(ITS#8081) syncprov crash in syncprov_op_mod

[ryan@nardis.ca]

Full_Name: Ryan Tandy
Version: master (05ea787), RE24 (082e192)
OS: Debian unstable
URL: ftp://ftp.openldap.org/incoming/20150317_rtandy_syncprovsegv.tgz
Submission from: (NULL) (24.68.37.4)


hi,

./configure CFLAGS="-g -O0" --disable-bdb --disable-hdb --enable-syncprov

reproducer: ftp://ftp.openldap.org/incoming/20150317_rtandy_syncprovsegv.tgz
note this is _not_ delta-syncrepl.

./prepare
./runslapd (backgrounds a consumer, runs e e producer in gdb in the foreground)
in another terminal, once the consumer has connected (5 seconds retry):
./modify

I get the following crash on master and RE24. not every time, but most times.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe6ffe700 (LWP 25923)]
0x0000000000511d45 in syncprov_op_mod (op=0x7fffd41024a0, rs=0x7fffe6ffdae0) at
syncprov.c:2129
2129						if ( m2->mi_op->o_threadctx == op->o_threadctx ) {
(gdb) bt
#0  0x0000000000511d45 in syncprov_op_mod (op=0x7fffd41024a0, rs=0x7fffe6ffdae0)
at syncprov.c:2129
#1  0x00000000004b6e91 in overlay_op_walk (op=0x7fffd41024a0, rs=0x7fffe6ffdae0,
which=op_modify, oi=0x895a30,
    on=0x895c10) at backover.c:661
#2  0x00000000004b715f in over_op_func (op=0x7fffd41024a0, rs=0x7fffe6ffdae0,
which=op_modify) at backover.c:730
#3  0x00000000004b7293 in over_op_modify (op=0x7fffd41024a0, rs=0x7fffe6ffdae0)
at backover.c:769
#4  0x00000000004494c1 in fe_op_modify (op=0x7fffd41024a0, rs=0x7fffe6ffdae0) at
modify.c:303
#5  0x0000000000448d94 in do_modify (op=0x7fffd41024a0, rs=0x7fffe6ffdae0) at
modify.c:177
#6  0x0000000000429a9f in connection_operation (ctx=0x7fffe6ffdc10,
arg_v=0x7fffd41024a0) at connection.c:1155
#7  0x000000000042a039 in connection_read_thread (ctx=0x7fffe6ffdc10, argv=0xb)
at connection.c:1291
#8  0x000000000052b511 in ldap_int_thread_pool_wrapper (xpool=0x870270) at
tpool.c:696
#9  0x00007ffff77ad0a4 in start_thread (arg=0x7fffe6ffe700) at
pthread_create.c:309
#10 0x00007ffff74e204d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:111
(gdb) p m2->mi_op
$2 = (Operation *) 0xc8

^ that looks a bit bogus. haven't started to investigate or bisect just yet.
will look more tomorrow.

apologies in advance if I've duplicated an existing ITS by accident :)