nginx-1.9.2 + ssl + spdy segfault

[kirimedia]

Segfault in nginx-1.9.2 with ssl and spdy module

# nginx -V
nginx version: nginx/1.9.2
built by gcc 4.4.6 20110731 (Red Hat 4.4.6-3) (GCC) 
built with OpenSSL 1.0.1e-fips 11 Feb 2013
TLS SNI support enabled
configure arguments: --user=nginx --group=nginx --prefix=/usr/local/nginx
--sbin-path=/usr/local/nginx/sbin/nginx
--conf-path=/usr/local/nginx/conf/nginx.conf --with-http_ssl_module
--with-http_gzip_static_module --with-http_stub_status_module
--with-http_realip_module --with-debug --with-ipv6 --with-http_spdy_module
--add-module=/home/buildbot/rpm//BUILD/lua-nginx-module-0.9.16
--add-module=/home/buildbot/rpm//BUILD/ngx_devel_kit-0.2.14

# gdb nginx nginx.core
GNU gdb (GDB) Red Hat Enterprise Linux (7.2-60.el6_4.1)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/local/nginx/sbin/nginx...done.
[New Thread 24331]

...

#0  ngx_http_spdy_close_stream_handler (ev=0x754eb58) at
src/http/ngx_http_spdy.c:3353
3353    src/http/ngx_http_spdy.c: No such file or directory.
        in src/http/ngx_http_spdy.c
Missing separate debuginfos, use: debuginfo-install
nginx-rb-1.9.52-1.x86_64
(gdb) directory nginx-1.9.2
Source directories searched: nginx-1.9.2:$cdir:$cwd
(gdb) bt
#0  ngx_http_spdy_close_stream_handler (ev=0x754eb58) at
src/http/ngx_http_spdy.c:3353
#1  0x0000000000482562 in ngx_http_spdy_write_handler (wev=<value optimized
out>) at src/http/ngx_http_spdy.c:649
#2  0x0000000000435f26 in ngx_event_process_posted (cycle=0xcc6a20,
posted=0x76fcd0) at src/event/ngx_event_posted.c:33
#3  0x000000000043ce85 in ngx_worker_process_cycle (cycle=0xcc6a20,
data=<value optimized out>) at src/os/unix/ngx_process_cycle.c:769
#4  0x000000000043b234 in ngx_spawn_process (cycle=0xcc6a20, proc=0x43cdb0
<ngx_worker_process_cycle>, data=0x10, name=0x4f98b3 "worker process",
respawn=-4) at src/os/unix/ngx_process.c:198
#5  0x000000000043c1cc in ngx_start_worker_processes (cycle=0xcc6a20, n=23,
type=-4) at src/os/unix/ngx_process_cycle.c:358
#6  0x000000000043dbd8 in ngx_master_process_cycle (cycle=0xcc6a20) at
src/os/unix/ngx_process_cycle.c:243
#7  0x000000000041b856 in main (argc=<value optimized out>, argv=<value
optimized out>) at src/core/nginx.c:415
(gdb) list
3348        ngx_http_request_t  *r;
3349
3350        fc = ev->data;
3351        r = fc->data;
3352
3353        ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
3354                       "spdy close stream handler");
3355
3356        ngx_http_spdy_close_stream(r->spdy_stream, 0);
3357    }
(gdb) p r
$1 = (ngx_http_request_t *) 0x0
(gdb) p fc
$2 = (ngx_connection_t *) 0x754ea20
(gdb) p *fc
$3 = {data = 0x0, read = 0x754eaf8, write = 0x754eb58, fd = 1041, recv =
0x4424e0 <ngx_ssl_recv>, send = 0x441e90 <ngx_ssl_write>, recv_chain =
0x442990 <ngx_ssl_recv_chain>, send_chain = 0x484830
<ngx_http_spdy_send_chain>, listening = 0xcc6f00, sent = 16770, 
  log = 0x754ebb8, pool = 0x1edb9a0, sockaddr = 0x1edb9f0, socklen = 16,
addr_text = {len = 11, data = 0x1edba50 "83.149.9.264"}, proxy_protocol_addr
= {len = 0, data = 0x0}, ssl = 0x53307b8, local_sockaddr = 0xe773e0,
local_socklen = 16, buffer = 0x0, queue = {
    prev = 0x0, next = 0x0}, number = 68976568, requests = 7, buffered = 2,
log_error = 2, unexpected_eof = 0, timedout = 0, error = 1, destroyed = 1,
idle = 0, reusable = 0, close = 0, sendfile = 1, sndlowat = 1, tcp_nodelay =
2, tcp_nopush = 0, need_last_buf = 1}
(gdb) p ev
$4 = (ngx_event_t *) 0x754eb58
(gdb) p *ev
$5 = {data = 0x754ea20, write = 1, accept = 0, instance = 0, active = 0,
disabled = 0, ready = 1, oneshot = 0, complete = 0, eof = 0, error = 0,
timedout = 0, timer_set = 0, delayed = 0, deferred_accept = 0, pending_eof =
0, posted = 0, closed = 0, channel = 0, 
  resolver = 0, cancelable = 0, available = 0, handler = 0x47ed90
<ngx_http_spdy_close_stream_handler>, index = 0, log = 0x754ebb8, timer =
{key = 0, left = 0x0, right = 0x0, parent = 0x0, color = 0 '\000', data = 0
'\000'}, queue = {prev = 0x0, next = 0x0}}
(gdb) f 1
#1  0x0000000000482562 in ngx_http_spdy_write_handler (wev=<value optimized
out>) at src/http/ngx_http_spdy.c:649
649             wev->handler(wev);
(gdb) list
644
645             ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
646                            "run spdy stream %ui", stream->id);
647
648             wev = stream->request->connection->write;
649             wev->handler(wev);
650         }
651
652         sc->blocked = 0;
653
(gdb) p wev
$6 = <value optimized out>
(gdb) p stream
$7 = (ngx_http_spdy_stream_t *) 0x66a7150
(gdb) p *stream
$8 = {id = 13, request = 0x66a64c0, connection = 0x39861e0, index = 0x0,
header_buffers = 0, queued = 0, send_window = 40500, recv_window =
2147483647, free_frames = 0x10ec518, free_data_headers = 0x10ec558,
free_bufs = 0x10ec4b8, queue = {prev = 0x0, next = 0x0}, 
  priority = 4, handled = 0, blocked = 0, exhausted = 0, in_closed = 1,
out_closed = 1, skip_data = 1}
(gdb) p stream->request
$9 = (ngx_http_request_t *) 0x66a64c0
(gdb) p *stream->request
$10 = {signature = 1347703880, connection = 0x754ea20, ctx = 0x66a6df8,
main_conf = 0xcc76e0, srv_conf = 0xd2a178, loc_conf = 0xd3a0c0,
read_event_handler = 0x454ee0 <ngx_http_test_reading>, write_event_handler =
0x4521f0 <ngx_http_terminate_handler>, cache = 0x0, 
  upstream = 0x0, upstream_states = 0x0, pool = 0x0, header_in = 0x66a7100,
headers_in = {headers = {last = 0x66a6530, part = {elts = 0x10ebb50, nelts =
5, next = 0x0}, size = 48, nalloc = 20, pool = 0x66a6470}, host = 0x10ebb50,
connection = 0x0, 
    if_modified_since = 0x0, if_unmodified_since = 0x0, if_match = 0x0,
if_none_match = 0x0, user_agent = 0x10ebc10, referer = 0x0, content_length =
0x0, content_type = 0x0, range = 0x0, if_range = 0x0, transfer_encoding =
0x0, expect = 0x0, upgrade = 0x0, 
    accept_encoding = 0x10ebbb0, via = 0x0, authorization = 0x0, keep_alive
