[Varnish] #142: Varnishd core dumps because of segmentation violation

[Varnish]

#142: Varnishd core dumps because of segmentation violation
----------------------+-----------------------------------------------------
 Reporter:  anders    |       Owner:  phk                      
     Type:  defect    |      Status:  new                      
 Priority:  high      |   Milestone:                           
Component:  varnishd  |     Version:  1.1                      
 Severity:  major     |    Keywords:  varnishd core dump sig 11
----------------------+-----------------------------------------------------
 I am running Varnish 1.1 (from ports, with patches by des committed july
 25th) in FreeBSD 6.2-RELEASE/amd64, on Intel hardware. I am using varnishd
 with a broad (20 GB sm_balloc) data set here, and that my graphs shows
 upto 1.43 million hashes/objects.

 Now and then, varnishd dies with sig11:

 Aug  6 04:46:27 cache10 kernel: pid 99461 (varnishd), uid 0: exited on
 signal 11 (core dumped)

 Backtrace, with what phk asked for so far:

 root at cache10:~# gdb -c
 /usr/local/varnish/cache10.finn.no/varnishd_2007-08-06_10-
 -01-44.core -s /usr/local/sbin/varnishd
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you
 are
 welcome to change it and/or distribute copies of it under certain
 conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for
 details.
 This GDB was configured as "amd64-marcel-freebsd"...
 Core was generated by `varnishd'.
 Program terminated with signal 11, Segmentation fault.
 #0  0x0000000800a4e550 in ?? ()
 (gdb) bt
 #0  0x0000000800a4e550 in ?? ()
 #1  0x00000030013a590e in ?? ()
 #2  0x00007ffff2390ad0 in ?? ()
 #3  0x0000000001b4d008 in ?? ()
 #4  0x00007ffff2390a00 in ?? ()
 #5  0x0000000000416cc8 in VCL_recv_method (sp=0x1b4d008) at
 vcl_returns.h:37
 Previous frame identical to this frame (corrupt stack?)
 (gdb) info threads
   13 process 100145  0x0000000800a1a63c in ?? ()
   12 process 100045  0x0000000800a4b7fc in ?? ()
   11 process 100069  0x0000000800a4b7fc in ?? ()
   10 process 100079  0x0000000800a4b7fc in ?? ()
   9 process 100110  0x0000000800a2b0fc in ?? ()
   8 process 100111  0x0000000800a1a63c in ?? ()
   7 process 100130  0x0000000800a64f2c in ?? ()
   6 process 100178  0x0000000800a64f2c in ?? ()
   5 process 100133  0x0000000800a64f2c in ?? ()
   4 process 100159  0x0000000800a64f2c in ?? ()
   3 process 100161  0x0000000800a64f2c in ?? ()
   2 process 100115  0x0000000800a64f2c in ?? ()
 * 1 process 100127  0x0000000800a4e550 in ?? ()
 (gdb) thread 1
 [Switching to thread 1 (process 100127)]#0  0x0000000800a4e550 in ?? ()
 (gdb) bt
 #0  0x0000000800a4e550 in ?? ()
 #1  0x00000030013a590e in ?? ()
 #2  0x00007ffff2390ad0 in ?? ()
 #3  0x0000000001b4d008 in ?? ()
 #4  0x00007ffff2390a00 in ?? ()
 #5  0x0000000000416cc8 in VCL_recv_method (sp=0x1b4d008) at
 vcl_returns.h:37
 Previous frame identical to this frame (corrupt stack?)
 (gdb) thread 9
 [Switching to thread 9 (process 100110)]#0  0x0000000800a2b0fc in ?? ()
 (gdb) bt
 #0  0x0000000800a2b0fc in ?? ()
 #1  0x0000000000408163 in vca_kqueue_main (arg=0x0)
     at cache_acceptor_kqueue.c:143
 #2  0x000000080088655b in ?? ()
 #3  0x0000000000000000 in ?? ()
 #4  0x0000000000000000 in ?? ()
 #5  0x000000000053be00 in ?? ()
 #6  0x0000000000000000 in ?? ()
 #7  0x000000000053b000 in ?? ()
 #8  0x0000000000000000 in ?? ()
 Cannot access memory at address 0x7fffff5fc000

 My VCL:

 backend default {
              set backend.host = "192.168.0.3";
              set backend.port = "80";
         }
 acl purge {
         "192.168.0.4"/32;
 }
 sub vcl_recv {
         if ((req.http.host ~ "^(cache.finn.no|finn.no|www.finn.no)$") ||
 (req.http.host == "banner.finn.no" && req.url ~
 "^/(jsp2|finn/gojsp|daily|board|auximg/papirfly|finn/cacheable|crossdomain.xml)"))
 {
                 if (req.request == "GET" || req.request == "HEAD") {
                         lookup;
                 } elsif (req.request == "PURGE") {
                         if (!client.ip ~ purge) {
                                 error 405 "Not allowed.";
                         }
                         lookup;
                 } else {
                         pipe;
                 }
         } else {
                 error 403 "Access denied. Contact cacheadmin at finn.no if
 you have problems.";
         }
 }
 sub vcl_miss {
         if (req.request == "PURGE") {
                 error 404 "Not in cache.";
         } else {
                 fetch;
         }
 }
 sub vcl_hit {
         if (req.request == "PURGE") {
                 set obj.ttl = 0s;
                 error 200 "Purged.";
         } else {
                 deliver;
         }
 }
 sub vcl_fetch {
         if (obj.ttl < 86400s) {
                 set obj.ttl = 604800s;
         }
         if (obj.http.Cookie) {
                 remove obj.http.Cookie;
         }
         if (obj.http.Set-Cookie) {
                 remove obj.http.Set-Cookie;
         }
         insert;
 }

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/142>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator