Core dump with Language Negotiation?!?

[Martin Kraemer <ma...@hyperreal.org>]

On my (almost) current  apache-1.3.5-dev, I just experienced a core dump
in the following situation:

I have a subdirectory with just one file called index.php3.fr - The 
Options enable +MultiViews, +Indexes and DirectoryIndex is set to "index".

> ls ~/WWW/sub/
index.php3.fr

Now when I request this file with Accept-Language = fr, everythings's okay:
> echo HEAD http://192.168.123.1/~martin/sub/ HTTP/1.0\nAccept-Language: fr\n | netcat 192.168.123.1 80
HTTP/1.1 200 OK
Date: Sun, 17 Jan 1999 10:40:58 GMT
Server: Apache/1.3.5-dev (Unix) PHP/3.0.7-dev
Last-Modified: Fri, 15 Jan 1999 22:04:53 GMT
ETag: "2d25-11-369fbb85;369fb9e5"
Connection: close
Content-Type: text/html
Content-Language: fr

But when I use any other Accept-Language, then the connection is terminated,
> echo HEAD http://192.168.123.1/~martin/sub/ HTTP/1.0\nAccept-Language: de\n | netcat 192.168.123.1 80 

and in the error_log I see:

httpd: [Sun Jan 17 11:35:49 1999] [error] [client 192.168.123.1] no acceptable variant: /home/martin/WWW/sub/index
overlay_tables: base's pool is not an ancestor of p
httpd: [Sun Jan 17 11:36:10 1999] [notice] child pid 367 exit signal IOT trap/Abort (6)


Using gdb, and running until the signal is raised, I get this traceback:
Program received signal SIGABRT, Aborted.
0x4004c665 in __kill ()
(gdb) where
#0  0x4004c665 in __kill ()
#1  0x4007233d in raise (sig=135887924)
#2  0x80a89f8 in handle_dir (r=0x8197c5c) at mod_dir.c:183
#3  0x80c2f23 in ap_invoke_handler (r=0x8197c5c) at http_config.c:505
#4  0x80d85b9 in process_request_internal (r=0x8197c5c) at http_request.c:1201
#5  0x80d861c in ap_process_request (r=0x8197c5c) at http_request.c:1217
#6  0x80cf2e9 in child_main (child_num_arg=1) at http_main.c:3852
#7  0x80cf55c in make_child (s=0x8162d94, slot=1, now=916569275) at http_main.c:3977
#8  0x80cf91a in perform_idle_server_maintenance () at http_main.c:4141
#9  0x80cfe95 in standalone_main (argc=3, argv=0xbffffdd4) at http_main.c:4372
#10 0x80d05c3 in main (argc=3, argv=0xbffffdd4) at http_main.c:4592
#11 0x805986e in _start ()

My question is now: where in handle_dir() is the call to overlay_tables()? 
(Or any *_table_* call for that matter?)

I've tried this with ".../index.html.fr" as well, so this is not a PHP3
problem. Is it possibly triggered because I have no other Accept-*
header in the request (esp. no Accept-Type)?

	Martin
-- 
Martin Kraemer                                         <Ma...@apache.org>