dovecot - Nov 2014 - IMAP child killed with signal 11

Hello,

We?re running a cluster of dovecot servers for a large amount of users. It?s
been working pretty well except we are seeing occasional fatal error messages.

Here is a sample error message that we are seeing:
Nov 20 19:51:29 ip-10-238-11-11 dovecot: imap(<USER_HERE>): Fatal: master:
service(imap): child 796 killed with signal 11 (core dumped)

We are running dovecot 2.2.9 installed from apt-get on Ubuntu 14.04.

I?ve checked out the core dump and here is the stack trace:

Core was generated by `dovecot/imap [e22a36135b5f40'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f83d63aa757 in mail_transaction_log_view_mark (view=0x7f83d804f8c0)
at mail-transaction-log-view.c:794
794 mail-transaction-log-view.c: No such file or directory.
(gdb) bt
#0  0x00007f83d63aa757 in mail_transaction_log_view_mark (view=0x7f83d804f8c0)
at mail-transaction-log-view.c:794
#1  0x00007f83d63a3796 in view_sync_have_expunges (view=0x7f83d804f7e0) at
mail-index-view-sync.c:223
#2  mail_index_view_sync_begin (view=0x7f83d804f7e0, flags=flags at
entry=MAIL_INDEX_VIEW_SYNC_FLAG_NOEXPUNGES) at mail-index-view-sync.c:583
#3  0x00007f83d6382168 in index_mailbox_sync_init (box=box at
entry=0x7f83d8049f80,
    flags=flags at entry=(MAILBOX_SYNC_FLAG_FAST |
MAILBOX_SYNC_FLAG_NO_EXPUNGES), failed=<optimized out>) at
index-sync.c:226
#4  0x00007f83d632983b in maildir_storage_sync_init (box=0x7f83d8049f80,
flags=(MAILBOX_SYNC_FLAG_FAST | MAILBOX_SYNC_FLAG_NO_EXPUNGES))
    at maildir-sync.c:1120
#5  0x00007f83d6356cf9 in mailbox_sync_init (box=box at entry=0x7f83d8049f80, 
    flags=flags at entry=(MAILBOX_SYNC_FLAG_FAST |
MAILBOX_SYNC_FLAG_NO_EXPUNGES)) at mail-storage.c:1668
#6  0x00007f83d6835e5e in imap_sync_init (client=client at entry=0x7f83d8046b60,
box=<optimized out>, imap_flags=(unknown: 0),
    flags=(MAILBOX_SYNC_FLAG_FAST | MAILBOX_SYNC_FLAG_NO_EXPUNGES)) at
imap-sync.c:230
#7  0x00007f83d6836af0 in cmd_sync_client (sync_cmd=0x7f83d8047760) at
imap-sync.c:739
#8  cmd_sync_delayed_real (client=0x7f83d8046b60) at imap-sync.c:877
#9  cmd_sync_delayed (client=client at entry=0x7f83d8046b60) at imap-sync.c:885
#10 0x00007f83d682db61 in client_handle_input (client=client at
entry=0x7f83d8046b60) at imap-client.c:906
#11 0x00007f83d682de35 in client_input (client=0x7f83d8046b60) at
imap-client.c:933
#12 0x00007f83d608c247 in io_loop_call_io (io=0x7f83d8047660) at ioloop.c:388
#13 0x00007f83d608cfd7 in io_loop_handler_run (ioloop=ioloop at
entry=0x7f83d8030760) at ioloop-epoll.c:220
#14 0x00007f83d608bde8 in io_loop_run (ioloop=0x7f83d8030760) at ioloop.c:412
#15 0x00007f83d603cc93 in master_service_run (service=0x7f83d80305f0,
callback=<optimized out>) at master-service.c:566
#16 0x00007f83d68222f4 in main (argc=2, argv=0x7f83d8030390) at main.c:400


Here are the settings we?re running (I?ve removed our domain and path
information):

# 2.2.9: /etc/dovecot/dovecot.conf
# OS: Linux 3.13.0-24-generic x86_64 Ubuntu 14.04.1 LTS 
auth_mechanisms = plain login
base_dir = /var/run/dovecot/
default_client_limit = 1024
default_process_limit = 256
default_vsz_limit = 1 G
disable_plaintext_auth = no
mail_privileged_group = mail
namespace inbox {
  inbox = yes
  location = 
  mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix = 
}
passdb {
  args = /etc/dovecot/dovecot-sql.conf
  driver = sql
}
protocols = " imap lmtp pop3"
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0666
    user = postfix
  }
}
service imap-login {
  inet_listener imap {
    port = 143
  }
  process_min_avail = 4
  service_count = 0
  vsz_limit = 128 M
}
service imap-postlogin {
  executable = script-login /real/location/to/the/script.sh
  user = vmail
}
service imap {
  client_limit = 1
  executable = imap imap-postlogin
  process_limit = 65536
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 110
  }
  service_count = 0
}
ssl = no
userdb {
  args = /etc/dovecot/dovecot-sql.conf
  driver = sql
}
verbose_proctitle = yes
protocol lmtp {
  hostname = real.domain.here
  postmaster_address = postmaster at real.domain.here
}


This seems like some sort of bug within dovecot since we?re seeing a seg fault,
but any help would be appreciated. Thanks!