101b4c9 in squat_trie_open (trie=0x40c5a800) at 
squat-trie.c:242
No locals.
#3  0x000000004101f908 in squat_trie_get_last_uid (trie=0x40c5a800, 
last_uid_r=0x7fffffffce5c) at squat-trie.c:1725
No locals.
#4  0x000000004101a79c in fts_backend_squat_get_last_uid 
(_backend=0x40c2b150, last_uid_r=0x7fffffffce5c) at fts-backend-squat.c:104
        backend = (struct squat_fts_backend *) 0x40c2b150
#5  0x0000000040e0f822 in fts_backend_get_last_uid (backend=0x40c2b150, 
last_uid_r=0x7fffffffce5c) at fts-api.c:80
No locals.
#6  0x0000000040e10bb1 in fts_build_init (fctx=0x40cee0f0) at 
fts-storage.c:177
        t = (struct mailbox_transaction_context *) 0x40c2b1e0
        backend = (struct fts_backend *) 0x40c2b150
        ctx = (struct fts_storage_build_context *) 0x40c2b150
        build = (struct fts_backend_build_context *) 0x40c7e120
        seqset = {seq1 = 16, seq2 = 1, next = 0x0}
        last_uid = 0
        last_uid_locked = 131072
        __PRETTY_FUNCTION__ = "fts_build_init"
#7  0x0000000040e11351 in fts_try_build_init (fctx=0x40cee0f0) at 
fts-storage.c:320
No locals.
#8  0x0000000040e114a6 in fts_mailbox_search_init (t=0x40c2b1e0, 
charset=0x4ceca0 "UTF-8", args=0x40c7e0c0, sort_program=0x0)
    at fts-storage.c:355
        fbox = (struct fts_mailbox *) 0x40cdc040
        ctx = (struct mail_search_context *) 0x40c28bc0
        fctx = (struct fts_search_context *) 0x40cee0f0
#9  0x00000000004714e1 in mailbox_search_init (t=0x40c2b1e0, 
charset=0x4ceca0 "UTF-8", args=0x40c7e0c0, sort_program=0x0)
    at mail-storage.c:621
No locals.
#10 0x0000000000419f9c in imap_search_init (cmd=0x40c7e048, 
box=0x40c67048, charset=0x4ceca0 "UTF-8", sargs=0x40c7e0c0)
    at cmd-search.c:36
        ctx = (struct imap_search_context *) 0x40c7e190
#11 0x000000000041a644 in cmd_search (cmd=0x40c7e048) at cmd-search.c:190
        ctx = (struct imap_search_context *) 0x40c1e240
        sargs = (struct mail_search_arg *) 0x40c7e0c0
        args = (const struct imap_arg *) 0x40c84080
        args_count = 4
        error = 0x0
        charset = 0x4ceca0 "UTF-8"
#12 0x000000000041bd12 in cmd_uid (cmd=0x40c7e048) at cmd-uid.c:26
        command = (struct command *) 0x40c1e2a0
        cmd_name = 0x40c84170 "SEARCH"
#13 0x000000000041d3a4 in client_command_input (cmd=0x40c7e048) at 
client.c:553
        client = (struct client *) 0x40c36180
        command = (struct command *) 0x2340c7e0b8
        __PRETTY_FUNCTION__ = "client_command_input"
#14 0x000000000041d5e1 in client_command_input (cmd=0x40c7e048) at 
client.c:602
        client = (struct client *) 0x40c36180
        command = (struct command *) 0x40c1e240
        __PRETTY_FUNCTION__ = "client_command_input"
#15 0x000000000041d723 in client_handle_next_command (client=0x40c36180, 
remove_io_r=0x7fffffffd0fd) at client.c:643
        size = 40
#16 0x000000000041d769 in client_handle_input (client=0x40c36180) at 
client.c:653
---Type <return> to continue, or q <return> to quit---
        _data_stack_cur_id = 3
        ret = false
        remove_io = false
        handled_commands = false
#17 0x000000000041d904 in client_input (client=0x40c36180) at client.c:698
        cmd = (struct client_command_context *) 0xffffd16c
        output = (struct ostream *) 0x40c7a0a8
        bytes = 40
        __PRETTY_FUNCTION__ = "client_input"
#18 0x00000000004be449 in io_loop_handler_run (ioloop=0x40c19140) at 
ioloop-kqueue.c:149
        ctx = (struct ioloop_handler_context *) 0x40c1be60
        events = (struct kevent *) 0x40c35000
        event = (const struct kevent *) 0x40c35000
        tv = {tv_sec = 1799, tv_usec = 999471}
        ts = {tv_sec = 1799, tv_nsec = 999471000}
        io = (struct io_file *) 0x40c15740
        events_count = 3
        t_id = 2
        ret = 1
        i = 0
        __PRETTY_FUNCTION__ = "io_loop_handler_run"
#19 0x00000000004bd51b in io_loop_run (ioloop=0x40c19140) at ioloop.c:301
No locals.
#20 0x0000000000428a19 in main (argc=3, argv=0x7fffffffd250, 
envp=0x7fffffffd270) at main.c:293
No locals.