Weird crash in seq record

[Dirk Zimoch <dirk.zimoch@psi.ch>]

Hi folks,

Sometimes I get a strange segmentation fault in the cbLow thread in 
seqRecord function processCallback(). My EPICS base version is 3.14.12.7.
#0  processCallback (arg=<optimized out>) at ../seqRecord.c:373

The line is:

  dbGetLink(&(pcb->plinks[pcb->index]->dol), DBR_DOUBLE,
	&(pcb->plinks[pcb->index]->dov),0,0);

(gdb) print *pcb
$2 = {callback = {callback = 0xff97a24 <processCallback>, priority = 0, 
user = 0xaffbdbe0, timer = 0x0}, pseqRecord = 0xb121a958, plinks = 
{0xb121aae8, 0xb121ab38,
    0xb121ab88, 0xb121abd8, 0xb121ac28, 0xb121ac78, 0xb121acc8, 
0xb121ad18, 0x0, 0x0, 0x0}, index = 8}
As you can see, index = 8, but plinks has only 8 valid entries. (This is 
consistent with the record having 8 links.) Thus pcb->plinks[pcb->index] 
== NULL, causing the crash.
I cannot see how this could possibly happen.

processCallback() is triggered by processNextLink(), but only if 
pcb->plinks[pcb->index] != NULL.
It looks like something changes pcb->index after callbackRequest() but 
before the callback runs. But the only code that modifies pcb->index is 
the callback function processCallback() itself and the process() 
function. Both while holding the dbScanLock semaphore. Also 
processNextLink is only called while holding the dbScanLock semaphore.
The record looks like this:
record(seq, "$(DEV)$(SYS)$(CH)-CALC-AVG-RMS") {
   field(LNK1, "$(DEV)$(SYS)$(CH)-MIN PP")
   field(LNK2, "$(DEV)$(SYS)$(CH)-MAX PP")
   field(LNK3, "$(DEV)$(SYS)$(CH)-PEAK-PEAK PP")
   field(LNK4, "$(DEV)$(SYS)$(CH)-AVG PP")
   field(LNK5, "$(DEV)$(SYS)$(CH)-RMS PP")
   field(LNK6, "$(DEV)$(SYS)$(CH)-RMS-AVG PP")
   field(LNK7, "$(DEV)$(SYS)$(CH)-AVG2 PP")
   field(LNK8, "$(DEV)$(SYS)$(CH)-AVG-RMS PP")
}

It is FLNK'ed from a record which is scanned "I/O Intr" and which may 
receive very quick "double triggers". So I suspect a race condition but 
I cannot find it.
Any ideas?

Dirk