[Pacemaker] crmd Segmentation fault at pacemaker 1.0.12

[TAKATSUKA Haruka]

Hello,  pacemaker hackers

I report crmd's crash at pacemaker 1.0.12 .

We are going to upgrade pacemaker 1.0.12 to 1.0.13 .
But I was not able to find a fix for this problem from ChangeLog.
tengine.c:do_te_invoke() is not seem to care for transition_graph==NULL
case in even 1.0.x head code.

regards,
Haruka Takatsuka.
-----

[log]
Nov 07 00:00:08 srv1 crmd: [21843]: ERROR: crm_abort: abort_transition_graph: Triggered assert at te_utils.c:259 : transition_graph != NULL
Nov 07 00:00:08 srv1 heartbeat: [21823]: WARN: Managed /usr/lib64/heartbeat/crmd process 21843 killed by signal 11 [SIGSEGV - Segmentation violation].
Nov 07 00:00:08 srv1 heartbeat: [21823]: ERROR: Managed /usr/lib64/heartbeat/crmd process 21843 dumped core
Nov 07 00:00:08 srv1 heartbeat: [21823]: EMERG: Rebooting system.  Reason: /usr/lib64/heartbeat/crmd

[gdb]
$ gdb -c core.21843 -s crmd.debug crmd
--(snip)--
Program terminated with signal 11, Segmentation fault.
#0  0x00000000004199c4 in do_te_invoke (action=140737488355328,
    cause=C_FSA_INTERNAL, cur_state=S_POLICY_ENGINE,
    current_input=I_FINALIZED, msg_data=0x1b28e20) at tengine.c:186
186                     if(transition_graph->complete == FALSE) {
--(snip)--
(gdb) bt
#0  0x00000000004199c4 in do_te_invoke (action=140737488355328, cause=
    C_FSA_INTERNAL, cur_state=S_POLICY_ENGINE, current_input=I_FINALIZED,
    msg_data=0x1b28e20) at tengine.c:186
#1  0x0000000000405ca3 in do_fsa_action (fsa_data=0x1b28e20, an_action=
    140737488355328, function=0x419831 <do_te_invoke>) at fsa.c:154
#2  0x0000000000406b22 in s_crmd_fsa_actions (fsa_data=0x1b28e20) at fsa.c:410
#3  0x00000000004061a1 in s_crmd_fsa (cause=C_FSA_INTERNAL) at fsa.c:267
#4  0x000000000041208f in crm_fsa_trigger (user_data=0x0) at callbacks.c:631
#5  0x0000003777a26146 in crm_trigger_dispatch (source=0x1b1b590, callback=
    0x412026 <crm_fsa_trigger>, userdata=0x1b1b590) at mainloop.c:53
#6  0x00000031d8a38f0e in g_main_context_dispatch ()
   from /lib64/libglib-2.0.so.0
#7  0x00000031d8a3c938 in ?? () from /lib64/libglib-2.0.so.0
#8  0x00000031d8a3cd55 in g_main_loop_run () from /lib64/libglib-2.0.so.0
#9  0x00000000004051bb in crmd_init () at main.c:139
#10 0x0000000000405093 in main (argc=1, argv=0x7fff947d1388) at main.c:105
(gdb) list
181
182             if(action & A_TE_CANCEL) {
183                     crm_debug("Cancelling the transition: %s",
184                               transition_graph->complete?"inactive":"active");
185                     abort_transition(INFINITY, tg_restart, "Peer Cancelled", NULL);
186                     if(transition_graph->complete == FALSE) {
187                         crmd_fsa_stall(NULL);
188                     }
189
190             } else if(action & A_TE_HALT) {
(gdb) p transition_graph
$1 = (crm_graph_t *) 0x0