dovecot - Apr 2014 - crash while fts searching a virtual folder

Hi,

searching a virtual folder crashes dovecot quite often. I'm using 
dovecot 2.2.12. Here's the backtrace:

[New LWP 28245]
[Thread debugging using libthread_db enabled]
Using host libthread_db library 
"/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `dovecot/imap'.
Program terminated with signal 6, Aborted.
#0  0x00007fc1d73f4425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#0  0x00007fc1d73f4425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#1  0x00007fc1d73f7b8b in abort () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#2  0x00007fc1d77e6d45 in default_fatal_finish (type=<optimized out>, 
status=0) at failures.c:193
         backtrace = 0x1cdc318 
"/usr/local/lib/dovecot/libdovecot.so.0(+0x68d4f) [0x7fc1d77e6d4f] -> 
/usr/local/lib/dovecot/libdovecot.so.0(+0x68dae) [0x7fc1d77e6dae] -> 
/usr/local/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7fc1d77a0"...
#3  0x00007fc1d77e6dae in i_internal_fatal_handler (ctx=0x7fff86d4b2d0, 
format=<optimized out>, args=<optimized out>) at failures.c:657
         status = 0
#4  0x00007fc1d77a03b9 in i_panic (format=<optimized out>) at 
failures.c:267
         ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0}
         args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 
0x7fff86d4b3a0, reg_save_area = 0x7fff86d4b2e0}}
#5  0x00007fc1d6774ed9 in level_scores_add_vuids (br=0x2413ab8, 
level=0x1c0c2e0, vbox=0x170c950) at fts-search.c:81
         i = <optimized out>
         count = 234
         backend_uids = {arr = {buffer = 0x1cdbe90, element_size = 8}, v 
= 0x1cdbe90, v_modifiable = 0x1cdbe90}
         vuids_arr = {arr = {buffer = 0x1cdba98, element_size = 4}, v = 
0x1cdba98, v_modifiable = 0x1cdba98}
         vuids = 0xea
         scores = 0x23c8f50
         score = 0xea
#6  multi_add_lookup_result (args=0x1bbb220, level=0x1c0c2e0, 
fctx=0x18c2240, result=<optimized out>) at fts-search.c:146
         br = 0x2413ab8
         vbox = 0x170c950
         vuids = {arr = {buffer = 0x16dbe70, element_size = 8}, v = 
0x16dbe70, v_modifiable = 0x16dbe70}
         orig_size = <optimized out>
         i = <optimized out>
#7  fts_search_lookup_level_multi (and_args=true, args=0x1bbb220, 
fctx=0x18c2240) at fts-search.c:194
         mailboxes_arr = {arr = {buffer = 0x1e0a580, element_size = 8}, v 
= 0x1e0a580, v_modifiable = 0x1e0a580}
         backend = <optimized out>
         j = 60
         vbox = <optimized out>
         mailboxes = 0x1e0a5b8
         level = 0x1c0c2e0
         result = {pool = 0x1e0a560, box_results = 0x2413838}
         i = <optimized out>
         mailbox_count = 60
#8  fts_search_lookup_level (fctx=0x18c2240, args=0x1bbb220, 
and_args=true) at fts-search.c:208
         _data_stack_cur_id = 4
         ret = <optimized out>
#9  0x00007fc1d6774f86 in fts_search_lookup (fctx=<optimized out>) at 
fts-search.c:354
         last_uid = 32653
         seq1 = 0
         seq2 = 0
         __FUNCTION__ = "fts_search_lookup"
#10 0x00007fc1d6776388 in fts_mailbox_search_init (t=<optimized out>, 
args=0x1bbb160, sort_program=<optimized out>, wanted_fields=0, 
wanted_headers=0x0) at fts-storage.c:207
         ft = 0x1d4be20
         fbox = <optimized out>
         flist = 0x1706610
         ctx = 0x192f540
         fctx = 0x18c2240
#11 0x000000000041caa0 in imap_search_start (ctx=0x170a238, 
sargs=0x1bbb160, sort_program=0x0) at imap-search.c:576
         cmd = 0x170a130
         __FUNCTION__ = "imap_search_start"
#12 0x00000000004117b6 in cmd_search (cmd=0x170a130) at cmd-search.c:48
         ctx = 0x170a238
         sargs = 0x1bbb160
         args = 0x16e2a38
         charset = 0x424d0b "UTF-8"
         ret = <optimized out>
#13 0x000000000041734d in command_exec (cmd=0x170a130) at 
imap-commands.c:158
         hook = 0x16e00f0
         ret = <optimized out>
#14 0x00000000004163e0 in client_command_input (cmd=0x170a130) at 
imap-client.c:780
         client = 0x17095e0
         command = <optimized out>
         __FUNCTION__ = "client_command_input"
#15 0x00000000004164c5 in client_command_input (cmd=0x170a130) at 
imap-client.c:841
         client = 0x17095e0
         command = <optimized out>
         __FUNCTION__ = "client_command_input"
#16 0x000000000041676d in client_handle_next_command 
(remove_io_r=<synthetic pointer>, client=0x17095e0) at imap-client.c:879
No locals.
#17 client_handle_input (client=0x17095e0) at imap-client.c:891
         _data_stack_cur_id = 3
         ret = 48
         remove_io = false
         handled_commands = false
         __FUNCTION__ = "client_handle_input"
#18 0x0000000000416ae2 in client_input (client=0x17095e0) at 
imap-client.c:933
         cmd = <optimized out>
         output = 0x1709ff0
         bytes = 26
         __FUNCTION__ = "client_input"
#19 0x00007fc1d77f7616 in io_loop_call_io (io=0x17071a0) at ioloop.c:388
         ioloop = 0x16df730
         t_id = 2
#20 0x00007fc1d77f84cf in io_loop_handler_run (ioloop=<optimized out>) 
at ioloop-epoll.c:220
         ctx = 0x16e03d0
         events = 0x0
         event = 0x16e1230
         list = 0x16e1e00
         io = <optimized out>
         tv = {tv_sec = 2, tv_usec = 425339}
         events_count = <optimized out>
         msecs = <optimized out>
         ret = 1
         i = <optimized out>
         call = <optimized out>
         __FUNCTION__ = "io_loop_handler_run"
#21 0x00007fc1d77f7128 in io_loop_run (ioloop=0x16df730) at ioloop.c:412
         __FUNCTION__ = "io_loop_run"
#22 0x00007fc1d77a57d3 in master_service_run (service=0x16df5c0, 
callback=<optimized out>) at master-service.c:566
No locals.
#23 0x000000000040af58 in main (argc=1, argv=0x16df390) at main.c:400
         set_roots = {0x427840, 0x0}
         login_set = {auth_socket_path = 0x16d7058 "", 
postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 
0x41fb00 <login_client_connected>, failure_callback = 0x41f810 
<login_client_failed>, request_auth_token = 1}
         service_flags = <optimized out>
         storage_service_flags = <optimized out>
         username = <optimized out>
         c = <optimized out>

Rebuilding the fts index and erasing all dovecot.index.* files didn't 
help.

Regards,
Matthias

On 25.4.2014, at 15.24, Matthias Rieber <ml-dovecot at zu-con.org> wrote:
> searching a virtual folder crashes dovecot quite often. I'm using
dovecot 2.2.12. Here's the backtrace:
> 
> #5  0x00007fc1d6774ed9 in level_scores_add_vuids (br=0x2413ab8,
level=0x1c0c2e0, vbox=0x170c950) at fts-search.c:81
http://hg.dovecot.org/dovecot-2.2/rev/d63b209737be should fix this.