Crashes in dovecot -hg (86f535375750)

[Reuben Farrelly]

Seems there is some breakage with -hg latest - 2.2.16 (86f535375750+). 
I've just had 4 core files created in short succession on both servers 
in the replication set.  Here's the first...

tornado reuben # gdb /usr/libexec/dovecot/imap core
GNU gdb (Gentoo 7.9 vanilla) 7.9
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://bugs.gentoo.org/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/libexec/dovecot/imap...done.
[New LWP 20929]

warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `dovecot/imap'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f186087693a in fts_user_free (fuser=0x0) at fts-user.c:187
187     fts-user.c: No such file or directory.
(gdb) bt full
#0  0x00007f186087693a in fts_user_free (fuser=0x0) at fts-user.c:187
         user_langp = 0x300000008
#1  0x00007f1860876ac2 in fts_mail_user_deinit (user=0x20a3eb0)
     at fts-user.c:215
         fuser = 0x0
#2  0x00007f185d7890f8 in fts_lucene_mail_user_deinit (user=0x20a3eb0)
     at fts-lucene-plugin.c:99
         fuser = 0x20a5550
#3  0x00007f185d994e0c in replication_user_deinit (user=0x20a3eb0)
     at replication-plugin.c:310
         ruser = 0x20a5500
#4  0x00007f18615b565a in mail_user_unref (_user=0x20abc28) at 
mail-user.c:168
         user = 0x20a3eb0
         __FUNCTION__ = "mail_user_unref"
#5  0x000000000041afef in client_default_destroy (client=0x20abbb0, 
reason=0x0)
     at imap-client.c:284
         cmd = 0x7ffde3a18960
         __FUNCTION__ = "client_default_destroy"
#6  0x000000000041ada0 in client_destroy (client=0x20abbb0, reason=0x0)
     at imap-client.c:236
No locals.
#7  0x000000000041ccf4 in client_input (client=0x20abbb0) at 
imap-client.c:967
         cmd = 0x7ffde3a189a0
         output = 0x0
         bytes = 12
         __FUNCTION__ = "client_input"
#8  0x00007f18612fc992 in io_loop_call_io (io=0x20c8610) at ioloop.c:501
         ioloop = 0x2076740
         t_id = 2
         __FUNCTION__ = "io_loop_call_io"
#9  0x00007f18612fec40 in io_loop_handler_run_internal (ioloop=0x2076740)
     at ioloop-epoll.c:220
         ctx = 0x2077460
         events = 0x2078290
         event = 0x2078290
         list = 0x2078e80
         io = 0x20c8610
         tv = {tv_sec = 4, tv_usec = 999387}
         events_count = 5
         msecs = 5000
         ret = 1
         i = 0
         j = 0
         call = true
         __FUNCTION__ = "io_loop_handler_run_internal"
#10 0x00007f18612fcb2f in io_loop_handler_run (ioloop=0x2076740)

Reuben