= 0x0, x_forwarded_for = {elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool
= 0x0}, x_real_ip = 0x0, user = {len = 0, data = 0x0}, passwd = {len = 0,
data = 0x0}, cookies = {elts = 0x66a71c0, 
      nelts = 0, size = 8, nalloc = 2, pool = 0x66a6470}, server = {len =
11, data = 0x10eb761 "r.mradx.net"}, content_length_n = -1, keep_alive_n =
-1, connection_type = 1, chunked = 0, msie = 0, msie6 = 0, opera = 0, gecko
= 0, chrome = 0, safari = 0, konqueror = 0}, 
  headers_out = {headers = {last = 0x66a66a0, part = {elts = 0x66a6a38,
nelts = 4, next = 0x0}, size = 48, nalloc = 20, pool = 0x66a6470}, status =
200, status_line = {len = 0, data = 0x0}, server = 0x0, date = 0x0,
content_length = 0x0, content_encoding = 0x0, 
    location = 0x0, refresh = 0x0, last_modified = 0x0, content_range = 0x0,
accept_ranges = 0x66a6ac8, www_authenticate = 0x0, expires = 0x66a6a68, etag
= 0x66a6a38, override_charset = 0x0, content_type_len = 10, content_type =
{len = 10, 
      data = 0xd84f60 "image/jpeg"}, charset = {len = 0, data = 0x0},
content_type_lowcase = 0x0, content_type_hash = 0, cache_control = {elts =
0x66a7468, nelts = 1, size = 8, nalloc = 1, pool = 0x66a6470},
content_length_n = 25036, date_time = 0, 
    last_modified_time = 1434536173}, request_body = 0x0, lingering_time =
0, start_sec = 1435303301, start_msec = 143, method = 2, http_version =
1001, request_line = {len = 0, data = 0x66a71d0 "GET /img/BA/1F3F84.jpg
HTTP/1.1"}, uri = {len = 18, 
    data = 0x10eb78b "/img/BA/1F3F84.jpg"}, args = {len = 0, data = 0x0},
exten = {len = 3, data = 0x10eb79a "jpg"}, unparsed_uri = {len = 18, data =
0x10eb78b "/img/BA/1F3F84.jpg"}, method_name = {len = 3, data = 0x66a71d0
"GET /img/BA/1F3F84.jpg HTTP/1.1"}, 
  http_protocol = {len = 8, data = 0x10eb7c1 "HTTP/1.1"}, out = 0x0, main =
0x66a64c0, parent = 0x0, postponed = 0x0, post_subrequest = 0x0,
posted_requests = 0x0, phase_handler = 18, content_handler = 0, access_code
= 0, variables = 0x66a6fa0, ncaptures = 0, 
  captures = 0x66a71f0, captures_data = 0x0, limit_rate = 0,
limit_rate_after = 0, header_size = 386, request_length = 301, err_status =
0, http_connection = 0x5330770, spdy_stream = 0x66a7150, log_handler =
0x452510 <ngx_http_log_error_handler>, cleanup = 0x0, 
  subrequests = 201, count = 0, blocked = 0, aio = 0, http_state = 6,
complex_uri = 0, quoted_uri = 0, plus_in_uri = 0, space_in_uri = 0,
invalid_header = 0, add_uri_to_alias = 0, valid_location = 1,
valid_unparsed_uri = 1, uri_changed = 0, uri_changes = 11, 
  request_body_in_single_buf = 0, request_body_in_file_only = 0,
request_body_in_persistent_file = 0, request_body_in_clean_file = 0,
request_body_file_group_access = 0, request_body_file_log_level = 5,
request_body_no_buffering = 0, subrequest_in_memory = 0, 
  waited = 0, cached = 0, gzip_tested = 0, gzip_ok = 0, gzip_vary = 0, proxy
= 0, bypass_cache = 0, no_cache = 0, limit_conn_set = 0, limit_req_set = 0,
pipeline = 0, chunked = 0, header_only = 0, keepalive = 0, lingering_close =
0, discard_body = 0, reading_body = 0, 
  internal = 0, error_page = 0, filter_finalize = 0, post_action = 0,
request_complete = 0, request_output = 1, header_sent = 1, expect_tested =
0, root_tested = 1, done = 0, logged = 0, buffered = 0,
main_filter_need_in_memory = 1, filter_need_in_memory = 0, 
  filter_need_temporary = 0, allow_ranges = 1, single_range = 0,
disable_not_modified = 0, stat_reading = 0, stat_writing = 1, state = 0,
header_hash = 3194399592611459, lowcase_index = 18446744073709551615,
lowcase_header = '\000' <repeats 31 times>, 
  header_name_start = 0x10eb81b "user-agent", header_name_end = 0x10eb825
"", header_start = 0x10eb829 "CFNetwork/711.3.18 Darwin/14.0.0", header_end
= 0x10eb861 "", uri_start = 0x66a64c0 "HTTP", uri_end = 0x0, uri_ext =
0x10eb79a "jpg", 
  args_start = 0x0, request_start = 0x0, request_end = 0x0, method_end =
0x0, schema_start = 0x10eb7ac "https", schema_end = 0x10eb7b1 "", host_start
= 0x0, host_end = 0x0, port_start = 0x0, port_end = 0x0, http_minor = 1,
http_major = 1, content_start_sec = 0, 
  content_start_msec = 0, content_end_sec = 0, content_end_msec = 0,
gzip_process = 0, gzip_start_sec = 0, gzip_start_msec = 0, gzip_end_sec = 0,
gzip_end_msec = 0}
(gdb) p stream->request->connection
$11 = (ngx_connection_t *) 0x754ea20
(gdb) p *stream->request->connection
$12 = {data = 0x0, read = 0x754eaf8, write = 0x754eb58, fd = 1041, recv =
0x4424e0 <ngx_ssl_recv>, send = 0x441e90 <ngx_ssl_write>, recv_chain =
0x442990 <ngx_ssl_recv_chain>, send_chain = 0x484830
<ngx_http_spdy_send_chain>, listening = 0xcc6f00, sent = 16770, 
  log = 0x754ebb8, pool = 0x1edb9a0, sockaddr = 0x1edb9f0, socklen = 16,
addr_text = {len = 11, data = 0x1edba50 "83.149.9.264"}, proxy_protocol_addr
= {len = 0, data = 0x0}, ssl = 0x53307b8, local_sockaddr = 0xe773e0,
local_socklen = 16, buffer = 0x0, queue = {
    prev = 0x0, next = 0x0}, number = 68976568, requests = 7, buffered = 2,
log_error = 2, unexpected_eof = 0, timedout = 0, error = 1, destroyed = 1,
idle = 0, reusable = 0, close = 0, sendfile = 1, sndlowat = 1, tcp_nodelay =
2, tcp_nopush = 0, need_last_buf = 1}
(gdb) p stream->request->connection->write
$13 = (ngx_event_t *) 0x754eb58
(gdb) p *stream->request->connection->write
$14 = {data = 0x754ea20, write = 1, accept = 0, instance = 0, active = 0,
disabled = 0, ready = 1, oneshot = 0, complete = 0, eof = 0, error = 0,
timedout = 0, timer_set = 0, delayed = 0, deferred_accept = 0, pending_eof =
0, posted = 0, closed = 0, channel = 0, 
  resolver = 0, cancelable = 0, available = 0, handler = 0x47ed90
<ngx_http_spdy_close_stream_handler>, index = 0, log = 0x754ebb8, timer =
{key = 0, left = 0x0, right = 0x0, parent = 0x0, color = 0 '\000', data = 0
'\000'}, queue = {prev = 0x0, next = 0x0}}
(gdb)

Posted at Nginx Forum: http://forum.nginx.org/read.php?21,260009,260009#msg-260009