Netscape Directory Server core dumps

Question

Hi,
I have NDS version 5.1 running on Solaris 10. My software is querying the LDAP at around 10-15 requests/sec. The LDAP memory is runnig at around 50M. (I have around 900 entries in the LDAP tree). At some random instance of time, the LDAP memory shoots up from 50M to 3.2 GB when it goes out of memory and then restarts. My software has a LDAP connection pool to it and one of the threads goes OutOfmemory after the error.
The LDAP does a core dump during the process. From the analysis of the core dump, it seems that it is trying to access some memory which is not part of the LDAP process map.
bash-3.00$ mdb core
mdb: failed to initialize /lib/libc_db.so.1: libthread_db call failed unexpectedly
mdb: warning: debugger will only be able to examine raw LWPs
Loading modules: [ libc.so.1 libuutil.so.1 ld.so.1 ]
::stacklibc_psr.so.1`memcpy+0x234(87c00038, 6b646174, 74776f6a, 8, 6b646174, 0)
libslapd.so`slapi_dup_control+0x94(53db678, 2ce38f8, fc93ff2c, 0, 2ce38f8,2ce38f8)
0x2f3b4(7e55c80, 2f30150, 2ce6bb8, 4c7fde8, 2f30150, ffffffff)
0xfef17d18(2f60164, fc940000, 0, 0, fef17c74, 1)
0xff2c8a20(0, 0, 0, 0, 0, 0)
::statusdebugging core file of ns-slapd (32-bit) from XXXXXX
initial argv:XXXXXXXX
threading model: multi-threaded using native lwps
status: process terminated by SIGSEGV (Segmentation Fault)
>
The failure is at address 0xfee8063c.
0xfee8063c::dislibc_psr.so.1`memcpy+0x20c: 0x2480012
libc_psr.so.1`memcpy+0x210: nop
libc_psr.so.1`memcpy+0x214: ldub [%i1], %o2
libc_psr.so.1`memcpy+0x218: stb %o2, [%i0]
libc_psr.so.1`memcpy+0x21c: add %i1, 1, %i1
libc_psr.so.1`memcpy+0x220: subcc %i3, 1, %i3
libc_psr.so.1`memcpy+0x224: 0x184ffffc
libc_psr.so.1`memcpy+0x228: add %i0, 1, %i0
libc_psr.so.1`memcpy+0x22c: ba +0x60 <libc_psr.so.1`memcpy+0x28c>
libc_psr.so.1`memcpy+0x230: nop
libc_psr.so.1`memcpy+0x234: ld [%i1], %o2
libc_psr.so.1`memcpy+0x238: st %o2, [%i0]
libc_psr.so.1`memcpy+0x23c: add %i1, 4, %i1
libc_psr.so.1`memcpy+0x240: subcc %i3, 4, %i3
// Looking for register i1
::regs%g0 = 0x00000000 %l0 = 0x87c00038
%g1 = 0xff37c840 libsh.so`_shi_sysAllocPool+0xd4 %l1 = 0xff16c2bc
%g2 = 0x00000000 %l2 = 0x07970778
%g3 = 0x0000036c %l3 = 0x05410000
%g4 = 0x00000001 %l4 = 0xff165a34
%g5 = 0x87c00038 %l5 = 0x00000000
%g6 = 0x00000000 %l6 = 0x01000000
%g7 = 0xfd06ca00 %l7 = 0x00000004
%o0 = 0x87c00038 %i0 = 0x87c00038
%o1 = 0x74776f72 %i1 = 0x6b646174
%o2 = 0xefe4617c %i2 = 0x74776f6a
%o3 = 0x00000002 %i3 = 0x00000008
%o4 = 0x00000002 %i4 = 0x6b646174
%o5 = 0x053d9c28 %i5 = 0x00000000
%o6 = 0xfc93fe00 %i6 = 0xfc93fe60
%o7 = 0xff0c0c44 libslapd.so`slapi_ch_malloc+0x64 %i7 = 0xff0e8e78
libslapd.so`slapi_dup_control+0x94
%psr = 0xfe401004 impl=0xf ver=0xe icc=nZvc
ec=0 ef=4096 pil=0 s=0 ps=0 et=0 cwp=0x4
%y = 0x00000002
%pc = 0xfee8063c libc_psr.so.1`memcpy+0x234
%npc = 0xfee80640 libc_psr.so.1`memcpy+0x238
%sp = 0xfc93fe00
0x6b646174::dismdb: failed to read instruction at 6b646174: no mapping for address
>
The register "i1"'s content was memory address 0x6b646174 which is not part of process address space.
Has anyone experienced similar problem before? I was trying to find the same in the forum but without any luck. This problem is happening quiet regularly.

Answer 1

Seeems like content of register i1 got missed.. here is the content..
%l2 = 0x07970778
%l3 = 0x05410000
%l4 = 0xff165a34
%l5 = 0x00000000
%l6 = 0x01000000
%l7 = 0x00000004
%i0 = 0x87c00038
%i1 = 0x6b646174
%i2 = 0x74776f6a
%i3 = 0x00000008
%i4 = 0x6b646174
%i5 = 0x00000000
%i6 = 0xfc93fe60