[Varnish] #194: Varnish crashes with assert error in HTC_Rx (cache_httpconn.c)

[Varnish]

#194: Varnish crashes with assert error in HTC_Rx (cache_httpconn.c)
----------------------+-----------------------------------------------------
 Reporter:  anders    |       Owner:  phk                                       
     Type:  defect    |      Status:  new                                       
 Priority:  normal    |   Milestone:                                            
Component:  varnishd  |     Version:  1.2                                       
 Severity:  normal    |    Keywords:  varnishd core dump HTC_Rx cache_httpconn.c
----------------------+-----------------------------------------------------
 Varnish crashes with this error message:

 {{{
 Child said (2, 27833): <<Assert error in HTC_Rx(), cache_httpconn.c line
 163:
   Condition((htc->ws->r) != 0) not true.
   errno = 35 (Resource temporarily unavailable)
 >>
 Cache child died pid=27833 status=0x86
 }}}

 I am running Varnish on FreeBSD/amd64 6.3-RC2, on Intel (EMT64) hardware.

 My VCL:

 {{{
 backend default {
              set backend.host = "192.168.110.1";
              set backend.port = "80";
         }
 acl purge {
         "192.168.100.1"/32;
 }


 sub vcl_recv {
         if (req.http.host ~ "^(bars.*.foo.no|bazcache.foo.no)$") {
                 if (req.request == "GET" || req.request == "HEAD") {
                         lookup;
                 } elsif (req.request ~ "^(PURGE|REPURGE)$") {
                         if (client.ip ~ purge) {
                                 if (req.request == "REPURGE") {
                                         purge_url(req.url);
                                         error 200 "Repurged.";
                                 } else {
                                         lookup;
                                 }
                         } else {
                                 error 405 "Not allowed.";
                         }
                 } else {
                         pipe;
                 }
         } else {
                 error 403 "Access denied. Contact cacheadmin at foo.no if you
 have problems.";
         }
 }


 sub vcl_miss {
         if (req.request ~ "^(PURGE|REPURGE)$") {
                 error 404 "Not in cache.";
         } else {
                 fetch;
         }
 }
 sub vcl_hit {
         if (req.request == "PURGE") {
                 set obj.ttl = 0s;
                 error 200 "Purged.";
         } else {
                 deliver;
         }
 }
 sub vcl_fetch {
         if (obj.status == 404 || obj.status == 503 || obj.status == 500) {
                 pass;
         }

         if (!obj.valid) {
                 error;
         }
         if (!obj.cacheable) {
                 pass;
         }

         if (obj.http.Cookie) {
                 remove obj.http.Cookie;
         }
         if (obj.http.Set-Cookie) {
                 remove obj.http.Set-Cookie;
         }
         insert;
 }
 sub vcl_hash {
         set req.hash += req.url;
         if (req.http.host ~ "^bars.*.foo.no$") {
                 set req.hash += "bars.foo.no";
         } else {
                 set req.hash += req.http.host;
         }
         hash;
 }
 }}}

 Backtrace:

 {{{
 (gdb) bt
 #0  0x0000000800c0d59c in thr_kill () from /lib/libc.so.6
 #1  0x000000080099101c in raise () from /usr/lib/libthr.so.2
 #2  0x0000000800c8d4cd in abort () from /lib/libc.so.6
 #3  0x000000080066dc09 in lbv_assert (func=0x432ee4 "HTC_Rx",
     file=0x432e62 "cache_httpconn.c", line=163,
     cond=0x432eeb "(htc->ws->r) != 0", err=35) at assert.c:58
 #4  0x0000000000417e71 in HTC_Rx (htc=0x131a0b0) at cache_httpconn.c:163
 #5  0x00000000004085bf in vca_kev (kp=0x7fffff5fb350)
     at cache_acceptor_kqueue.c:107
 #6  0x000000000040896d in vca_kqueue_main (arg=0x0)
     at cache_acceptor_kqueue.c:156
 #7  0x000000080099355b in pthread_create () from /usr/lib/libthr.so.2
 #8  0x0000000000000000 in ?? ()
 Cannot access memory at address 0x7fffff5fc000
 (gdb) print sp
 $1 = (struct sess *) 0x131a008
 (gdb) print *sp
 $2 = {magic = 741317722, fd = -1, id = 36, xid = 0, restarts = 0, wrk =
 0x0,
   sockaddrlen = 16, mysockaddrlen = 128, sockaddr = 0x131a670,
   mysockaddr = 0x131a6f0, addr = 0x131a770 "83.108.186.146",
   port = 0x131a77f "9718", srcaddr = 0x0, doclose = 0x0, http = 0x131a1c8,
   http0 = 0x131a410, ws = {{magic = 905626964, id = 0x4339f0 "sess",
       s = 0x131a770 "83.108.186.146", f = 0x131a784 "", r = 0x0,
       e = 0x131c770 ""}}, ws_ses = 0x131a784 "", ws_req = 0x131a995 "",
 htc = {
     {magic = 1041886673, fd = 36, ws = 0x131a070, rxbuf = {b = 0x131a784
 "",
         e = 0x131a784 ""}, pipeline = {b = 0x0, e = 0x0}}},
   t_open = 1200047595.0341094, t_req = nan(0x8000000000000),
   t_resp = nan(0x8000000000000), t_end = 1200047595.0341094, step =
 STP_DONE,
   cur_method = 0, handling = 128, wantbody = 1 '\001', err_code = 0,
   err_reason = 0x0, list = {vtqe_next = 0x1242008, vtqe_prev = 0x121d120},
   backend = 0x0, bereq = 0x0, obj = 0x0, vcl = 0x0, mem = 0x131a000,
   workreq = {list = {vtqe_next = 0x0, vtqe_prev = 0x0}, sess = 0x131a008},
   acct = {first = 1200047594.641866, sess = 1, req = 1, pipe = 0, pass =
 0,
     fetch = 0, hdrbytes = 341, bodybytes = 52881}, nhashptr = 12,
   ihashptr = 4, lhashptr = 69, hashptr = 0x131a998}
 }}}

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/194>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator