If ServantLocator::preinvoke() throws Exceptions, postinvoke() must not be 
called according to the COARBA-2.6 spec, $11.3.6.

With TAO-1.5, postinvoke is called in this case, with parameter operation set 
to 0. Even worse IMHO (although the spec is not very clear about this), if 
preinvoke() returns 0, meaning no servant was found,  postinvoke() is called as 
well.

My investigation revealed the following:

TAO_Object_Adapter::dispatch_servant() creates a Servant_Upcall instance and 
calls Servant_Upcall::prepare_for_upcall()
This method finally calls 
RequestProcessingStrategyServantLocator::locate_servant()
, where the follwing happens in this order:
 - Servant_Upcall::state (OBJECT_ADAPTER_LOCK_RELEASED);
 - ServantLocator::preinvoke()
 - Servant_Upcall::operation(operation)

if ServantLocator::preinvoke() throws an Execption, the destructor of 
Servant_Upcall is called when the stack is unwound, and this destructor calls
Servant_Upcall::upcall_cleanup().

This method contains a switch on the member state_.

As state_ has been set to OBJECT_ADAPTER_LOCK_RELEASED (see above),
ServantLocator::postinvoke() is now called with NULL operation.

The case when ServantLocator::preinvoke() returns NULL is very similar...

My quick hack to fix this problem: 
In Servant_Upcall::upcall_cleanup(), call ServantLocator::postinvoke() only if 
operation_ and servant_ are both not NULL.

--------------------- snip snip -----------------------

diff -r -u PortableServer.orig/Servant_Upcall.cpp 
PortableServer/Servant_Upcall.cpp
--- PortableServer.orig/Servant_Upcall.cpp	2006-02-13 04:23:52.000000000 
+0100
+++ PortableServer/Servant_Upcall.cpp	2006-04-21 11:00:18.480507500 +0200
@@ -288,7 +288,10 @@
           // Cleanup servant locator related state.  Note that because
           // this operation does not change any Object Adapter related
           // state, it is ok to call it outside the lock.
-          this->post_invoke_servant_cleanup ();
+          if ( this->operation() && this->servant() )
+          {
+            this->post_invoke_servant_cleanup ();
+          }
 
           // Since the object adapter lock was released, we must acquire
           // it.

--------------------- snip snip -----------------------