[Varnish] #162: Varnish trunk dies with assert error in SES_Delete()

[Varnish]

#162: Varnish trunk dies with assert error in SES_Delete()
---------------------------------------------------------+------------------
 Reporter:  anders                                       |        Owner:  phk  
     Type:  defect                                       |       Status:  new  
 Priority:  high                                         |    Milestone:       
Component:  varnishd                                     |      Version:  trunk
 Severity:  normal                                       |   Resolution:       
 Keywords:  varnishd core dump SES_Delete cache_session  |  
---------------------------------------------------------+------------------
Comment (by anders):

 Updating to commit 2030, this still happens:

 Sep 26 21:31:34 cache12 kernel: pid 86128 (varnishd), uid 0: exited on
 signal 6 (core dumped)

 On the console:

 {{{
 Child said (2, 86128): <<Assert error in SES_Delete(), cache_session.c
 line 337:
   Condition((sp->obj) == 0) not true.
   errno = 0 (Unknown error: 0)
 >>
 Cache child died pid=86128 status=0x86
 }}}

 Backtrace:

 {{{
 root at cache12:/usr/local/var/varnish/cache12.finn.no# gdb -c
 varnishd-2007-09-26-21-31.core -s /usr/local/sbin/varnishd
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you
 are
 welcome to change it and/or distribute copies of it under certain
 conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for
 details.
 This GDB was configured as "amd64-marcel-freebsd"...
 Core was generated by `varnishd'.
 Program terminated with signal 6, Aborted.
 #0  0x0000000800bfd0dc in ?? ()
 (gdb) bt
 #0  0x0000000800bfd0dc in ?? ()
 #1  0x000000080098201c in ?? ()
 #2  0x00007fffff5faefc in ?? ()
 #3  0x0000000800c7c16d in ?? ()
 #4  0x0000000000000000 in ?? ()
 #5  0xffffffdf00018749 in ?? ()
 #6  0xffffffffffffffff in ?? ()
 #7  0x00000000ffffffff in ?? ()
 #8  0x000000000042809b in __func__.0 ()
 Cannot access memory at address 0x427fd3
 (gdb) info threads
   1006 process 100343  0x0000000800c3463c in ?? ()
   1005 process 100097  0x0000000800c657fc in ?? ()
   1004 process 100104  0x0000000800c657fc in ?? ()
   1003 process 100151  0x0000000800c657fc in ?? ()
   1002 process 100197  0x0000000800c3463c in ?? ()
   1001 process 100655  0x0000000800c7ef2c in ?? ()
   1000 process 100662  0x0000000800c7ef2c in ?? ()
   999 process 100698  0x0000000800c7ef2c in ?? ()
   998 process 100868  0x0000000800c7ef2c in ?? ()
   997 process 100978  0x0000000800c7ef2c in ?? ()
   996 process 100218  0x0000000800c7ef2c in ?? ()
   995 process 100219  0x0000000800c7ef2c in ?? ()
 (..)
 }}}

 The list of threads goes on, with mostly ??. This core seems not complete
 due to disk space shortage. But still, there is one interesting thread
 974:

 {{{
   974 process 100846  EXP_Touch (o=0x140313000, now=1190833381.981848)
     at cache_expire.c:86
 }}}

 Checking it, I get:

 {{{
 (gdb) thread 974
 [Switching to thread 974 (process 100846)]#0  EXP_Touch (o=0x140313000,
     now=1190833381.981848) at cache_expire.c:86
 86                              TAILQ_REMOVE(&exp_lru, o, deathrow);
 (gdb) bt
 #0  EXP_Touch (o=0x140313000, now=1190833381.981848) at cache_expire.c:86
 #1  0x000000000040dff6 in CNT_Session (sp=0xded0a008) at
 cache_center.c:151
 #2  0x00000000004153f9 in wrk_thread (priv=0x86ac80) at cache_pool.c:192
 #3  0x000000080098455b in ?? ()
 #4  0x0000000000000000 in ?? ()
 #5  0x00007fffcd86dfd8 in ?? ()
 #6  0x000000013eae5e00 in ?? ()
 #7  0x0000000000000000 in ?? ()
 #8  0x0000000000af7000 in ?? ()
 #9  0x00007fff8f47e000 in ?? ()
 Cannot access memory at address 0x7fff8f67e000
 (gdb)
 }}}

 Hope this helps!

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/162#comment:1>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator