[Dovecot] Dovecot v2.0.beta5 (2d6cf78982dc): Crashes upon client login

[Thomas Leuxner]

Core dump upon client login with latest changes, gdb attached:

==> /var/log/dovecot.log <==
Jun  8 19:26:05 spectre dovecot: master: Dovecot v2.0.beta5 (2d6cf78982dc) starting up
Jun  8 19:26:21 spectre dovecot: imap-login: Login: user=<tlx at leuxner.net>, method=PLAIN, rip=10.10.10.10, lip=1.2.3.4, mpid=9997, TLS
Jun  8 19:26:21 spectre dovecot: master: Error: service(imap): child 9997 killed with signal 11 (core dumped)
Jun  8 19:26:21 spectre dovecot: imap-login: Login: user=<tlx at leuxner.net>, method=PLAIN, rip=10.10.10.10, lip=1.2.3.4, mpid=9999, TLS
Jun  8 19:26:21 spectre dovecot: master: Error: service(imap): child 9999 killed with signal 11 (core dumped)
Jun  8 19:26:26 spectre dovecot: imap-login: Login: user=<tlx at leuxner.net>, method=PLAIN, rip=10.10.10.10, lip=1.2.3.4, mpid=10001, TLS
Jun  8 19:26:28 spectre dovecot: master: Error: service(imap): child 10001 killed with signal 11 (core dumped)
Jun  8 19:26:32 spectre dovecot: master: Warning: Killed with signal 15 (by pid=10021 uid=0 code=kill)

Core was generated by `dovecot/imap'.
Program terminated with signal 11, Segmentation fault.
[New process 10001]
#0  quota_mailbox_transaction_commit (ctx=0x1d66660, changes_r=0x7fffec59fd80) at quota-storage.c:91
91      quota-storage.c: No such file or directory.
        in quota-storage.c
#0  quota_mailbox_transaction_commit (ctx=0x1d66660, changes_r=0x7fffec59fd80) at quota-storage.c:91
        qbox = (struct quota_mailbox *) 0x1d5df50
        qt = (struct quota_transaction_context *) 0x0
#1  0x00007fcfcaf5b69d in mailbox_transaction_commit_get_changes (_t=<value optimized out>, changes_r=0x7fffec59fd80) at mail-storage.c:1194
        _data_stack_cur_id = 4
        t = (struct mailbox_transaction_context *) 0x1d66660
        ret = <value optimized out>
#2  0x00007fcfcaf5b6d6 in mailbox_transaction_commit (t=0x18) at mail-storage.c:1178
        changes = {pool = 0xa0, uid_validity = 0, saved_uids = {arr = {buffer = 0x0, element_size = 30553128}, v = 0x0, v_modifiable = 0x0}, ignored_uid_changes = 30770416, ignored_modseq_changes = 0}
        ret = <value optimized out>
#3  0x0000000000415a93 in imap_search_deinit (ctx=0x1d584e0) at imap-search.c:575
        ret = 0
#4  0x00000000004160cc in cmd_search_more (cmd=0x1d583d8) at imap-search.c:402
        ctx = (struct imap_search_context *) 0x1d584e0
        opts = SEARCH_RETURN_ALL
        sync_flags = <value optimized out>
        end_time = {tv_sec = 30988688, tv_usec = 1024}
        id = 18766
        id_min = <value optimized out>
        id_max = 0
        time_msecs = <value optimized out>
        tryagain = false
        lost_data = false
        __FUNCTION__ = "cmd_search_more"
#5  0x0000000000416484 in imap_search_start (ctx=0x1d584e0, sargs=0x1d65698, sort_program=0x0) at imap-search.c:550
        cmd = (struct client_command_context *) 0x1d583d8
        wanted_fields = 0
        wanted_headers = (struct mailbox_header_lookup_ctx *) 0x0
#6  0x000000000040d443 in cmd_search (cmd=0x1d583d8) at cmd-search.c:45
        ctx = <value optimized out>
        sargs = (struct mail_search_args *) 0x1d65698
        args = (const struct imap_arg *) 0x1d5ac30
        charset = 0x41a0cc "UTF-8"
        ret = 0
#7  0x000000000041030c in client_command_input (cmd=0x1d583d8) at imap-client.c:646
        client = (struct client *) 0x1d57c78
        command = <value optimized out>
        __FUNCTION__ = "client_command_input"
#8  0x00000000004103bd in client_command_input (cmd=0x1d583d8) at imap-client.c:696
        client = (struct client *) 0x1d57c78
        command = (struct command *) 0x8
        __FUNCTION__ = "client_command_input"
#9  0x0000000000410535 in client_handle_input (client=0x1d57c78) at imap-client.c:737
        _data_stack_cur_id = 3
        ret = 34
        remove_io = <value optimized out>
        handled_commands = false
        __FUNCTION__ = "client_handle_input"
#10 0x0000000000410f82 in client_input (client=0x1d57c78) at imap-client.c:788
        cmd = <value optimized out>
        output = (struct ostream *) 0x1d58258
        bytes = <value optimized out>
        __FUNCTION__ = "client_input"
#11 0x00007fcfcacf98eb in io_loop_handler_run (ioloop=<value optimized out>) at ioloop-epoll.c:212
        ctx = (struct ioloop_handler_context *) 0x1d2b7d0
        event = (const struct epoll_event *) 0x1d2b840
        list = (struct io_list *) 0x1d58330
        io = (struct io_file *) 0x1d582f0
        tv = {tv_sec = 1799, tv_usec = 999330}
        t_id = 2
        msecs = <value optimized out>
        ret = 1
        call = <value optimized out>
#12 0x00007fcfcacf8a68 in io_loop_run (ioloop=0x1d2b5c0) at ioloop.c:350
No locals.
#13 0x00007fcfcace8563 in master_service_run (service=0x1d2b490, callback=0x18) at master-service.c:480
No locals.
#14 0x0000000000419121 in main (argc=1, argv=0x1d2b370) at main.c:359
        service_flags = <value optimized out>
        storage_service_flags = <value optimized out>
        postlogin_socket_path = 0x0
        username = 0x0
        c = <value optimized out>
        set_roots = {0x41c320, 0x0}