[Varnish] #162: Varnish trunk dies with assert error in SES_Delete()

[Varnish]

#162: Varnish trunk dies with assert error in SES_Delete()
---------------------------------------------------------+------------------
 Reporter:  anders                                       |        Owner:  phk  
     Type:  defect                                       |       Status:  new  
 Priority:  high                                         |    Milestone:       
Component:  varnishd                                     |      Version:  trunk
 Severity:  normal                                       |   Resolution:       
 Keywords:  varnishd core dump SES_Delete cache_session  |  
---------------------------------------------------------+------------------
Comment (by anders):

 Trying 1.2 branch up to date to commit 2221 on my 8-core server, it
 happened there too:

 {{{
 Child said (2, 20575): <<Assert error in SES_Delete(), cache_session.c
 line 338:
   Condition((sp->obj) == 0) not true.
   errno = 9 (Bad file descriptor)
 >>
 Cache child died pid=20575 status=0x86
 }}}

 Backtrace:

 {{{
 (gdb) bt
 #0  0x0000000800d1148c in thr_kill () from /lib/libc.so.7
 #1  0x0000000800d9b63b in abort () from /lib/libc.so.7
 #2  0x000000080066ec7f in lbv_assert (func=Could not find the frame base
 for "lbv_assert".
 ) at assert.c:58
 #3  0x000000000041b9e1 in SES_Delete (sp=0x210523d008) at
 cache_session.c:338
 #4  0x0000000000408618 in vca_kev (kp=0x7fffff5fb300)
     at cache_acceptor_kqueue.c:112
 #5  0x0000000000408874 in vca_kqueue_main (arg=0x0)
     at cache_acceptor_kqueue.c:151
 #6  0x0000000800a989a8 in pthread_getprio () from /lib/libthr.so.3
 #7  0x0000000000000000 in ?? ()
 Cannot access memory at address 0x7fffff5fc000
 (gdb) frame 3
 #3  0x000000000041b9e1 in SES_Delete (sp=0x210523d008) at
 cache_session.c:338
 338             AZ(sp->obj);
 (gdb) print *sp
 $1 = {magic = 741317722, fd = 175, id = 175, xid = 0, restarts = 0, wrk =
 0x0,
   sockaddrlen = 16, mysockaddrlen = 128, sockaddr = 0x210523d670,
   mysockaddr = 0x210523d6f0, addr = 0x210523d770 "83.109.65.254",
   port = 0x210523d77e "9997", srcaddr = 0x21053dd3a0, doclose = 0x0,
   http = 0x210523d1c8, http0 = 0x210523d410, ws = {{magic = 905626964,
       id = 0x433588 "sess", s = 0x210523d770 "83.109.65.254",
       f = 0x210523d783 "", r = 0x210523f783 '¥' <repeats 200 times>...,
       e = 0x2105241770 '¥' <repeats 200 times>...}}, ws_ses = 0x210523d783
 "",
   ws_req = 0x210523dad8 "\207×#\005!", htc = {{magic = 1041886673, fd =
 175,
       ws = 0x210523d070, rxbuf = {b = 0x210523d783 "", e = 0x210523d783
 ""},
       pipeline = {b = 0x0, e = 0x0}}}, t_open = 1193823630.5851231,
   t_req = nan(0x8000000000000), t_resp = nan(0x8000000000000),
   t_end = 1193823630.5851231, step = STP_DONE, cur_method = 0, handling =
 128,
   wantbody = 1 '\001', err_code = 200, err_reason = 0x0, list = {
     vtqe_next = 0x0, vtqe_prev = 0x0}, backend = 0x0, bereq = 0x0, obj =
 0x0,
   vcl = 0x0, mem = 0x210523d000, workreq = {list = {vtqe_next = 0x0,
       vtqe_prev = 0x0}, sess = 0x210523d008}, acct = {
     first = 1193823629.3212414, sess = 1, req = 1, pipe = 0, pass = 0,
     fetch = 1, hdrbytes = 339, bodybytes = 2017}, nhashptr = 6, ihashptr =
 4,
   lhashptr = 54, hashptr = 0x210523dad8}
 (gdb)
 }}}

 For more data, see:

 Varnishlog:
 https://ssldist.fupp.net/ticket-162-cache12-2007-10-31/varnish.log.bz2

 Tarball of build dir:
 https://ssldist.fupp.net/ticket-162-cache12-2007-10-31/varnish-1.2-branch-2221.tbz

 Core dump:
 https://ssldist.fupp.net/ticket-162-cache12-2007-10-31/varnishd_2007-10-31_10-50-00.core.bz2

 Tarball of installed package:
 https://ssldist.fupp.net/ticket-162-cache12-2007-10-31/varnishd_2007-10-31_10-50-00.tbz

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/162#comment:18>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator