dovecot crash with virtual folders (debian testing version 2.2.13-11)

[James Bottomley]

The virtual folder triggering the crash has the configuration

namespace {
  prefix = virtual/
  separator = /
  location = virtual:~/Maildir/virtual
}

And the actual virtual/openstack/dovecot-virtual file is

Lists/openstack-dev
  inthread refs or from "james bottomley" keyword thread

It's a standard search for threads I've either replied to or marked with
an imap keyword 'thread'

The imap command

0 status virtual/openstack (MESSAGES UNSEEN RECENT)

Is crashing most of the time with

gdb /usr/lib/dovecot/imap
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show
copying"
and "show warranty" for details.
This GDB was configured as "i586-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/lib/dovecot/imap...Reading symbols
from /usr/lib/debug//usr/lib/dovecot/imap...done.
done.
(gdb) r
Starting program: /usr/lib/dovecot/imap 
process 7868 is executing new program: /usr/bin/doveconf
process 7868 is executing new program: /usr/lib/dovecot/imap
* PREAUTH [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID
ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS
THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN
NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH
ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS SPECIAL-USE BINARY
MOVE] Logged in as jejb
0 status virtual/openstack (MESSAGES UNSEEN RECENT)

Program received signal SIGSEGV, Segmentation fault.
0xb7f0814b in mail_search_args_deinit_sub (args=args at entry=0x8005caf0, 
    arg=0x8005cb08) at mail-search.c:169
169     mail-search.c: No such file or directory.
(gdb) bt
#0  0xb7f0814b in mail_search_args_deinit_sub
(args=args at entry=0x8005caf0, 
    arg=0x8005cb08) at mail-search.c:169
#1  0xb7f08aea in mail_search_args_deinit (args=0x8005caf0)
    at mail-search.c:193
#2  0xb7d9ecf1 in virtual_mailbox_close_internal
(mbox=mbox at entry=0x800585d0)
    at virtual-storage.c:253
#3  0xb7d9ed7b in virtual_mailbox_close (box=0x800585d0)
    at virtual-storage.c:307
#4  0xb7f403ff in mail_thread_mailbox_close (box=0x800585d0)
    at index-thread.c:628
#5  0xb7f0d3fe in mailbox_close (box=0x800585d0) at mail-storage.c:1182
#6  0xb7f0d472 in mailbox_free (_box=0xbffff878) at mail-storage.c:1197
#7  0x8001e0ae in imap_status_get (cmd=0x80053948, ns=0x80052220, 
    mailbox=0x8003a250 "virtual/openstack", items=0xbffff8f8, 
    result_r=0xbffff900) at imap-status.c:96
#8  0x80011f64 in cmd_status (cmd=0x80053948) at cmd-status.c:40
#9  0x80016847 in command_exec (cmd=0x80053948) at imap-commands.c:158
#10 0x800155cb in client_command_input (cmd=0x80053948) at
imap-client.c:778
#11 0x80015719 in client_command_input (cmd=0x80053948) at
imap-client.c:839
#12 0x800159cd in client_handle_next_command (remove_io_r=<synthetic
pointer>, 
    client=0x80052ee0) at imap-client.c:877
#13 client_handle_input (client=0x80052ee0) at imap-client.c:889
#14 0x80015dd5 in client_input (client=0x80052ee0) at imap-client.c:931
---Type <return> to continue, or q <return> to quit---
#15 0xb7e202e3 in io_loop_call_io (io=0x800538c8) at ioloop.c:441
#16 0xb7e214be in io_loop_handler_run_internal (ioloop=0x80042458)
    at ioloop-epoll.c:220
#17 0xb7e2036a in io_loop_handler_run (ioloop=0x80042458) at
ioloop.c:488
#18 0xb7e203f9 in io_loop_run (ioloop=0x80042458) at ioloop.c:465
#19 0xb7dc6985 in master_service_run (service=0x80042380, 
    callback=0x800200b0 <client_connected>) at master-service.c:566
#20 0x80008b44 in main (argc=1, argv=0xbffffd84) at main.c:400

I thought it might be this patch

http://hg.dovecot.org/dovecot-2.2/rev/5c6f49e2d8d9

But after applying I still get the same segfault.

James