Varnishd crash while receiving some HTTP requests

[Lin Jui-Nan Eric]

Dear All,

I found that varnishd child crashed while receiving the below request:
GET /robot.txt HTTP/1.0 \r\n\r\n\r\n

While the count of "\r\n" is larger than 3, no response will be
generated by varnishd.
If the count of "\r\n" is 2, that's ok.
I use varnishd-1.2 from svn: http://varnish.projects.linpro.no/svn/branches/1.2

The running command is:
varnishd -a "[MYIP]:10000" -f /usr/local/etc/varnish/image.vcl -h
classic,1048583 -n /gstripe0/varnish0 -s
"file,/gstripe0/varnish0/varnish-cache.mmap,100G" -t 604800 -w 32,1024
-d

The error message is:

Child said (2, 65305): <<Assert error in http_dissect_hdrs(),
cache_http.c line 366:
 Condition(p <= t.e) not true.
 errno = 0 (Unknown error: 0)
>>
Cache child died pid=65305 status=0x6
Clean child
Child cleaned
start child pid 65306
Child said (2, 65306): <<Child starts
managed to mmap 107374182400 bytes of 107374182400
Ready
CLI ready
>>