[Varnish] #167: Varnishd crashes with assert error in RES_WriteObj

[Varnish]

#167: Varnishd crashes with assert error in RES_WriteObj
---------------------------------------------+------------------------------
 Reporter:  anders                           |        Owner:  phk  
     Type:  defect                           |       Status:  new  
 Priority:  normal                           |    Milestone:       
Component:  varnishd                         |      Version:  trunk
 Severity:  normal                           |   Resolution:       
 Keywords:  varnishd core dump RES_WriteObj  |  
---------------------------------------------+------------------------------
Comment (by anders):

 Happened again, now with branches/1.2 (up to date to commit 2153 including
 patches for ticket 168 (changeset r2153) and ticket 164 (changeset 2151)):

 {{{
 Child said (2, 35335): <<Assert error in RES_WriteObj(), cache_response.c
 line 184:
   Condition(u == sp->obj->len) not true.
   errno = 14 (Bad address)
 }}}

 Backtrace:

 {{{
 Program received signal SIGABRT, Aborted.
 [Switching to Thread 0x2d830026b0 (LWP 100383)]
 0x0000000800d1048c in thr_kill () from /lib/libc.so.7
 (gdb) bt
 #0  0x0000000800d1048c in thr_kill () from /lib/libc.so.7
 #1  0x0000000800d9a63b in abort () from /lib/libc.so.7
 #2  0x000000080066dc7f in lbv_assert (func=Could not find the frame base
 for "lbv_assert".
 ) at assert.c:58
 #3  0x0000000000419e99 in RES_WriteObj (sp=0x2d84b69008)
     at cache_response.c:184
 #4  0x000000000040e606 in cnt_deliver (sp=0x2d84b69008) at
 cache_center.c:162
 #5  0x000000000041005a in CNT_Session (sp=0x2d84b69008) at steps.h:41
 #6  0x0000000000417ecd in wrk_do_one (w=0x7fffe4121ae0) at
 cache_pool.c:193
 #7  0x00000000004183c6 in wrk_thread (priv=0x800f111e0) at
 cache_pool.c:246
 #8  0x0000000800a979a8 in pthread_getprio () from /lib/libthr.so.3
 #9  0x00007fffe3f22000 in ?? ()
 Error accessing memory address 0x7fffe4122000: Bad address.
 (gdb) frame 3
 #3  0x0000000000419e99 in RES_WriteObj (sp=0x2d84b69008)
     at cache_response.c:184
 184                     assert(u == sp->obj->len);
 (gdb) print u
 $1 = 0
 (gdb) print sp->obj->len
 $2 = 31114
 }}}

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/167#comment:3>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator