The crash occurs:

{{{
Thread 1 (Thread 0x7f4edf9cb700 (LWP 27506)):

0 cache_unlock_entry (cache=0x7f4ee17305d8, e=0x0) at ldap/servers/slapd/back-ldbm/cache.c:1568

1 0x00007f4ed3b1ec08 in ldbm_back_delete (pb=0x7f4ea80164c0) at ldap/servers/slapd/back-ldbm/ldbm_delete.c:1278

2 0x00007f4edf58a0f0 in op_shared_delete (pb=pb@entry=0x7f4ea80164c0) at ldap/servers/slapd/delete.c:364

3 0x00007f4edf58a2a2 in delete_internal_pb (pb=pb@entry=0x7f4ea80164c0) at ldap/servers/slapd/delete.c:242

4 0x00007f4edf58a553 in slapi_delete_internal_pb (pb=pb@entry=0x7f4ea80164c0) at ldap/servers/slapd/delete.c:185

5 0x00007f4ed239bafe in delete_changerecord (cnum=cnum@entry=52314) at ldap/servers/plugins/retrocl/retrocl_trim.c:117

6 0x00007f4ed239bdd1 in trim_changelog () at ldap/servers/plugins/retrocl/retrocl_trim.c:316

7 changelog_trim_thread_fn (arg=) at ldap/servers/plugins/retrocl/retrocl_trim.c:359

8 0x00007f4edd9ca7bb in _pt_root () from /lib64/libnspr4.so

9 0x00007f4edd36bdf5 in start_thread () from /lib64/libpthread.so.0

10 0x00007f4edd0991ad in clone () from /lib64/libc.so.6

}}}

The problem could be trigger by small cn=changelog entry cache

{{{
[25/Jun/2015:15:04:33 +0200] - 389-Directory/1.3.3.1 B2015.118.1941 starting up
[25/Jun/2015:15:04:35 +0200] - WARNING -- Minimum cache size is 512000 -- rounding up
[25/Jun/2015:15:04:36 +0200] - WARNING -- Minimum cache size is 512000 -- rounding up
[25/Jun/2015:15:04:36 +0200] - WARNING -- Minimum cache size is 512000 -- rounding up
[25/Jun/2015:15:04:36 +0200] - WARNING -- Minimum cache size is 512000 -- rounding up
[25/Jun/2015:15:04:37 +0200] - WARNING: changelog: entry cache size 512000B is less than db size 36683776B; We recommend to increase the entry cache size nsslapd-cachememsize.
[25/Jun/2015:15:04:37 +0200] - I'm resizing my cache now...cache was 3689347 and is now 2951477
}}}

The bug could be at https://git.fedorahosted.org/cgit/389/ds.git/tree/ldap/servers/slapd/back-ldbm/ldbm_delete.c#n1264. If '!create_tombstone_entry' (that is the case for cn=changelog), 'e' was updated and so could be NULL.

attachment
stacktrace.27492

attachment
stacktrace.27553.zip

attachment
stacktrace.27615.zip

attachment
0001-Ticket-48206-Crash-during-retro-changelog-trimming.patch

Looks good.

Does your fix need to be backported to the older version, too?

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1244926

29043c5..2a8a8c8 master -> master
commit 2a8a8c8ced5849dada34ab28d79e87dd3636e413
Author: Mark Reynolds mreynolds@redhat.com
Date: Mon Jul 20 14:22:05 2015 -0400

0e31d81..6d43988 389-ds-base-1.3.4 -> 389-ds-base-1.3.4
commit 6d439887b99da557e8d7bc0c611d9afa909fdce7

c81f40a..1cde230 389-ds-base-1.3.3 -> 389-ds-base-1.3.3
commit 1cde230fc97b87b37e8fe78028d07c2c58143bdd

64b54d4..21a1196 389-ds-base-1.3.2 -> 389-ds-base-1.3.2
commit 21a1196113d2ed2f35a79a84ad38b8962d4a5f84

35f75ce..95a7fbd 389-ds-base-1.3.1 -> 389-ds-base-1.3.1
commit 95a7fbdc2103d5c5cacb51fb2dc06101f20b76d3

8173360..f5552bf 389-ds-base-1.2.11 -> 389-ds-base-1.2.11
commit f5552bfea4f20db3206fdf48770e86a315c9d3be

Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1244970

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/389ds/389-ds-base/issues/1537

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.