sefaults on log

[Franchoze Eric]

Sometimes I have segfaults nginx thread on trying to write error log. 
>From  this back trace it's  unclear for me why nginx does not fail on thngx_connection_error() with dereferencing c(0x0)->log.  
Is it gdb bug?

Core was generated by `nginx: worker process                   '.
Program terminated with signal 11, Segmentation fault.
#0  0x000000348d47be50 in strncasecmp_l () from /lib64/libc.so.6
(gdb) bt
#0  0x000000348d47be50 in strncasecmp_l () from /lib64/libc.so.6
#1  0x0000000000408871 in ngx_vslprintf (buf=0x7fff4ecdac27 "", last=0x7fff4ecdb340 " ", fmt=<value optimized out>, args=0x7fff4ecda9f0) at src/core/ngx_string.c:235
#2  0x0000000000409465 in ngx_snprintf (buf=0x7fff4ecdac27 "", max=<value optimized out>, fmt=0x716 <Address 0x716 out of bounds>) at src/core/ngx_string.c:122
#3  0x0000000000428628 in ngx_http_log_error_handler (r=0x1180fe0, sr=0x1180fe0, buf=<value optimized out>, len=<value optimized out>) at src/http/ngx_http_request.c:3122
#4  0x000000000042873c in ngx_http_log_error (log=<value optimized out>, 
    buf=0x7fff4ecdabb8 ", client: 10.31.64.39, server: hss, request: \"GET /x/653606414/false/p_100000276486951=0 HTTP/1.1\", upstream: \"", len=4294967293) at src/http/ngx_http_request.c:3061
#5  0x0000000000404a65 in ngx_log_error_core (level=2, log=0x894b50, err=14, fmt=0x463df1 "recv() failed") at src/core/ngx_log.c:133
#6  0x000000000040dd8a in ngx_connection_error (c=0x0, err=0, text=0xfffffffd <Address 0xfffffffd out of bounds>) at src/core/ngx_connection.c:1015
#7  0x000000000041a6b1 in ngx_unix_recv (c=0xdce4a0, buf=0x69640a7d646c6f62 <Address 0x69640a7d646c6f62 out of bounds>, size=490371890246388487) at src/os/unix/ngx_recv.c:164
#8  0x00000000004384dd in ngx_http_upstream_process_header (r=0x1180fe0, u=0x8c38b20) at src/http/ngx_http_upstream.c:1506
#9  0x00000000004369b2 in ngx_http_upstream_handler (ev=<value optimized out>) at src/http/ngx_http_upstream.c:898
#10 0x000000000041e746 in ngx_epoll_process_events (cycle=<value optimized out>, timer=<value optimized out>, flags=<value optimized out>) at src/event/modules/ngx_epoll_module.c:642
#11 0x00000000004179a8 in ngx_process_events_and_timers (cycle=0x889110) at src/event/ngx_event.c:245
#12 0x000000000041d3e0 in ngx_worker_process_cycle (cycle=0x889110, data=<value optimized out>) at src/os/unix/ngx_process_cycle.c:795
#13 0x000000000041bd27 in ngx_spawn_process (cycle=0x889110, proc=0x41d318 <ngx_worker_process_cycle>, data=0x0, name=0x464649 "worker process", respawn=-3) at src/os/unix/ngx_process.c:196
#14 0x000000000041ca79 in ngx_start_worker_processes (cycle=0x889110, n=12, type=-3) at src/os/unix/ngx_process_cycle.c:355
#15 0x000000000041d944 in ngx_master_process_cycle (cycle=0x889110) at src/os/unix/ngx_process_cycle.c:136
#16 0x00000000004044fa in main (argc=22, argv=0x8880e0) at src/core/nginx.c:401
(gdb) up
#1  0x0000000000408871 in ngx_vslprintf (buf=0x7fff4ecdac27 "", last=0x7fff4ecdb340 " ", fmt=<value optimized out>, args=0x7fff4ecda9f0) at src/core/ngx_string.c:235
235	                buf = ngx_cpymem(buf, v->data, len);
(gdb) up
#2  0x0000000000409465 in ngx_snprintf (buf=0x7fff4ecdac27 "", max=<value optimized out>, fmt=0x716 <Address 0x716 out of bounds>) at src/core/ngx_string.c:122
122	    p = ngx_vslprintf(buf, buf + max, fmt, args);
(gdb) up
#3  0x0000000000428628 in ngx_http_log_error_handler (r=0x1180fe0, sr=0x1180fe0, buf=<value optimized out>, len=<value optimized out>) at src/http/ngx_http_request.c:3122
3122	        p = ngx_snprintf(buf, len, ", upstream: \"%V%V%s%V\"",
(gdb) up
#4  0x000000000042873c in ngx_http_log_error (log=<value optimized out>, 
    buf=0x7fff4ecdabb8 ", client: 10.31.64.39, server: hss, request: \"GET /x/653606414/false/p_100000276486951=0 HTTP/1.1\", upstream: \"", len=4294967293) at src/http/ngx_http_request.c:3061
3061	        return r->log_handler(r, ctx->current_request, p, len);
(gdb) up
#5  0x0000000000404a65 in ngx_log_error_core (level=2, log=0x894b50, err=14, fmt=0x463df1 "recv() failed") at src/core/ngx_log.c:133
133	        p = log->handler(log, p, last - p);
(gdb) up
#6  0x000000000040dd8a in ngx_connection_error (c=0x0, err=0, text=0xfffffffd <Address 0xfffffffd out of bounds>) at src/core/ngx_connection.c:1015
1015	    ngx_log_error(level, c->log, err, text);
(gdb)

X86/64 (64 bit nginx).
nginx version: afts/0.8.50
built by gcc 4.1.2 20080704 (Red Hat 4.1.2-48)
configure arguments: --prefix=/usr --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --pid-path=/var/run/nginx.pid --lock-path=/var/lock/nginx.lock --user=www --group=www --with-http_flv_module --with-http_gzip_static_module --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/nginx/client/ --http-proxy-temp-path=/var/nginx/proxy/ --http-fastcgi-temp-path=/var/nginx/fcgi/ --with-http_stub_status_module --add-module=/usr/src/redhat/SOURCES/af-headers --add-module=/usr/src/redhat/SOURCES/echo-module --add-module=/usr/src/redhat/SOURCES/gunzip