dovecot - Jan 2011 - Panic in 2.0.9 imap-client

Hi,

Yesterday I upgraded one of our system from 2.0.7 to 2.0.9, I've got about 5
panic since then. It is using the exact same config (see attached) and was
compiled the same way. Any clue on the reason? And how can I fix that?

Jan 17 12:06:20 server dovecot: imap(XXXX at YYYYYYY): Panic: file
imap-client.c: line 570 (client_continue_pending_input): assertion failed:
(!client->handling_input)
Jan 17 12:06:20 server dovecot: imap(XXXX at YYYYYYY): Error: Raw backtrace:
/usr/lib64/dovecot/libdovecot.so.0 [0x382be3b620] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x382be3b676] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x382be3ab33] -> dovecot/imap [0x40f766]
-> dovecot/imap(cmd_idle+0xc5) [0x40a825] -> dovecot/imap [0x40f2ec] ->
dovecot/imap [0x40f3a2] -> dovecot/imap(client_handle_input+0x3f) [0x40f4ef]
-> dovecot/imap(client_input+0x62) [0x40fe62] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x48) [0x382be45e78] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0xd5) [0x382be471b5]
-> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x2d) [0x382be45e0d] ->
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13) [0x382be34c33] ->
dovecot/imap(main+0x1d8) [0x417948] ->
/lib64/libc.so.6(__libc_start_main+0xf4) [0x3ac341d994] -> dovecot/imap
[0x408179]

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: doveconf.txt
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20110117/3fd00f0b/attachment-0002.txt>

> Jan 17 12:06:20 server dovecot: imap(XXXX at YYYYYYY): Panic: file
imap-client.c: line 570 (client_continue_pending_input): assertion failed:
(!client->handling_input)
I just saw this with 2.0.8 too.  Backtrace is:

0   __kill + 10
1    abort + 177
2    0x10d928000 + 143594
3    0x10d928000 + 139194
4    i_panic + 159
5    client_continue_pending_input + 196
6    cmd_idle + 188
7    client_command_input + 36
8    client_command_input + 416
9    client_handle_input + 134
10   client_input + 118
11   io_loop_call_io + 70
12   io_loop_handler_run + 227
13   io_loop_run + 72
14   master_service_run + 27
15   main + 703
16   start + 52

>> Jan 17 12:06:20 server dovecot: imap(XXXX at YYYYYYY): Panic: file
imap-client.c: line 570 (client_continue_pending_input): assertion failed:
(!client->handling_input)
I can reproduce this every time by sending any data in the same packet after the
"tag IDLE<CR><LF>".  For instance using nc:
$ nc localhost 143
... login, etc ...
x idle^M^Jfoo

Where I generate ^M^J by typing ctrl-V ctrl-M ctrl-V ctrl-J.