[Varnish] #167: Varnishd crashes with assert error in RES_WriteObj

[Varnish]

#167: Varnishd crashes with assert error in RES_WriteObj
----------------------+-----------------------------------------------------
 Reporter:  anders    |       Owner:  phk                            
     Type:  defect    |      Status:  new                            
 Priority:  normal    |   Milestone:                                 
Component:  varnishd  |     Version:  trunk                          
 Severity:  normal    |    Keywords:  varnishd core dump RES_WriteObj
----------------------+-----------------------------------------------------
 I am running Varnish trunk (up to date to commit 2096) with vca_act set to
 vca_acceptors[1] to use polling instead of kqueue, due to recent kqueue
 problems discovered in ticket #162.

 After a short time, Varnish crashed:

 {{{
 Child said (2, 25882): <<Assert error in RES_WriteObj(), cache_response.c
 line 184:
   Condition(u == sp->obj->len) not true.
   errno = 32 (Broken pipe)
 }}}

 My VCL:

 {{{
 backend default {
              set backend.host = "192.168.0.3";
              set backend.port = "80";
         }
 acl purge {
         "192.168.0.4"/32;
 }
 sub vcl_recv {
         if ((req.http.host ~ "^(cache.finn.no|finn.no|www.finn.no)$") ||
 (req.http.host == "banner.finn.no" && req.url ~
 "^/(jsp2|finn/gojsp|daily|board|auximg/papirfly|finn/cacheable|crossdomain.xml)"))
 {
                 if (req.request == "GET" || req.request == "HEAD") {
                         lookup;
                 } elsif (req.request == "PURGE") {
                         if (!client.ip ~ purge) {
                                 error 405 "Not allowed.";
                         }
                         lookup;
                 } else {
                         pipe;
                 }
         } else {
                 error 403 "Access denied. Contact cacheadmin at finn.no if
 you have problems.";
         }
 }
 sub vcl_miss {
         if (req.request == "PURGE") {
                 error 404 "Not in cache.";
         } else {
                 fetch;
         }
 }
 sub vcl_hit {
         if (req.request == "PURGE") {
                 set obj.ttl = 0s;
                 error 200 "Purged.";
         } else {
                 deliver;
         }
 }
 sub vcl_fetch {
         if (obj.ttl < 86400s) {
                 set obj.ttl = 604800s;
         }
         if (obj.http.Cookie) {
                 remove obj.http.Cookie;
         }
         if (obj.http.Set-Cookie) {
                 remove obj.http.Set-Cookie;
         }
         insert;
 }
 }}}

 Backtrace shows:

 {{{
 Program received signal SIGABRT, Aborted.
 [Switching to Thread 0x32ffe00 (LWP 100463)]
 0x0000000800c080dc in thr_kill () from /lib/libc.so.6
 (gdb) bt
 #0  0x0000000800c080dc in thr_kill () from /lib/libc.so.6
 #1  0x000000080098d01c in raise () from /usr/lib/libthr.so.2
 #2  0x0000000800c8716d in abort () from /lib/libc.so.6
 #3  0x000000080066ab99 in lbv_assert (func=0x430fbc "RES_WriteObj",
     file=0x430f76 "cache_response.c", line=184,
     cond=0x430ff0 "u == sp->obj->len", err=32) at assert.c:58
 #4  0x0000000000419412 in RES_WriteObj (sp=0x3fc5008) at
 cache_response.c:184
 #5  0x000000000040e353 in cnt_deliver (sp=0x3fc5008) at cache_center.c:162
 #6  0x000000000040fc4c in CNT_Session (sp=0x3fc5008) at steps.h:41
 #7  0x0000000000417588 in wrk_do_one (w=0x7fffd9aceae0) at
 cache_pool.c:193
 #8  0x0000000000417a48 in wrk_thread (priv=0x85b300) at cache_pool.c:245
 #9  0x000000080098f55b in pthread_create () from /usr/lib/libthr.so.2
 #10 0x0000000000000000 in ?? ()
 Error accessing memory address 0x7fffd9acf000: Bad address.
 (gdb) frame 4
 #4  0x0000000000419412 in RES_WriteObj (sp=0x3fc5008) at
 cache_response.c:184
 184                     assert(u == sp->obj->len);
 (gdb) print sp->obj->len
 $1 = 1525
 (gdb) print u
 $2 = 0
 }}}

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/167>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator