Re: [389-devel] [389-users] Incremental Replication over SSL ( and startTLS) with simple bind crashes the latest version

[Ivanov Andrey (M.)]

2010/8/25 Rich Megginson <rmeggins(a)redhat.com
>  
>  Andrey Ivanov wrote:
>
> >  
> >  
> > 2010/8/25 Rich Megginson
> <rmeggins(a)redhat.com <mailto:[e-mail]
> > >
> >  
> >  
> >  
> >    Andrey Ivanov wrote:
> >  
> >        I wanted to configure the replication over SSL
> (both with SSL
> >        mechanism which was available in previous versions) and by TLS
> >        using
> >        simple bind (both in multimaster or single master-dedicated
> >        consumer models).
> >  
> >        I've tried to configure it with command line
> and with the
> >        console. The
> >        configuration and the initial initialisation are ok/
> >  
> >        But  when i continue and try to make a change on a
> master the
> >        consumer
> >        server  crashes.  So the total replica initialisation is ok
> >        but even a
> >        single  incremental  update  crashes the consumer server. And
> >        there is
> >        nothing  helpful  in logs. I haven't tried the 1.2.6.rc7
> >        version, i've
> >        tried  the latest code version (as of today). Don't know if it
> >        matters
> >        (there  seem  to  be  a  lot  of coverity defects that have
> >        been fixed
> >        between rc7 and a1).
> >  
> >    Can you get a core file and a stack trace?
> >  
> >  Rich, just as i thought, this crash happens only with
> today's snapshot of
> > 1.2.7.a1 version only. I've compiled 1.2.6.rc7 and the replication works
> > smoothly and without any problem. I didn't have a lot of time to generate a
> > stack trace because i was migrating our production servers. I thought the
> > latest build should be stable but it seems that the changes between 6rc7 and
> > 7a1 introduce some problems with incremental replication as well as with
> > apostrophs in DN (my second mail). So for now i will migrate to 1.2.6.rc7.
> > I'll test the a1 version later when i will have time...
> >  
>  Thanks for the confirmation.  Yeah, the 1.2.7 (master) is
> unstable right
>  now.  There have been a lot of changes going in that haven't been fully
>  tested with our test suite (we're also having to update the test suite).
>  
I wanted to make a  debug build of the server to test the incremental
replication crash i've seen yesterday and used the following commands :
export CFLAGS="-g"
export CXXFLAGS="-g"
export USE_64=1
./configure --prefix=/Local/dirsrv --enable-debug --enable-autobind

Are these parameters correct? Is there any other way to generate the debug
info?

However the debug build i've obtained (from the stable 1.2.6.rc7) in this
way crashes during its startup if i activate USN plugin  with ldapmodify
just after setup-ds-admin, then stop-start:

dn: cn=USN,cn=plugins,cn=config
changetype: modify
replace: nsslapd-pluginEnabled
nsslapd-pluginEnabled: on


Non-debug build does not crash, by the way... I think it's because of the
assertion being executed only in debug builds?


Here is the stack trace :

[root@ldap-model Admin]#  gdb /Local/dirsrv/sbin/ns-slapd
GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-23.el5_5.2)
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html
>  
This is free software: you are free to change and redistribute
it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /Local/dirsrv/sbin/ns-slapd...done.
(gdb) set follow-fork-mode child
(gdb) set arg -D /Local/dirsrv/etc/dirsrv/slapd-dmz -i
/Local/dirsrv/var/run/dirsrv/slapd-dmz.pid -w
/Local/dirsrv/var/run/dirsrv/slapd-dmz.startpid
(gdb) run
Starting program: /Local/dirsrv/sbin/ns-slapd -D
/Local/dirsrv/etc/dirsrv/slapd-dmz -i
/Local/dirsrv/var/run/dirsrv/slapd-dmz.pid -w
/Local/dirsrv/var/run/dirsrv/slapd-dmz.startpid
[Thread debugging using libthread_db enabled]
[New process 32401]
[Thread debugging using libthread_db enabled]
[New Thread 0x40a00940 (LWP 32402)]
[New Thread 0x41401940 (LWP 32403)]
[New Thread 0x41e02940 (LWP 32404)]
[New Thread 0x42803940 (LWP 32405)]
[New Thread 0x43204940 (LWP 32406)]
[New Thread 0x43c05940 (LWP 32407)]
[New Thread 0x44606940 (LWP 32408)]
[New Thread 0x45007940 (LWP 32409)]
[New Thread 0x45a08940 (LWP 32410)]

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x2aaaabee5e00 (LWP 32401)]
0x000000389d430265 in raise () from /lib64/libc.so.6
(gdb) bt
#0  0x000000389d430265 in raise () from /lib64/libc.so.6
#1  0x000000389d431d10 in abort () from /lib64/libc.so.6
#2  0x00002aaaab21d61c in PR_Assert () from /usr/lib64/libnspr4.so
#3  0x00002aaaaab33655 in slapi_mods_add_one_element (smods=0x7fffffff9ee0)
at ldap/servers/slapd/modutil.c:178
#4  0x00002aaaaab336de in slapi_mods_insert_at (smods=0x7fffffff9ee0,
mod=0xacc100, pos=3) at ldap/servers/slapd/modutil.c:196
#5  0x00002aaaaab33974 in slapi_mods_add_ldapmod (smods=0x7fffffff9ee0,
mod=0xacc100) at ldap/servers/slapd/modutil.c:270
#6  0x00002aaaaab33aa2 in slapi_mods_add_modbvps (smods=0x7fffffff9ee0,
modtype=130, type=0x2aaab1af998c "entryusn", bvps=0x7fffffff9ed0) at
ldap/servers/slapd/modutil.c:309
#7  0x00002aaab1af84f4 in _usn_mod_next_usn (mods=0x7fffffff9f30,
be=0x909900) at ldap/servers/plugins/usn/usn.c:378
#8  0x00002aaab1af8773 in usn_bepreop_modify (pb=0x7fffffffe3f0) at
ldap/servers/plugins/usn/usn.c:478
#9  0x00002aaaaab41194 in plugin_call_func (list=0x7ce1c0, operation=451,
pb=0x7fffffffe3f0, call_one=0) at ldap/servers/slapd/plugin.c:1424
#10 0x00002aaaaab41075 in plugin_call_list (list=0x7a5660, operation=451,
pb=0x7fffffffe3f0) at ldap/servers/slapd/plugin.c:1386
#11 0x00002aaaaab3f586 in plugin_call_plugins (pb=0x7fffffffe3f0,
whichfunction=451) at ldap/servers/slapd/plugin.c:379
#12 0x00002aaaafab9b73 in ldbm_back_modify (pb=0x7fffffffe3f0) at
ldap/servers/slapd/back-ldbm/ldbm_modify.c:300
#13 0x00002aaaaab312b4 in op_shared_modify (pb=0x7fffffffe3f0, pw_change=0,
old_pw=0x0) at ldap/servers/slapd/modify.c:834
#14 0x00002aaaaab3090f in modify_internal_pb (pb=0x7fffffffe3f0) at
ldap/servers/slapd/modify.c:554
#15 0x00002aaaaab305f9 in slapi_modify_internal_pb (pb=0x7fffffffe3f0) at
ldap/servers/slapd/modify.c:443
#16 0x00002aaaaab4b917 in pw_mod_allowchange_aci (pw_prohibit_change=0) at
ldap/servers/slapd/pw.c:1297
#17 0x0000000000427195 in pw_init () at ldap/servers/slapd/pw_mgmt.c:301
#18 0x000000000041e514 in main (argc=7, argv=0x7fffffffe8d8) at
ldap/servers/slapd/main.c:1218



(gdb) bt full
#0  0x000000389d430265 in raise () from /lib64/libc.so.6
No symbol table info available.
#1  0x000000389d431d10 in abort () from /lib64/libc.so.6
No symbol table info available.
#2  0x00002aaaab21d61c in PR_Assert () from /usr/lib64/libnspr4.so
No symbol table info available.
#3  0x00002aaaaab33655 in slapi_mods_add_one_element (smods=0x7fffffff9ee0)
at ldap/servers/slapd/modutil.c:178
        need = 5
#4  0x00002aaaaab336de in slapi_mods_insert_at (smods=0x7fffffff9ee0,
mod=0xacc100, pos=3) at ldap/servers/slapd/modutil.c:196
        i = -24896
        a = {a_type = 0x0, a_present_values = {va = 0x0}, a_flags = 0,
a_plugin = 0x0, a_deleted_values = {va = 0x0}, a_listtofree = 0x0, a_next =
0x0, a_deletioncsn = 0x0, a_mr_eq_plugin = 0x0,
          a_mr_ord_plugin = 0x0, a_mr_sub_plugin = 0x0}
#5  0x00002aaaaab33974 in slapi_mods_add_ldapmod (smods=0x7fffffff9ee0,
mod=0xacc100) at ldap/servers/slapd/modutil.c:270
No locals.
#6  0x00002aaaaab33aa2 in slapi_mods_add_modbvps (smods=0x7fffffff9ee0,
modtype=130, type=0x2aaab1af998c "entryusn", bvps=0x7fffffff9ed0) at
ldap/servers/slapd/modutil.c:309
        mod = 0xacc100
#7  0x00002aaab1af84f4 in _usn_mod_next_usn (mods=0x7fffffff9f30,
be=0x909900) at ldap/servers/plugins/usn/usn.c:378
        smods = {mods = 0xadbd90, num_elements = 4, num_mods = 3, iterator =
0, free_mods = 0}
        bvals = {0x7fffffff9ec0, 0x0}
        usn_berval = {bv_len = 1, bv_val = 0x7fffffff9e80 "0"}
        counter_buf =
"0\000\377\377\377\177\000\000f0\264\252\252*\000\000\000\237\377\377\377\177\000\000\300\001\000\000\001\000\000\000
\266\254\000\000\000\000\000\360\343\377\377\377\177\000\000\000\237\377\377\303\001\000\000\300\341|\000\000\000\000"
#8  0x00002aaab1af8773 in usn_bepreop_modify (pb=0x7fffffffe3f0) at
ldap/servers/plugins/usn/usn.c:478
        mods = 0xadbd90
        be = 0x909900
        rc = 0
#9  0x00002aaaaab41194 in plugin_call_func (list=0x7ce1c0, operation=451,
pb=0x7fffffffe3f0, call_one=0) at ldap/servers/slapd/plugin.c:1424
        n = 0x7cbfb0 "USN bepreoperation plugin"
        func = 0x2aaab1af86f0 <usn_bepreop_modify
>  
       
rc = 0
        return_value = 0
        count = 1
#10 0x00002aaaaab41075 in plugin_call_list (list=0x7a5660, operation=451,
pb=0x7fffffffe3f0) at ldap/servers/slapd/plugin.c:1386
No locals.
#11 0x00002aaaaab3f586 in plugin_call_plugins (pb=0x7fffffffe3f0,
whichfunction=451) at ldap/servers/slapd/plugin.c:379
        p = 0x792340
        plugin_list_number = 3
        rc = 0
        do_op = 1
#12 0x00002aaaafab9b73 in ldbm_back_modify (pb=0x7fffffffe3f0) at
ldap/servers/slapd/back-ldbm/ldbm_modify.c:300
        be = 0x909900
        inst = 0x9069c0
        li = 0x793140
        e = 0x7678d0
        ec = 0xb11470
        postentry = 0x0
        mods = 0xadbd90
        smods = {mods = 0x0, num_elements = 0, num_mods = 0, iterator = 0,
free_mods = 0}
        txn = {back_txn_txn = 0x0}
        parent_txn = 0x0
        retval = -1
        msg = 0xd700acf4c0 <Address 0xd700acf4c0 out of bounds
>  
---Type <return> to continue, or q <return> to
quit---
        errbuf = 0x0
        retry_count = 0
        disk_full = 0
        ldap_result_code = 0
        ldap_result_message = 0x0
        rc = 0
        operation = 0xad7a00
        dblock_acquired = 1
        addr = 0xad7ac8
        change_entry = 0
        ec_in_cache = 0
        is_fixup_operation = 0
        is_ruv = 0
        opcsn = 0x0
        i = 0
#13 0x00002aaaaab312b4 in op_shared_modify (pb=0x7fffffffe3f0, pw_change=0,
old_pw=0x0) at ldap/servers/slapd/modify.c:834
        rc = -1
        be = 0x909900
        pse = 0x2aaaaaafcc7d
        referral = 0x0
        ecopy = 0x0
        e = 0x0
        ebuf =
"\300\302\377\377\377\177\000\000L:\257\252\252*\000\000\320zz\000\000\000\000\000\000\303\377\377\377\177\000\000\340\345\377\377\377\177\000\000*+\264\252\252*\000\000\000\000\000\000\000\000\000\000\300FB",
'\000' <repeats 13 times>"\220,
\263v\000\000\000\000\000\016\000\000\000\000\000\000\000\022\252t", '\000'
<repeats 13 times>,
"$\220\000\235\001\000\000\000p\257Я\252*\000\000\220*y", '\000'
<repeats 13
times>"\377, \377\377\377", '\000' <repeats 12 times>,
"(8\357\235\070",
'\000' <repeats 11 times>"\360,
b\220\000\000\000\000\000\020\304\377\377\377\177\000\000\340\310\377\377\377\177\000\000\000`\020\022r*\000\000U\315\000\235\070\000\000\000\005",
'\000' <repeats 31 times>,
"p\257Я\252*\000\000\300\310\377\377\377\177\000\000\260\006\221\000\000\000\000\000\342(\001\235\070\000\000\000\330\226د\252*\000\000\260\006\221",
'\000' <repeats 13 times>,
"\020\304\377\377\377\177\000\000\360b\220\000\000\000\000\000\300"...
        dn = 0x90e980 "o=netscaperoot"
        sdn = {flag = 4 '\004', dn = 0x90e980 "o=netscaperoot", ndn =
0x766af0 "o=netscaperoot", ndn_len = 14}
        mods = 0x86d920
        pw_mod = 0x7fffffffe310
        tmpmods = 0x86d920
        smods = {mods = 0x0, num_elements = 0, num_mods = 0, iterator = 0,
free_mods = 0}
        unhashed_pw_smod = {mods = 0x0, num_elements = 0, num_mods = 0,
iterator = 0, free_mods = 1}
        repl_op = 0
        internal_op = 32
        lastmod = 1
        skip_modified_attrs = 0
        unhashed_pw_attr = 0x0
        operation = 0xad7a00
        errorbuf =
"\000\372N\261\252*\000\000Ȣ\377\377\016\000\000\000\000\000\000\000\001\000\000\000\360\r}\000\000\000\000\000\234dž\000\000\000\000\000\026\264I\260\377\377\377\377`\242\377\377\377\177\000\000\325\067\267\252\252*\000\000Ȣ\377\377\377\177\000\000Ȣ\377\377\000\000\000\000p\242\377\377\001\000\000\000\b\275\255\000\000\000\000\000\340\242\377\377\377\177\000\000p\274\255\000\000\000\000\000\000\000\000\000\377\177",
'\000' <repeats 18 times>,
"k'G\235\070\000\000\000\000\000\000\000e\000\000\000n\000\000\000\377\377\377\377\000\243\377\377\377\177\000\000e\324N\261\252*\000\000\060\251\254\000\000\000\000\000\b\275\255\000\000\000\000\000@\243\377\377\377\177\000\000p\274\255\000\000\000\000\000\320\350\377\377\377\177\000\000\b\275\255\000\000\000\000\000`\243\377\377\377\177\000\000p\274\255\000\000\000\000\000\320\350\377\377\377\177",
'\000' <repeats 18 times>,
"k'G\235\070\000\000\000P\215y\000\b\002\000\000\b\275\255\000\000\000\000\000\000\000\000\000\001\000\000\000L:\257\252\252*\000\000\060\340t"...
        err = 0
        lc_mod = 0x0
        p = 0x0
        numattr = 11334848
        i = 0
#14 0x00002aaaaab3090f in modify_internal_pb (pb=0x7fffffffe3f0) at
ldap/servers/slapd/modify.c:554
---Type <return> to continue, or q <return> to quit---
        controls = 0x0
        pwpolicy_ctrl = 0
        op = 0xad7a00
        opresult = 0
        normalized_mods = 0x86d920
        mods = 0x7fffffffe670
        mod = 0x86d928
        smods = {mods = 0x100acf4c0, num_elements = -7184, num_mods = 32767,
iterator = -7184, free_mods = 32767}
        pw_change = 0
        old_pw = 0x0
#15 0x00002aaaaab305f9 in slapi_modify_internal_pb (pb=0x7fffffffe3f0) at
ldap/servers/slapd/modify.c:443
No locals.
#16 0x00002aaaaab4b917 in pw_mod_allowchange_aci (pw_prohibit_change=0) at
ldap/servers/slapd/pw.c:1297
        pb = {pb_backend = 0x909900, pb_conn = 0x0, pb_op = 0xad7a00,
pb_plugin = 0x7ce1c0, pb_opreturn = 0, pb_object = 0x0, pb_destroy_fn = 0,
pb_requestor_isroot = 1, pb_config_fname = 0x0,
          pb_config_lineno = 0, pb_config_argc = 0, pb_config_argv = 0x0,
pb_target_entry = 0x0, pb_existing_dn_entry = 0xadc210,
pb_existing_uniqueid_entry = 0x0, pb_parent_entry = 0x0,
          pb_newparent_entry = 0x0, pb_pre_op_entry = 0xadbed0,
pb_post_op_entry = 0x0, pb_seq_type = 0, pb_seq_attrname = 0x0, pb_seq_val =
0x0, pb_ldif_file = 0x0, pb_removedupvals = 0,
          pb_db2index_attrs = 0x0, pb_ldif2db_noattrindexes = 0,
pb_ldif_printkey = 0, pb_instance_name = 0x0, pb_task = 0x0, pb_task_flags =
0, pb_mr_filter_match_fn = 0, pb_mr_filter_index_fn = 0,
          pb_mr_filter_reset_fn = 0, pb_mr_index_fn = 0, pb_mr_oid = 0x0,
pb_mr_type = 0x0, pb_mr_value = 0x0, pb_mr_values = 0x0, pb_mr_keys = 0x0,
pb_mr_filter_reusable = 0,
          pb_mr_query_operator = 0, pb_mr_usage = 0,
pb_pwd_storage_scheme_user_passwd = 0x0, pb_pwd_storage_scheme_db_passwd =
0x0, pb_managedsait = 0, pb_internal_op_result = 0,
          pb_plugin_internal_search_op_entries = 0x0,
pb_plugin_internal_search_op_referrals = 0x0, pb_plugin_identity = 0xacf4c0,
pb_parent_txn = 0x0, pb_txn = 0x0, pb_dbsize = 0,
          pb_ldif_files = 0x0, pb_ldif_include = 0x0, pb_ldif_exclude = 0x0,
pb_ldif_dump_replica = 0, pb_ldif_dump_uniqueid = 0,
pb_ldif_generate_uniqueid = 0, pb_ldif_namespaceid = 0x0,
          pb_ldif_encrypt = 0, pb_operation_notes = 0, pb_slapd_argc = 0,
pb_slapd_argv = 0x0, pb_slapd_configdir = 0x0, pb_ctrls_arg = 0x0,
pb_dse_dont_add_write = 0, pb_dse_add_merge = 0,
          pb_dse_dont_check_dups = 0, pb_dse_is_primary_file = 0,
pb_schema_flags = 0, pb_result_code = 0, pb_result_text = 0x0,
pb_result_matched = 0x0, pb_nentries = 0, urls = 0x0,
          pb_import_entry = 0x0, pb_import_state = 0, pb_destroy_content =
0, pb_dse_reapply_mods = 0, pb_urp_naming_collision_dn = 0x0,
pb_urp_tombstone_uniqueid = 0x0, pb_server_running = 0,
          pb_backend_count = 1, pb_pwpolicy_ctrl = 0, pb_vattr_context =
0x0, pb_substrlens = 0x0, pb_plugin_enabled = 0, pb_search_ctrls = 0x0,
pb_mr_index_sv_fn = 0}
        rc = 32
        base = 0x90feb0
        values_mod = {0x2aaaaab8f898 "(targetattr = \"userPassword\") (
version 3.0; acl \"disallow_pw_change_aci\"; deny (write ) userdn =
\"ldap:///self\";)", 0x0}
        mod = {mod_op = 1, mod_type = 0x2aaaaab8f88d "aci", mod_vals =
{modv_strvals = 0x7fffffffe6a0, modv_bvals = 0x7fffffffe6a0}}
        mods = {0x7fffffffe680, 0x0}
        be = 0x909900
        cookie = 0xacf830 "\004"
#17 0x0000000000427195 in pw_init () at ldap/servers/slapd/pw_mgmt.c:301
        slapdFrontendConfig = 0x2aaaaadbcc00
#18 0x000000000041e514 in main (argc=7, argv=0x7fffffffe8d8) at
ldap/servers/slapd/main.c:1218
        return_value = 0
        slapdFrontendConfig = 0x2aaaaadbcc00
        ports_info = {n_port = 389, s_port = 636, n_listenaddr = 0x753590,
s_listenaddr = 0x74f9a0, n_socket = 0x751610, i_listenaddr = 0x0, i_port =
0, i_socket = 0x0, s_socket = 0x0}

[389-users] Incremental Replication over SSL ( and startTLS) with simple bind crashes the latest version

[Rich Megginson]

Andrey Ivanov wrote:
>  2010/8/25 Rich Megginson <rmeggins(a)redhat.com 
>  <mailto:[e-mail]>>
>
>      Andrey Ivanov wrote:
>
>
>
>          2010/8/25 Rich Megginson <rmeggins(a)redhat.com
>          <mailto:[e-mail]> <mailto:[e-mail]
>          <mailto:[e-mail]>>>
>
>
>             Andrey Ivanov wrote:
>
>                 I wanted to configure the replication over SSL (both
>          with SSL
>                 mechanism which was available in previous versions) and
>          by TLS
>                 using
>                 simple bind (both in multimaster or single master-dedicated
>                 consumer models).
>
>                 I've tried to configure it with command line and with the
>                 console. The
>                 configuration and the initial initialisation are ok/
>
>                 But  when i continue and try to make a change on a
>          master the
>                 consumer
>                 server  crashes.  So the total replica initialisation is ok
>                 but even a
>                 single  incremental  update  crashes the consumer
>          server. And
>                 there is
>                 nothing  helpful  in logs. I haven't tried the 1.2.6.rc7
>                 version, i've
>                 tried  the latest code version (as of today). Don't
>          know if it
>                 matters
>                 (there  seem  to  be  a  lot  of coverity defects that have
>                 been fixed
>                 between rc7 and a1).
>                 
>             Can you get a core file and a stack trace?
>
>           Rich, just as i thought, this crash happens only with today's
>          snapshot of 1.2.7.a1 version only. I've compiled 1.2.6.rc7 and
>          the replication works smoothly and without any problem. I
>          didn't have a lot of time to generate a stack trace because i
>          was migrating our production servers. I thought the latest
>          build should be stable but it seems that the changes between
>          6rc7 and 7a1 introduce some problems with incremental
>          replication as well as with apostrophs in DN (my second mail).
>          So for now i will migrate to 1.2.6.rc7. I'll test the a1
>          version later when i will have time...
>
>      Thanks for the confirmation.  Yeah, the 1.2.7 (master) is unstable
>      right now.  There have been a lot of changes going in that haven't
>      been fully tested with our test suite (we're also having to update
>      the test suite).
>
>
>  I wanted to make a  debug build of the server to test the incremental 
>  replication crash i've seen yesterday and used the following commands :
>  export CFLAGS="-g"
>  export CXXFLAGS="-g"
>  export USE_64=1
>  ./configure --prefix=/Local/dirsrv --enable-debug --enable-autobind
>
>  Are these parameters correct? Is there any other way to generate the 
>  debug info? 
This is the correct way to do it.
>  However the debug build i've obtained (from the stable 1.2.6.rc7) in 
>  this way crashes during its startup if i activate USN plugin  with 
>  ldapmodify just after setup-ds-admin, then stop-start:
>
>  dn: cn=USN,cn=plugins,cn=config
>  changetype: modify
>  replace: nsslapd-pluginEnabled
>  nsslapd-pluginEnabled: on
>
>
>  Non-debug build does not crash, by the way... I think it's because of 
>  the assertion being executed only in debug builds? 
Right.  This is a bogus
assertion in the slapi_mods code - it should not 
assert freemods != 0 if using slapi_mods via passin and passout.  This 
will be fixed very soon.

Noriko just committed a fix for the repl crashing issue.
>  Here is the stack trace :
>
>  [root@ldap-model Admin]#  gdb /Local/dirsrv/sbin/ns-slapd
>  GNU gdb (GDB) Red Hat Enterprise Linux (7.0.1-23.el5_5.2)
>  Copyright (C) 2009 Free Software Foundation, Inc.
>  License GPLv3+: GNU GPL version 3 or later 
>  <http://gnu.org/licenses/gpl.html>
>  This is free software: you are free to change and redistribute it.
>  There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
>  and "show warranty" for details.
>  This GDB was configured as "x86_64-redhat-linux-gnu".
>  For bug reporting instructions, please see:
>  <http://www.gnu.org/software/gdb/bugs/>...
>  Reading symbols from /Local/dirsrv/sbin/ns-slapd...done.
>  (gdb) set follow-fork-mode child
>  (gdb) set arg -D /Local/dirsrv/etc/dirsrv/slapd-dmz -i 
>  /Local/dirsrv/var/run/dirsrv/slapd-dmz.pid -w 
>  /Local/dirsrv/var/run/dirsrv/slapd-dmz.startpid        
>  (gdb) run
>  Starting program: /Local/dirsrv/sbin/ns-slapd -D 
>  /Local/dirsrv/etc/dirsrv/slapd-dmz -i 
>  /Local/dirsrv/var/run/dirsrv/slapd-dmz.pid -w 
>  /Local/dirsrv/var/run/dirsrv/slapd-dmz.startpid        
>  [Thread debugging using libthread_db enabled]
>  [New process 32401]
>  [Thread debugging using libthread_db enabled]
>  [New Thread 0x40a00940 (LWP 32402)]
>  [New Thread 0x41401940 (LWP 32403)]
>  [New Thread 0x41e02940 (LWP 32404)]
>  [New Thread 0x42803940 (LWP 32405)]
>  [New Thread 0x43204940 (LWP 32406)]
>  [New Thread 0x43c05940 (LWP 32407)]
>  [New Thread 0x44606940 (LWP 32408)]
>  [New Thread 0x45007940 (LWP 32409)]
>  [New Thread 0x45a08940 (LWP 32410)]
>
>  Program received signal SIGABRT, Aborted.
>  [Switching to Thread 0x2aaaabee5e00 (LWP 32401)]
>  0x000000389d430265 in raise () from /lib64/libc.so.6
>  (gdb) bt
>  #0  0x000000389d430265 in raise () from /lib64/libc.so.6
>  #1  0x000000389d431d10 in abort () from /lib64/libc.so.6
>  #2  0x00002aaaab21d61c in PR_Assert () from /usr/lib64/libnspr4.so
>  #3  0x00002aaaaab33655 in slapi_mods_add_one_element 
>  (smods=0x7fffffff9ee0) at ldap/servers/slapd/modutil.c:178
>  #4  0x00002aaaaab336de in slapi_mods_insert_at (smods=0x7fffffff9ee0, 
>  mod=0xacc100, pos=3) at ldap/servers/slapd/modutil.c:196
>  #5  0x00002aaaaab33974 in slapi_mods_add_ldapmod 
>  (smods=0x7fffffff9ee0, mod=0xacc100) at ldap/servers/slapd/modutil.c:270
>  #6  0x00002aaaaab33aa2 in slapi_mods_add_modbvps 
>  (smods=0x7fffffff9ee0, modtype=130, type=0x2aaab1af998c "entryusn", 
>  bvps=0x7fffffff9ed0) at ldap/servers/slapd/modutil.c:309
>  #7  0x00002aaab1af84f4 in _usn_mod_next_usn (mods=0x7fffffff9f30, 
>  be=0x909900) at ldap/servers/plugins/usn/usn.c:378
>  #8  0x00002aaab1af8773 in usn_bepreop_modify (pb=0x7fffffffe3f0) at 
>  ldap/servers/plugins/usn/usn.c:478
>  #9  0x00002aaaaab41194 in plugin_call_func (list=0x7ce1c0, 
>  operation=451, pb=0x7fffffffe3f0, call_one=0) at 
>  ldap/servers/slapd/plugin.c:1424
>  #10 0x00002aaaaab41075 in plugin_call_list (list=0x7a5660, 
>  operation=451, pb=0x7fffffffe3f0) at ldap/servers/slapd/plugin.c:1386
>  #11 0x00002aaaaab3f586 in plugin_call_plugins (pb=0x7fffffffe3f0, 
>  whichfunction=451) at ldap/servers/slapd/plugin.c:379
>  #12 0x00002aaaafab9b73 in ldbm_back_modify (pb=0x7fffffffe3f0) at 
>  ldap/servers/slapd/back-ldbm/ldbm_modify.c:300
>  #13 0x00002aaaaab312b4 in op_shared_modify (pb=0x7fffffffe3f0, 
>  pw_change=0, old_pw=0x0) at ldap/servers/slapd/modify.c:834
>  #14 0x00002aaaaab3090f in modify_internal_pb (pb=0x7fffffffe3f0) at 
>  ldap/servers/slapd/modify.c:554
>  #15 0x00002aaaaab305f9 in slapi_modify_internal_pb (pb=0x7fffffffe3f0) 
>  at ldap/servers/slapd/modify.c:443
>  #16 0x00002aaaaab4b917 in pw_mod_allowchange_aci 
>  (pw_prohibit_change=0) at ldap/servers/slapd/pw.c:1297
>  #17 0x0000000000427195 in pw_init () at ldap/servers/slapd/pw_mgmt.c:301
>  #18 0x000000000041e514 in main (argc=7, argv=0x7fffffffe8d8) at 
>  ldap/servers/slapd/main.c:1218
>
>
>
>  (gdb) bt full
>  #0  0x000000389d430265 in raise () from /lib64/libc.so.6
>  No symbol table info available.
>  #1  0x000000389d431d10 in abort () from /lib64/libc.so.6
>  No symbol table info available.
>  #2  0x00002aaaab21d61c in PR_Assert () from /usr/lib64/libnspr4.so
>  No symbol table info available.
>  #3  0x00002aaaaab33655 in slapi_mods_add_one_element 
>  (smods=0x7fffffff9ee0) at ldap/servers/slapd/modutil.c:178
>          need = 5
>  #4  0x00002aaaaab336de in slapi_mods_insert_at (smods=0x7fffffff9ee0, 
>  mod=0xacc100, pos=3) at ldap/servers/slapd/modutil.c:196
>          i = -24896
>          a = {a_type = 0x0, a_present_values = {va = 0x0}, a_flags = 0, 
>  a_plugin = 0x0, a_deleted_values = {va = 0x0}, a_listtofree = 0x0, 
>  a_next = 0x0, a_deletioncsn = 0x0, a_mr_eq_plugin = 0x0,
>            a_mr_ord_plugin = 0x0, a_mr_sub_plugin = 0x0}
>  #5  0x00002aaaaab33974 in slapi_mods_add_ldapmod 
>  (smods=0x7fffffff9ee0, mod=0xacc100) at ldap/servers/slapd/modutil.c:270
>  No locals.
>  #6  0x00002aaaaab33aa2 in slapi_mods_add_modbvps 
>  (smods=0x7fffffff9ee0, modtype=130, type=0x2aaab1af998c "entryusn", 
>  bvps=0x7fffffff9ed0) at ldap/servers/slapd/modutil.c:309
>          mod = 0xacc100
>  #7  0x00002aaab1af84f4 in _usn_mod_next_usn (mods=0x7fffffff9f30, 
>  be=0x909900) at ldap/servers/plugins/usn/usn.c:378
>          smods = {mods = 0xadbd90, num_elements = 4, num_mods = 3, 
>  iterator = 0, free_mods = 0}
>          bvals = {0x7fffffff9ec0, 0x0}
>          usn_berval = {bv_len = 1, bv_val = 0x7fffffff9e80 "0"}
>          counter_buf = 
>
> "0\000\377\377\377\177\000\000f0\264\252\252*\000\000\000\237\377\377\377\177\000\000\300\001\000\000\001\000\000\000
>
>
> \266\254\000\000\000\000\000\360\343\377\377\377\177\000\000\000\237\377\377\303\001\000\000\300\341|\000\000\000\000"
>  #8  0x00002aaab1af8773 in usn_bepreop_modify (pb=0x7fffffffe3f0) at 
>  ldap/servers/plugins/usn/usn.c:478
>          mods = 0xadbd90
>          be = 0x909900
>          rc = 0
>  #9  0x00002aaaaab41194 in plugin_call_func (list=0x7ce1c0, 
>  operation=451, pb=0x7fffffffe3f0, call_one=0) at 
>  ldap/servers/slapd/plugin.c:1424
>          n = 0x7cbfb0 "USN bepreoperation plugin"
>          func = 0x2aaab1af86f0 <usn_bepreop_modify>
>          rc = 0
>          return_value = 0
>          count = 1
>  #10 0x00002aaaaab41075 in plugin_call_list (list=0x7a5660, 
>  operation=451, pb=0x7fffffffe3f0) at ldap/servers/slapd/plugin.c:1386
>  No locals.
>  #11 0x00002aaaaab3f586 in plugin_call_plugins (pb=0x7fffffffe3f0, 
>  whichfunction=451) at ldap/servers/slapd/plugin.c:379
>          p = 0x792340
>          plugin_list_number = 3
>          rc = 0
>          do_op = 1
>  #12 0x00002aaaafab9b73 in ldbm_back_modify (pb=0x7fffffffe3f0) at 
>  ldap/servers/slapd/back-ldbm/ldbm_modify.c:300
>          be = 0x909900
>          inst = 0x9069c0
>          li = 0x793140
>          e = 0x7678d0
>          ec = 0xb11470
>          postentry = 0x0
>          mods = 0xadbd90
>          smods = {mods = 0x0, num_elements = 0, num_mods = 0, iterator 
>  = 0, free_mods = 0}
>          txn = {back_txn_txn = 0x0}
>          parent_txn = 0x0
>          retval = -1
>          msg = 0xd700acf4c0 <Address 0xd700acf4c0 out of bounds>
>  ---Type <return> to continue, or q <return> to quit---
>          errbuf = 0x0
>          retry_count = 0
>          disk_full = 0
>          ldap_result_code = 0
>          ldap_result_message = 0x0
>          rc = 0
>          operation = 0xad7a00
>          dblock_acquired = 1
>          addr = 0xad7ac8
>          change_entry = 0
>          ec_in_cache = 0
>          is_fixup_operation = 0
>          is_ruv = 0
>          opcsn = 0x0
>          i = 0
>  #13 0x00002aaaaab312b4 in op_shared_modify (pb=0x7fffffffe3f0, 
>  pw_change=0, old_pw=0x0) at ldap/servers/slapd/modify.c:834
>          rc = -1
>          be = 0x909900
>          pse = 0x2aaaaaafcc7d
>          referral = 0x0
>          ecopy = 0x0
>          e = 0x0
>          ebuf = 
>
> "\300\302\377\377\377\177\000\000L:\257\252\252*\000\000\320zz\000\000\000\000\000\000\303\377\377\377\177\000\000\340\345\377\377\377\177\000\000*+\264\252\252*\000\000\000\000\000\000\000\000\000\000\300FB",
>
>  '\000' <repeats 13 times>"\220, 
>  \263v\000\000\000\000\000\016\000\000\000\000\000\000\000\022\252t", 
>  '\000' <repeats 13 times>, 
>  "$\220\000\235\001\000\000\000p\257Я\252*\000\000\220*y", '\000' 
>  <repeats 13 times>"\377, \377\377\377", '\000' <repeats 12
> times>, 
>  "(8\357\235\070", '\000' <repeats 11 times>"\360, 
>
> b\220\000\000\000\000\000\020\304\377\377\377\177\000\000\340\310\377\377\377\177\000\000\000`\020\022r*\000\000U\315\000\235\070\000\000\000\005",
>
>  '\000' <repeats 31 times>, 
>
> "p\257Я\252*\000\000\300\310\377\377\377\177\000\000\260\006\221\000\000\000\000\000\342(\001\235\070\000\000\000\330\226د\252*\000\000\260\006\221",
>
>  '\000' <repeats 13 times>, 
>  "\020\304\377\377\377\177\000\000\360b\220\000\000\000\000\000\300"...
>          dn = 0x90e980 "o=netscaperoot"
>          sdn = {flag = 4 '\004', dn = 0x90e980 "o=netscaperoot", ndn = 
>  0x766af0 "o=netscaperoot", ndn_len = 14}
>          mods = 0x86d920
>          pw_mod = 0x7fffffffe310
>          tmpmods = 0x86d920
>          smods = {mods = 0x0, num_elements = 0, num_mods = 0, iterator 
>  = 0, free_mods = 0}
>          unhashed_pw_smod = {mods = 0x0, num_elements = 0, num_mods = 
>  0, iterator = 0, free_mods = 1}
>          repl_op = 0
>          internal_op = 32
>          lastmod = 1
>          skip_modified_attrs = 0
>          unhashed_pw_attr = 0x0
>          operation = 0xad7a00
>          errorbuf = 
>
> "\000\372N\261\252*\000\000Ȣ\377\377\016\000\000\000\000\000\000\000\001\000\000\000\360\r}\000\000\000\000\000\234dž\000\000\000\000\000\026\264I\260\377\377\377\377`\242\377\377\377\177\000\000\325\067\267\252\252*\000\000Ȣ\377\377\377\177\000\000Ȣ\377\377\000\000\000\000p\242\377\377\001\000\000\000\b\275\255\000\000\000\000\000\340\242\377\377\377\177\000\000p\274\255\000\000\000\000\000\000\000\000\000\377\177",
>
>  '\000' <repeats 18 times>, 
>
> "k'G\235\070\000\000\000\000\000\000\000e\000\000\000n\000\000\000\377\377\377\377\000\243\377\377\377\177\000\000e\324N\261\252*\000\000\060\251\254\000\000\000\000\000\b\275\255\000\000\000\000\000@\243\377\377\377\177\000\000p\274\255\000\000\000\000\000\320\350\377\377\377\177\000\000\b\275\255\000\000\000\000\000`\243\377\377\377\177\000\000p\274\255\000\000\000\000\000\320\350\377\377\377\177",
>
>  '\000' <repeats 18 times>, 
>
> "k'G\235\070\000\000\000P\215y\000\b\002\000\000\b\275\255\000\000\000\000\000\000\000\000\000\001\000\000\000L:\257\252\252*\000\000\060\340t"...
>          err = 0
>          lc_mod = 0x0
>          p = 0x0
>          numattr = 11334848
>          i = 0
>  #14 0x00002aaaaab3090f in modify_internal_pb (pb=0x7fffffffe3f0) at 
>  ldap/servers/slapd/modify.c:554
>  ---Type <return> to continue, or q <return> to quit---
>          controls = 0x0
>          pwpolicy_ctrl = 0
>          op = 0xad7a00
>          opresult = 0
>          normalized_mods = 0x86d920
>          mods = 0x7fffffffe670
>          mod = 0x86d928
>          smods = {mods = 0x100acf4c0, num_elements = -7184, num_mods = 
>  32767, iterator = -7184, free_mods = 32767}
>          pw_change = 0
>          old_pw = 0x0
>  #15 0x00002aaaaab305f9 in slapi_modify_internal_pb (pb=0x7fffffffe3f0) 
>  at ldap/servers/slapd/modify.c:443
>  No locals.
>  #16 0x00002aaaaab4b917 in pw_mod_allowchange_aci 
>  (pw_prohibit_change=0) at ldap/servers/slapd/pw.c:1297
>          pb = {pb_backend = 0x909900, pb_conn = 0x0, pb_op = 0xad7a00, 
>  pb_plugin = 0x7ce1c0, pb_opreturn = 0, pb_object = 0x0, pb_destroy_fn 
>  = 0, pb_requestor_isroot = 1, pb_config_fname = 0x0,
>            pb_config_lineno = 0, pb_config_argc = 0, pb_config_argv = 
>  0x0, pb_target_entry = 0x0, pb_existing_dn_entry = 0xadc210, 
>  pb_existing_uniqueid_entry = 0x0, pb_parent_entry = 0x0,
>            pb_newparent_entry = 0x0, pb_pre_op_entry = 0xadbed0, 
>  pb_post_op_entry = 0x0, pb_seq_type = 0, pb_seq_attrname = 0x0, 
>  pb_seq_val = 0x0, pb_ldif_file = 0x0, pb_removedupvals = 0,
>            pb_db2index_attrs = 0x0, pb_ldif2db_noattrindexes = 0, 
>  pb_ldif_printkey = 0, pb_instance_name = 0x0, pb_task = 0x0, 
>  pb_task_flags = 0, pb_mr_filter_match_fn = 0, pb_mr_filter_index_fn = 0,
>            pb_mr_filter_reset_fn = 0, pb_mr_index_fn = 0, pb_mr_oid = 
>  0x0, pb_mr_type = 0x0, pb_mr_value = 0x0, pb_mr_values = 0x0, 
>  pb_mr_keys = 0x0, pb_mr_filter_reusable = 0,
>            pb_mr_query_operator = 0, pb_mr_usage = 0, 
>  pb_pwd_storage_scheme_user_passwd = 0x0, 
>  pb_pwd_storage_scheme_db_passwd = 0x0, pb_managedsait = 0, 
>  pb_internal_op_result = 0,
>            pb_plugin_internal_search_op_entries = 0x0, 
>  pb_plugin_internal_search_op_referrals = 0x0, pb_plugin_identity = 
>  0xacf4c0, pb_parent_txn = 0x0, pb_txn = 0x0, pb_dbsize = 0,
>            pb_ldif_files = 0x0, pb_ldif_include = 0x0, pb_ldif_exclude 
>  = 0x0, pb_ldif_dump_replica = 0, pb_ldif_dump_uniqueid = 0, 
>  pb_ldif_generate_uniqueid = 0, pb_ldif_namespaceid = 0x0,
>            pb_ldif_encrypt = 0, pb_operation_notes = 0, pb_slapd_argc = 
>  0, pb_slapd_argv = 0x0, pb_slapd_configdir = 0x0, pb_ctrls_arg = 0x0, 
>  pb_dse_dont_add_write = 0, pb_dse_add_merge = 0,
>            pb_dse_dont_check_dups = 0, pb_dse_is_primary_file = 0, 
>  pb_schema_flags = 0, pb_result_code = 0, pb_result_text = 0x0, 
>  pb_result_matched = 0x0, pb_nentries = 0, urls = 0x0,
>            pb_import_entry = 0x0, pb_import_state = 0, 
>  pb_destroy_content = 0, pb_dse_reapply_mods = 0, 
>  pb_urp_naming_collision_dn = 0x0, pb_urp_tombstone_uniqueid = 0x0, 
>  pb_server_running = 0,
>            pb_backend_count = 1, pb_pwpolicy_ctrl = 0, pb_vattr_context 
>  = 0x0, pb_substrlens = 0x0, pb_plugin_enabled = 0, pb_search_ctrls = 
>  0x0, pb_mr_index_sv_fn = 0}
>          rc = 32
>          base = 0x90feb0
>          values_mod = {0x2aaaaab8f898 "(targetattr = \"userPassword\") 
>  ( version 3.0; acl \"disallow_pw_change_aci\"; deny (write ) userdn = 
>  \"ldap:///self\";)", 0x0}
>          mod = {mod_op = 1, mod_type = 0x2aaaaab8f88d "aci", mod_vals = 
>  {modv_strvals = 0x7fffffffe6a0, modv_bvals = 0x7fffffffe6a0}}
>          mods = {0x7fffffffe680, 0x0}
>          be = 0x909900
>          cookie = 0xacf830 "\004"
>  #17 0x0000000000427195 in pw_init () at ldap/servers/slapd/pw_mgmt.c:301
>          slapdFrontendConfig = 0x2aaaaadbcc00
>  #18 0x000000000041e514 in main (argc=7, argv=0x7fffffffe8d8) at 
>  ldap/servers/slapd/main.c:1218
>          return_value = 0
>          slapdFrontendConfig = 0x2aaaaadbcc00
>          ports_info = {n_port = 389, s_port = 636, n_listenaddr = 
>  0x753590, s_listenaddr = 0x74f9a0, n_socket = 0x751610, i_listenaddr = 
>  0x0, i_port = 0, i_socket = 0x0, s_socket = 0x0}
>
>
>
>