[Varnish] #548: Sig 11 crash in trunk 4199

[Varnish]

#548: Sig 11 crash in trunk 4199
---------------------------------------------+------------------------------
 Reporter:  anders                           |        Owner:  phk                
     Type:  defect                           |       Status:  new                
 Priority:  normal                           |    Milestone:  Varnish 2.1 release
Component:  varnishd                         |      Version:  trunk              
 Severity:  normal                           |   Resolution:                     
 Keywords:  sig 11 segmentation fault trunk  |  
---------------------------------------------+------------------------------
Comment (by anders):

 This is still happening with trunk/4434, any chance for a resolution:

 {{{
 (gdb) bt
 #0  0x00000008009cf35f in getframeaddr (level=Variable "level" is not
 available.
 ) at execinfo.c:285
 #1  0x00000008009cf394 in backtrace (buffer=Variable "buffer" is not
 available.
 ) at execinfo.c:70
 #2  0x0000000000421ac8 in pan_backtrace () at cache_panic.c:273
 #3  0x0000000000421e77 in pan_ic (func=Variable "func" is not available.
 ) at cache_panic.c:329
 #4  0x000000000041c82d in HSH_Lookup (sp=0x10eacf2008, poh=0x7fffadb68720)
     at cache_hash.c:407
 #5  0x0000000000411ba4 in cnt_lookup (sp=0x10eacf2008) at
 cache_center.c:780
 #6  0x0000000000413f96 in CNT_Session (sp=0x10eacf2008) at steps.h:38
 #7  0x0000000000423d01 in wrk_do_cnt_sess (w=0x7fffadb6e800, priv=Variable
 "priv" is not available.
 )
     at cache_pool.c:277
 #8  0x000000000042300d in wrk_thread_real (qp=0x80110f4c0,
 shm_workspace=Variable "shm_workspace" is not available.
 )
     at cache_pool.c:173
 #9  0x0000000800bf04d1 in pthread_getprio () from /lib/libthr.so.3
 #10 0x00007fffad970000 in ?? ()
 Cannot access memory at address 0x7fffadb70000
 (gdb) frame 4
 #4  0x000000000041c82d in HSH_Lookup (sp=0x10eacf2008, poh=0x7fffadb68720)
     at cache_hash.c:407
 407                     CHECK_OBJ_NOTNULL(o, OBJECT_MAGIC);
 (gdb) print *sp
 $1 = {magic = 741317722, fd = 3699, id = 3699, xid = 1480106783, restarts
 = 0,
   esis = 0, disable_esi = 0, wrk = 0x7fffadb6e800, sockaddrlen = 16,
   mysockaddrlen = 128, sockaddr = 0x10eacf2b50, mysockaddr = 0x10eacf2bd0,
   mylsock = 0x80111be80, addr = 0x10eacf2c50 "80.213.121.208",
   port = 0x10eacf2c5f "4747", doclose = 0x0, http = 0x10eacf2258,
   http0 = 0x10eacf26c8, ws = {{magic = 905626964, id = 0x446688 "sess",
       s = 0x10eacf2c50 "80.213.121.208",
       f = 0x10eacf3011 "tion: Keep-Alive, TE", r = 0x0,
       e = 0x10eacf6c50 '¥' <repeats 200 times>..., overflow = 0}},
   ws_ses = 0x10eacf2c64 "GET", ws_req = 0x10eacf2ffa "Accept-Encoding:
 gzip",
   digest = "TòWMW¨\tX.º¹â¨EC\035V\002À\f\201Ós²G\031\221Cm'öÀ", htc = {{
       magic = 1041886673, fd = 3699, ws = 0x10eacf2078, rxbuf = {
         b = 0x10eacf2c64 "GET", e = 0x10eacf2ffa "Accept-Encoding: gzip"},
       pipeline = {b = 0x0, e = 0x0}}}, t_open = 1264365582.6530151,
   t_req = 1264365582.7233465, t_resp = nan(0x8000000000000),
   t_end = 1264365582.6530151, connect_timeout = 0.40000000000000002,
   first_byte_timeout = 60, between_bytes_timeout = 60, grace = 300,
   step = STP_LOOKUP, cur_method = 0, handling = 3, sendbody = 0 '\0',
   wantbody = 1 '\001', err_code = 0, err_reason = 0x0, list = {
     vtqe_next = 0x80e0cf008, vtqe_prev = 0xee38bb170}, director =
 0x80bbeeec8,
   vbe = 0x0, obj = 0x0, objcore = 0x0, objhead = 0x0, vcl = 0x80bbf90e8,
   mem = 0x10eacf2000, workreq = {list = {vtqe_next = 0x0, vtqe_prev =
 0x0},
     func = 0x423c40 <wrk_do_cnt_sess>, priv = 0x10eacf2008}, acct = {
     first = 1264365582.6346316, sess = 1, req = 1, pipe = 0, pass = 0,
     fetch = 0, hdrbytes = 345, bodybytes = 1135}, acct_req = {first = 0,
     sess = 0, req = 1, pipe = 0, pass = 0, fetch = 0, hdrbytes = 0,
     bodybytes = 0}}
 (gdb) print *oc
 $2 = {magic = 1294996226, obj = 0x0, objhead = 0xfa6ab4a90,
   timer_when = 1264888298.0438495, flags = 0, timer_idx = 0, list = {
     vtqe_next = 0x0, vtqe_prev = 0xfa6ab4aa8}, lru_list = {
     vle_next = 0x12b0aad2e0, vle_prev = 0x80112b688}, ban_list = {
     vtqe_next = 0x10e4efc580, vtqe_prev = 0x15ef767478}, smp_seg = 0x0,
   ban = 0x0}
 }}}

 Some lines around line 407, cache_hash.c:

 {{{
         if (oc != NULL) {
                 o = oc->obj;
                 CHECK_OBJ_NOTNULL(o, OBJECT_MAGIC);

                 /* We found an object we like */
                 o->refcnt++;
                 if (o->hits < INT_MAX)
                         o->hits++;
                 assert(oh->refcnt > 1);
                 Lck_Unlock(&oh->mtx);
                 assert(hash->deref(oh));
                 *poh = oh;
                 return (oc);
         }
 }}}

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/548#comment:5>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator