[Varnish] #200: Varnish crashes in VBE_new_bereq (cache_backend.c)

[Varnish]

#200: Varnish crashes in VBE_new_bereq (cache_backend.c)
----------------------+-----------------------------------------------------
 Reporter:  anders    |       Owner:  phk                             
     Type:  defect    |      Status:  new                             
 Priority:  normal    |   Milestone:                                  
Component:  varnishd  |     Version:  trunk                           
 Severity:  normal    |    Keywords:  varnishd core dump VBE_new_bereq
----------------------+-----------------------------------------------------
 Varnish crashes with this error message:

 {{{
 Child said (2, 83138): <<Assert error in VBE_new_bereq(), cache_backend.c
 line 143:
   Condition((bereq)->magic == 0x3b6d250c) not true.
   errno = 32 (Broken pipe)
 }}}

 I am running Varnish trunk up to date to commit 2344, with des' madvise
 patch applied: http://anders.fupp.net/test/varnishd_madvise.diff

 My VCL:

 {{{
 backend default {
              set backend.host = "192.168.110.1";
              set backend.port = "80";
         }
 acl purge {
         "192.168.100.1"/32;
 }


 sub vcl_recv {
         if (req.http.host ~ "^(bars.*.foo.no|bazcache.foo.no)$") {
                 if (req.request == "GET" || req.request == "HEAD") {
                         lookup;
                 } elsif (req.request ~ "^(PURGE|REPURGE)$") {
                         if (client.ip ~ purge) {
                                 if (req.request == "REPURGE") {
                                         purge_url(req.url);
                                         error 200 "Repurged.";
                                 } else {
                                         lookup;
                                 }
                         } else {
                                 error 405 "Not allowed.";
                         }
                 } else {
                         pipe;
                 }
         } else {
                 error 403 "Access denied. Contact cacheadmin at foo.no if you
 have problems.";
         }
 }


 sub vcl_miss {
         if (req.request ~ "^(PURGE|REPURGE)$") {
                 error 404 "Not in cache.";
         } else {
                 fetch;
         }
 }
 sub vcl_hit {
         if (req.request == "PURGE") {
                 set obj.ttl = 0s;
                 error 200 "Purged.";
         } else {
                 deliver;
         }
 }
 sub vcl_fetch {
         if (obj.status == 404 || obj.status == 503 || obj.status == 500) {
                 pass;
         }

         if (!obj.valid) {
                 error;
         }
         if (!obj.cacheable) {
                 pass;
         }

         if (obj.http.Cookie) {
                 remove obj.http.Cookie;
         }
         if (obj.http.Set-Cookie) {
                 remove obj.http.Set-Cookie;
         }
         insert;
 }
 sub vcl_hash {
         set req.hash += req.url;
         if (req.http.host ~ "^bars.*.foo.no$") {
                 set req.hash += "bars.foo.no";
         } else {
                 set req.hash += req.http.host;
         }
         hash;
 }
 }}}

 Backtrace:

 {{{
 (gdb) bt
 #0  0x0000000800d16fec in thr_kill () from /lib/libc.so.7
 #1  0x0000000800da0c5b in abort () from /lib/libc.so.7
 #2  0x0000000800673d1f in lbv_assert (func=Could not find the frame base
 for "lbv_assert".
 ) at assert.c:58
 #3  0x00000000004094fc in VBE_new_bereq () at cache_backend.c:143
 #4  0x00000000004179a4 in http_FilterHeader (sp=0x14c5033008, how=8)
     at cache_http.c:630
 #5  0x00000000004103f8 in cnt_miss (sp=0x14c5033008) at cache_center.c:611
 #6  0x0000000000411556 in CNT_Session (sp=0x14c5033008) at steps.h:39
 #7  0x000000000041a91d in wrk_do_one (w=0x7fffd46a4ae0) at
 cache_pool.c:193
 #8  0x000000000041ae20 in wrk_thread (priv=0x800f11200) at
 cache_pool.c:247
 #9  0x0000000800a9ea88 in pthread_getprio () from /lib/libthr.so.3
 #10 0x00007fffd44a5000 in ?? ()
 Error accessing memory address 0x7fffd46a5000: Bad address.
 (gdb) frame 3
 #3  0x00000000004094fc in VBE_new_bereq () at cache_backend.c:143
 143                     CHECK_OBJ(bereq, BEREQ_MAGIC);
 (gdb) print *sp
 No symbol "sp" in current context.
 (gdb) print *bereq
 $6 = {magic = 0, list = {vtqe_next = 0x0, vtqe_prev = 0x53f090}, ws = {{
       magic = 0, id = 0x0, s = 0x0, f = 0x0, r = 0x0, e = 0x0}}, http = {{
       magic = 0, ws = 0x0, conds = 0 '\0', logtag = 0, status = 0, hd = {{
           b = 0x0, e = 0x0} <repeats 32 times>},
       hdf = '\0' <repeats 31 times>, nhd = 0}}}
 (gdb) frame 4
 #4  0x00000000004179a4 in http_FilterHeader (sp=0x14c5033008, how=8)
     at cache_http.c:630
 630             bereq = VBE_new_bereq();
 (gdb) print *sp
 $1 = {magic = 741317722, fd = 3527, id = 3527, xid = 1007760133, restarts
 = 0,
   esis = 0, wrk = 0x7fffd46a4ae0, sockaddrlen = 16, mysockaddrlen = 128,
   sockaddr = 0x14c5033670, mysockaddr = 0x14c50336f0,
   addr = 0x14c5033770 "85.165.2.13", port = 0x14c503377c "10511",
   srcaddr = 0x1492db0660, doclose = 0x0, http = 0x14c50331c8,
   http0 = 0x14c5033410, ws = {{magic = 905626964, id = 0x4387b8 "sess",
       s = 0x14c5033770 "85.165.2.13",
       f = 0x14c50339ce "inn_ld=aebDate: Thu, 24 Jan 2008 14:39:40 GMT",
       r = 0x0, e = 0x14c5037770 ""}}, ws_ses = 0x14c5033782 "GET",
   ws_req = 0x14c5033996 "", htc = {{magic = 1041886673, fd = 3527,
       ws = 0x14c5033070, rxbuf = {b = 0x14c5033782 "GET",
         e = 0x14c5033996 ""}, pipeline = {b = 0x0, e = 0x0}}},
   t_open = 1201185585.8976934, t_req = 1201185585.9043143,
   t_resp = nan(0x8000000000000), t_end = nan(0x8000000000000),
   step = STP_MISS, cur_method = 0, handling = 4, wantbody = 1 '\001',
   err_code = 0, err_reason = 0x0, list = {vtqe_next = 0x0, vtqe_prev =
 0x0},
   backend = 0x800f14140, bereq = 0x0, obj = 0x1111782000, vcl =
 0x1489c03920,
   mem = 0x14c5033000, workreq = {list = {vtqe_next = 0x0, vtqe_prev =
 0x0},
     sess = 0x14c5033008}, acct = {first = 1201185585.8976934, sess = 0,
     req = 0, pipe = 0, pass = 0, fetch = 0, hdrbytes = 0, bodybytes = 0},
   nhashptr = 6, ihashptr = 4, lhashptr = 53, hashptr = 0x14c5033998}

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/200>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator