[Varnish] #472: Crash in HSH_Prepare (ESI in use)

[Varnish]

#472: Crash in HSH_Prepare (ESI in use)
----------------------+-----------------------------------------------------
 Reporter:  kristian  |       Owner:       
     Type:  defect    |      Status:  new  
 Priority:  normal    |   Milestone:       
Component:  build     |     Version:  trunk
 Severity:  normal    |    Keywords:       
----------------------+-----------------------------------------------------
 This seems to happen under _some_ load, but not a lot. Typically on ESI-
 heavy pages combined with several misses.

 {{{
 (gdb) bt full
 #0  0x00002b46c1003bb5 in raise () from /lib64/libc.so.6
 No symbol table info available.
 #1  0x00002b46c1004fb0 in abort () from /lib64/libc.so.6
 No symbol table info available.
 #2  0x000000000041b0d7 in pan_ic (func=<value optimized out>, file=<value
 optimized out>, line=<value optimized out>,
     cond=<value optimized out>, err=-1428692184, xxx=<value optimized
 out>) at cache_panic.c:317
         l = <value optimized out>
         p = 0x2b46c15002d8 <Address 0x2b46c15002d8 out of bounds>
         q = <value optimized out>
         sp = (const struct sess *) 0x0
 #3  0x00000000004158ac in HSH_Prepare (sp=0x2aabeb367008, nhashcount=6) at
 cache_hash.c:187
         p = <value optimized out>
         u = <value optimized out>
         __func__ = "HSH_Prepare"
 #4  0x000000000040efc8 in cnt_lookup (sp=0x2aabeb367008) at
 cache_center.c:583
         o = <value optimized out>
         __func__ = "cnt_lookup"
 #5  0x0000000000410a22 in CNT_Session (sp=0x2aabeb367008) at steps.h:38
         done = -348753912
         w = (struct worker *) 0x2aacdba44c60
         __func__ = "CNT_Session"
 #6  0x0000000000423ce8 in ESI_Deliver (sp=0x2aabeb367008) at
 cache_vrt_esi.c:810
         eb = (struct esi_bit *) 0x2aabeb54fa40
         obj = (struct object *) 0x2aaaab2b3000
         __func__ = "ESI_Deliver"
 #7  0x000000000041cc4f in RES_WriteObj (sp=0x2aabeb367008) at
 cache_response.c:150
         st = <value optimized out>
         u = <value optimized out>
         lenbuf = "\bp6�*\000\000\000\000\000\000\000\000\000\000`L��"
         __func__ = "RES_WriteObj"
 #8  0x000000000040faba in cnt_deliver (sp=0x2aabeb367008) at
 cache_center.c:180
         __func__ = "cnt_deliver"
 #9  0x000000000041073a in CNT_Session (sp=0x2aabeb367008) at steps.h:42
         done = 0
         w = (struct worker *) 0x2aacdba44c60
         __func__ = "CNT_Session"
 #10 0x000000000041c642 in wrk_do_cnt_sess (w=0x2aacdba44c60, priv=<value
 optimized out>) at cache_pool.c:398
         sess = (struct sess *) 0x2aabeb367008
         __func__ = "wrk_do_cnt_sess"
 #11 0x000000000041bd25 in wrk_thread (priv=0x2b46c1413100) at
 cache_pool.c:310
         ww = {magic = 1670491599, nobjhead = 0x2aabeb838740, nobj =
 0x2aaaab862000, lastused = 1237110660.244344, cond = {__data = {
       __lock = 0, __futex = 2478, __total_seq = 1239, __wakeup_seq = 1239,
 __woken_seq = 1239, __mutex = 0x2b46c14f0288, __nwaiters = 0,
       __broadcast_seq = 0},
     __size =
 "\000\000\000\000�\t\000\000�\004\000\000\000\000\000\000�\004\000\000\000\000\000\000�\004\000\000\000\000\000\000\210\002O�F+\000\000\000\000\000\000\000\000\000",
 __align = 10642928959488}, list = {vtqe_next = 0x2aacda241c60, vtqe_prev =
 0x2b46c1413110},
   wrq = 0x2aabeb367198, wfd = 0x0, werr = 0, iov = {{iov_base =
 0x2aabeb54fa50, iov_len = 4}, {iov_base = 0x2aaaac5085cd, iov_len = 127},
     {iov_base = 0x43f5d6, iov_len = 2}, {iov_base = 0x43dae7, iov_len =
 1}, {iov_base = 0x43cd05, iov_len = 8}, {iov_base = 0x43f5d6,
       iov_len = 2}, {iov_base = 0x2aabeb367855, iov_len = 212}, {iov_base
 = 0x43f5d6, iov_len = 2}, {iov_base = 0x2aabeb36792b,
       iov_len = 39}, {iov_base = 0x43f5d6, iov_len = 2}, {iov_base =
 0x2aabeb367954, iov_len = 19}, {iov_base = 0x43f5d6, iov_len = 2}, {
       iov_base = 0x2aabeb367969, iov_len = 216}, {iov_base = 0x43f5d6,
 iov_len = 2}, {iov_base = 0x2aabeb367a43, iov_len = 30}, {
       iov_base = 0x43f5d6, iov_len = 2}, {iov_base = 0x2aabeb367a93,
 iov_len = 109}, {iov_base = 0x43f5d6, iov_len = 2}, {
       iov_base = 0x2aabeb367fe1, iov_len = 18}, {iov_base = 0x43f5d6,
 iov_len = 2}, {iov_base = 0x2aac3710f2a0, iov_len = 12}, {
       iov_base = 0x43f5d6, iov_len = 2}, {iov_base = 0x2aac3710f2ad,
 iov_len = 30}, {iov_base = 0x43f5d6, iov_len = 2}, {
       iov_base = 0x43f5d6, iov_len = 2}, {iov_base = 0x2aaaabfba000,
 iov_len = 179}, {iov_base = 0x43dfeb, iov_len = 16}, {
       iov_base = 0x43f5d6, iov_len = 2}, {iov_base = 0x2aacb892a9a6,
 iov_len = 17}, {iov_base = 0x43f5d6, iov_len = 2}, {
       iov_base = 0x43f5d6, iov_len = 2}, {iov_base = 0x2aaaab33c000,
 iov_len = 3059}, {iov_base = 0x43f5d6, iov_len = 2}, {
       iov_base = 0x43f5d6, iov_len = 2}, {iov_base = 0x43f5d6, iov_len =
 2}, {iov_base = 0x2aaaab199000, iov_len = 29597}, {
       iov_base = 0x0, iov_len = 0} <repeats 28 times>}, niov = 0, liov =
 0, vcl = 0x0, srcaddr = 0x2aabeb8041c0,
   wlb = 0x2aacdba42c50 "'", wlp = 0x2aacdba42c50 "'", wle = 0x2aacdba44c50
 "", wlr = 0, sha256ctx = 0x2aacdba45120}
         sha256 = {state = {1779033703, 3144134277, 1013904242, 2773480762,
 1359893119, 2600822924, 528734635, 1541459225}, count = 0,
   buf = '\0' <repeats 63 times>}
         __func__ = "wrk_thread"
 #12 0x00002b46c0c55143 in start_thread () from /lib64/libpthread.so.0
 No symbol table info available.
 ---Type <return> to continue, or q <return> to quit---
 #13 0x00002b46c10948cd in clone () from /lib64/libc.so.6
 No symbol table info available.
 #14 0x0000000000000000 in ?? ()
 No symbol table info available.
 (gdb)
 }}}

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/472>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator