[Varnish] #778: Signal 11 crash in Varnish trunk/4516

[Varnish]

#778: Signal 11 crash in Varnish trunk/4516
----------------------+-----------------------------------------------------
 Reporter:  anders    |       Owner:  phk  
     Type:  defect    |      Status:  new  
 Priority:  normal    |   Milestone:       
Component:  varnishd  |     Version:  trunk
 Severity:  normal    |    Keywords:       
----------------------+-----------------------------------------------------
 I am running Varnish trunk/4516 in FreeBSD/amd64 7.2-RELEASE, using saint
 mode.

 Occasionally I get a signal11 crash:

 Sep 16 09:38:07 cache3 kernel: pid 93634 (varnishd), uid 0: exited on
 signal 11 (core dumped)

 Backtrace here:

 {{{
 (gdb) bt
 #0  0x00000008009d535f in getframeaddr (level=Variable "level" is not
 available.
 ) at execinfo.c:285
 #1  0x00000008009d5394 in backtrace (buffer=Variable "buffer" is not
 available.
 ) at execinfo.c:70
 #2  0x0000000000422538 in pan_backtrace () at cache_panic.c:273
 #3  0x0000000000422915 in pan_ic (func=Variable "func" is not available.
 ) at cache_panic.c:332
 #4  0x000000000041df3d in http_copyheader (w=0x7fffce071d10, fd=3905,
     to=0x8f06958e0, fm=0x7fffce06b350, n=15) at cache_http.c:650
 #5  0x000000000041ebf8 in http_FilterFields (w=0x7fffce071d10, fd=3905,
     to=0x8f06958e0, fm=0x7fffce06b350, how=Variable "how" is not
 available.
 ) at cache_http.c:714
 #6  0x00000000004133cf in cnt_fetch (sp=0xaa7462008) at cache_center.c:584
 #7  0x00000000004148fa in CNT_Session (sp=0xaa7462008) at steps.h:41
 #8  0x0000000000424891 in wrk_do_cnt_sess (w=0x7fffce071d10, priv=Variable
 "priv" is not available.
 )
     at cache_pool.c:294
 #9  0x0000000000423b7d in wrk_thread_real (qp=0x80110f6f0,
 shm_workspace=Variable "shm_workspace" is not available.
 )
     at cache_pool.c:183
 #10 0x0000000800bf74d1 in pthread_getprio () from /lib/libthr.so.3
 #11 0x00007fffcde72000 in ?? ()
 Cannot access memory at address 0x7fffce072000
 (gdb) frame 5
 #5  0x000000000041ebf8 in http_FilterFields (w=0x7fffce071d10, fd=3905,
     to=0x8f06958e0, fm=0x7fffce06b350, how=Variable "how" is not
 available.
 ) at cache_http.c:714
 714                     http_copyheader(w, fd, to, fm, u);
 (gdb) print *w
 $1 = {magic = 1670491599, nobjhead = 0x8a0159820, nobjcore = 0x86f76d510,
   stats = {client_req = 2, cache_hit = 0, cache_hitpass = 2, cache_miss =
 0,
     fetch_head = 0, fetch_length = 1, fetch_chunked = 0, fetch_eof = 0,
     fetch_bad = 0, fetch_close = 0, fetch_oldhttp = 0, fetch_zero = 0,
     fetch_failed = 0, n_object = 1, n_vampireobject = 0, n_objectcore = 0,
     n_objecthead = 0, n_objoverflow = 0, s_sess = 1, s_req = 1, s_pipe =
 0,
     s_pass = 1, s_fetch = 1, s_hdrbytes = 324, s_bodybytes = 0,
     sess_closed = 0, sess_pipeline = 0, sess_readahead = 0, sess_linger =
 1,
     sess_herd = 0}, lastused = 1284621501.1297348, cond = 0x8a05c1580,
 list = {
     vtqe_next = 0x7fffcee78d10, vtqe_prev = 0x80110f700}, wrq =
 0xaa74621a0,
   wfd = 0x0, werr = 0, iov = 0x7fffce06a6a0, siov = 128, niov = 0, liov =
 0,
   vcl = 0x0, wlb = 0x7fffce06fca0 "\024", wlp = 0x7fffce06fe6e "",
   wle = 0x7fffce071ca0 "", wlr = 16, sha256ctx = 0x7fffce071f10, htc = {{
       magic = 1041886673, fd = 4389, ws = 0x7fffce071e50, rxbuf = {
         b = 0x7fffce06bca5 "HTTP/1.1", e = 0x7fffce06bdc0 "ÿØÿà"},
 pipeline = {
         b = 0x7fffce06bdc0 "ÿØÿà",
         e = 0x7fffce06c24d "X-Varnish-IP: 80.91.37.199"}}}, ws = {{
       magic = 905626964, id = 0x444a76 "wrk",
       s = 0x7fffce06bc90 "X-Varnish: 806894301",
       f = 0x7fffce06c286 "Date: Thu, 16 Sep 2010 07:18:21 GMT", r = 0x0,
       e = 0x7fffce06fc90 "", overflow = 0}}, http = {0x7fffce06b7f0,
     0x7fffce06b350, 0x7fffce06aeb0}, bereq = 0x7fffce06b7f0,
   beresp1 = 0x7fffce06aeb0, beresp = 0x7fffce06b350, resp = 0x0,
   cacheable = 0, age = 0, entered = 1284621501.1304965,
   ttl = 1284623301.1297348, grace = 21600, do_esi = 0, connect_timeout =
 0,
   first_byte_timeout = 0, between_bytes_timeout = 0}
 (gdb) print *to
 $2 = {magic = 1680389577, ws = 0x8f0695820, conds = 0 '\0', logtag =
 HTTP_Obj,
   status = 206, protover = 0, shd = 15, hd = 0x8f0695928,
   hdf = 0x8f0695a18 "", nhd = 11}
 (gdb) print *fm
 $3 = {magic = 1680389577, ws = 0x7fffce071e50, conds = 0 '\0',
   logtag = HTTP_Rx, status = 206, protover = 1.1000000000000001, shd = 64,
   hd = 0x7fffce06b398, hdf = 0x7fffce06b798 "", nhd = 16}
 (gdb) frame 4
 #4  0x000000000041df3d in http_copyheader (w=0x7fffce071d10, fd=3905,
     to=0x8f06958e0, fm=0x7fffce06b350, n=15) at cache_http.c:650
 650             assert(n < to->shd);
 }}}

-- 
Ticket URL: <http://www.varnish-cache.org/trac/ticket/778>
Varnish <http://varnish-cache.org/>
The Varnish HTTP Accelerator