[Varnish] #783: Critbit crash in Varnish 2.1.3

[Varnish]

#783: Critbit crash in Varnish 2.1.3
----------------------+-----------------------------------------------------
 Reporter:  anders    |       Owner:  phk  
     Type:  defect    |      Status:  new  
 Priority:  normal    |   Milestone:       
Component:  varnishd  |     Version:  2.1.3
 Severity:  major     |    Keywords:       
----------------------+-----------------------------------------------------
 I am running Varnish 2.1.3 in FreeBSD/amd64 7.2-RELEASE, with the
 recommended binary heap patch from r5195. After some days with gdb
 attached and ping_interval set to 0, I get a crash:

 {{{
 (gdb) bt
 #0  0x00000008009d94ab in backtrace (buffer=Variable "buffer" is not
 available.
 ) at execinfo.c:138
 #1  0x0000000000423d36 in pan_ic (func=Variable "func" is not available.
 ) at cache_panic.c:273
 #2  0x0000000000431408 in hcb_lookup (sp=0x80d45d008, noh=0x851219940)
     at hash_critbit.c:475
 #3  0x000000000041db62 in HSH_Lookup (sp=0x80d45d008, poh=0x7ffff6da45e0)
     at cache_hash.c:349
 #4  0x0000000000411f84 in cnt_lookup (sp=0x80d45d008) at
 cache_center.c:788
 #5  0x0000000000414612 in CNT_Session (sp=0x80d45d008) at steps.h:38
 #6  0x0000000000426381 in wrk_do_cnt_sess (w=0x7ffff6db7d10, priv=Variable
 "priv" is not available.
 )
     at cache_pool.c:294
 #7  0x0000000000425607 in wrk_thread_real (qp=0x80110e600,
 shm_workspace=Variable "shm_workspace" is not available.
 )
     at cache_pool.c:183
 #8  0x0000000800bfb4d1 in pthread_getprio () from /lib/libthr.so.3
 #9  0x00007ffff6bb8000 in ?? ()
 Error accessing memory address 0x7ffff6db8000: Bad address.
 (gdb) frame 2
 #2  0x0000000000431408 in hcb_lookup (sp=0x80d45d008, noh=0x851219940)
     at hash_critbit.c:475
 475                             assert(!with_lock);
 (gdb) print *hp
 No symbol "hp" in current context.
 (gdb) print *sp
 $1 = {magic = 741317722, fd = 251, id = 251, xid = 379794173, restarts =
 0,
   esis = 0, disable_esi = 0, wrk = 0x7ffff6db7d10, sockaddrlen = 16,
   mysockaddrlen = 128, sockaddr = 0x80d45d2b0, mysockaddr = 0x80d45d330,
   mylsock = 0x80111b2b0, addr = 0x80d45dcc0 "80.91.37.198",
   port = 0x80d45dcd0 "49690", doclose = 0x445f29 "Connection: close",
   http = 0x80d45d3b0, http0 = 0x80d45d838, ws = {{magic = 905626964,
       id = 0x44a4b8 "sess", s = 0x80d45dcc0 "80.91.37.198",
       f = 0x80d45dd68 "/", r = 0x0, e = 0x80d46dcc0 "", overflow = 0}},
   ws_ses = 0x80d45dcd8 "PURGE",
   ws_req = 0x80d45dd48 "Accept-Encoding: deflate",
   digest = "ÙØØ?£\236j$\033ü÷#:ê\b\023\2264dÒÛ*7vOÃ\226\v\216?gÎ", htc =
 {{
       magic = 1041886673, fd = 251, ws = 0x80d45d078, rxbuf = {
         b = 0x80d45dcd8 "PURGE", e = 0x80d45dd44 ""}, pipeline = {b = 0x0,
         e = 0x0}}}, t_open = 1285509011.4016879, t_req =
 1285509011.401763,
   t_resp = nan(0x8000000000000), t_end = 1285509011.4016879, grace =
 21600,
   step = STP_LOOKUP, cur_method = 0, handling = 3, sendbody = 0 '\0',
   wantbody = 1 '\001', err_code = 0, err_reason = 0x0, list = {
     vtqe_next = 0x0, vtqe_prev = 0x0}, director = 0x80110e8d8, vbe = 0x0,
   obj = 0x0, objcore = 0x0, objhead = 0x0, vcl = 0x8011d20e8,
   mem = 0x80d45d000, workreq = {list = {vtqe_next = 0x0, vtqe_prev = 0x0},
     func = 0x4262c0 <wrk_do_cnt_sess>, priv = 0x80d45d008}, acct_tmp = {
     first = 0, sess = 1, req = 1, pipe = 0, pass = 0, fetch = 0, hdrbytes
 = 0,
     bodybytes = 0}, acct_req = {first = 0, sess = 0, req = 0, pipe = 0,
     pass = 0, fetch = 0, hdrbytes = 0, bodybytes = 0}, acct_ses = {
     first = 1285509011.4016879, sess = 0, req = 0, pipe = 0, pass = 0,
     fetch = 0, hdrbytes = 0, bodybytes = 0}}
 (gdb) frame 3
 #3  0x000000000041db62 in HSH_Lookup (sp=0x80d45d008, poh=0x7ffff6da45e0)
     at cache_hash.c:349
 349                     oh = hash->lookup(sp, w->nobjhead);
 }}}

 I am using -s malloc,50G. I did not set hash algorithm with -h. Man page
 says I should have classic, but I still get a crash that refers to
 hash_critbit.c?

-- 
Ticket URL: <http://varnish-cache.org/trac/ticket/783>
Varnish <http://varnish-cache.org/>
The Varnish HTTP Accelerator