I am running 389-ds-base-1.2.9.9-1.el5 on RHEL 5.7

Name        : 389-ds-base                  Relocations: (not relocatable)
Version     : 1.2.9.9                           Vendor: Fedora Project
Release     : 1.el5                         Build Date: Fri 02 Sep 2011
06:41:29 AM EST
Install Date: Wed 21 Sep 2011 07:16:41 PM EST      Build Host:
x86-03.phx2.fedoraproject.org
Group       : System Environment/Daemons    Source RPM:
389-ds-base-1.2.9.9-1.el5.src.rpm
Size        : 5005087                          License: GPLv2 with exceptions
Signature   : DSA/SHA1, Fri 02 Sep 2011 10:01:24 AM EST, Key ID
119cc036217521f6
Packager    : Fedora Project
URL         : http://port389.org/
Summary     : 389 Directory Server (base)
Description :
389 Directory Server is an LDAPv3 compliant server.  The base package includes
the LDAP server and command line utilities for server administration.

One of our servers has been causes repeated directory server crashes (we have
powered it off for now). See stack trace from the core dump below:


#0  0x0000003935830265 in raise () from /lib64/libc.so.6
#1  0x0000003935831d10 in abort () from /lib64/libc.so.6
#2  0x000000393586a99b in __libc_message () from /lib64/libc.so.6
#3  0x000000393587245f in _int_free () from /lib64/libc.so.6
#4  0x00000039358728bb in free () from /lib64/libc.so.6
#5  0x00002b65777757b6 in slapi_ch_free (ptr=0x597e8500) at
ldap/servers/slapd/ch_malloc.c:363
#6  0x00002b657ba84ec1 in ldbm_back_next_search_entry_ext (pb=0xf4a9b70,
use_extension=0) at ldap/servers/slapd/back-ldbm/ldbm_search.c:1238
#7  0x00002b65777aeb98 in iterate (pb=0xf4a9b70, be=0xe823130, send_result=1,
pnentries=0x597ee6a4, pagesize=1000, pr_statp=0x597ee698)
    at ldap/servers/slapd/opshared.c:1153
#8  0x00002b65777af0e2 in send_results_ext (pb=0xf4a9b70, send_result=1,
nentries=0x597ee6a4, pagesize=1000, pr_stat=0x597ee698)
    at ldap/servers/slapd/opshared.c:1537
#9  0x00002b65777afab0 in op_shared_search (pb=0xf4a9b70, send_result=1) at
ldap/servers/slapd/opshared.c:599
#10 0x000000000042450f in do_search (pb=0xf4a9b70) at
ldap/servers/slapd/search.c:393
#11 0x000000000041352c in connection_threadmain () at
ldap/servers/slapd/connection.c:611
#12 0x00000039398284ad in PR_JoinThread () from /usr/lib64/libnspr4.so
#13 0x000000393600673d in start_thread () from /lib64/libpthread.so.0

(gdb)  print *pb
$1 = {pb_backend = 0xe823130, pb_conn = 0x2aaaaaab1fa0, pb_op = 0xf48c7e0,
pb_plugin = 0xe6fb1a0, pb_opreturn = 0, pb_object = 0x0, pb_destroy_fn = 0,
  pb_requestor_isroot = 0, pb_config_fname = 0x0, pb_config_lineno = 0,
pb_config_argc = 0, pb_config_argv = 0x0, pb_target_entry = 0x0,
  pb_existing_dn_entry = 0x0, pb_existing_uniqueid_entry = 0x0, pb_parent_entry
= 0x0, pb_newparent_entry = 0x0, pb_pre_op_entry = 0x2aaab066bfc0,
  pb_post_op_entry = 0x0, pb_seq_type = 0, pb_seq_attrname = 0x0, pb_seq_val =
0x0, pb_ldif_file = 0x0, pb_removedupvals = 0, pb_db2index_attrs = 0x0,
  pb_ldif2db_noattrindexes = 0, pb_ldif_printkey = 0, pb_instance_name = 0x0,
pb_task = 0x0, pb_task_flags = 0, pb_mr_filter_match_fn = 0,
  pb_mr_filter_index_fn = 0, pb_mr_filter_reset_fn = 0, pb_mr_index_fn = 0,
pb_mr_oid = 0x0, pb_mr_type = 0x0, pb_mr_value = 0x0, pb_mr_values = 0x0,
  pb_mr_keys = 0x0, pb_mr_filter_reusable = 0, pb_mr_query_operator = 0,
pb_mr_usage = 0, pb_pwd_storage_scheme_user_passwd = 0x0,
  pb_pwd_storage_scheme_db_passwd = 0x0, pb_managedsait = 0,
pb_internal_op_result = 0, pb_plugin_internal_search_op_entries = 0x0,
  pb_plugin_internal_search_op_referrals = 0x0, pb_plugin_identity = 0x0,
pb_plugin_config_area = 0x0, pb_parent_txn = 0x0, pb_txn = 0x0,
  pb_txn_ruv_mods_fn = 0, pb_dbsize = 0, pb_ldif_files = 0x0, pb_ldif_include =
0x0, pb_ldif_exclude = 0x0, pb_ldif_dump_replica = 0,
  pb_ldif_dump_uniqueid = 0, pb_ldif_generate_uniqueid = 0, pb_ldif_namespaceid
= 0x0, pb_ldif_encrypt = 0, pb_operation_notes = 2, pb_slapd_argc = 0,
  pb_slapd_argv = 0x0, pb_slapd_configdir = 0x0, pb_ctrls_arg = 0x0,
pb_dse_dont_add_write = 0, pb_dse_add_merge = 0, pb_dse_dont_check_dups = 0,
  pb_dse_is_primary_file = 0, pb_schema_flags = 0, pb_result_code = 0,
pb_result_text = 0x0, pb_result_matched = 0x0, pb_nentries = 0, urls = 0x0,
  pb_import_entry = 0x0, pb_import_state = 0, pb_destroy_content = 0,
pb_dse_reapply_mods = 0, pb_urp_naming_collision_dn = 0x0,
  pb_urp_tombstone_uniqueid = 0x0, pb_server_running = 0, pb_backend_count = 0,
pb_pwpolicy_ctrl = 0, pb_vattr_context = 0x0, pb_substrlens = 0x0,
  pb_plugin_enabled = 0, pb_search_ctrls = 0x0, pb_mr_index_sv_fn = 0}

I can send the core file(s) through but I would like them to be kept
confidential.

Attached is the output from bt full and thread apply all bt

Regards,
Daniel