coredump in 1.10.3

[George .]

Hi all,

We've found two different coredumps in production machines running 1.10.3
handing ssl and http v2 traffic.

Here is the backtrace of version compiles with -O0 -g -ggdb



warning: exec file is newer than core file.
[New LWP 28665]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `nginx: worker process          '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00000000004aeecc in ngx_http_v2_state_window_update (h2c=0x32c8aa0,
pos=0x31a52fa "", end=0x31a5314 ")�") at src/http/v2/ngx_http_v2.c:2216

warning: Source file is more recent than executable.
2216        ngx_queue_remove(q);
(gdb) bt
#0  0x00000000004aeecc in ngx_http_v2_state_window_update (h2c=0x32c8aa0,
pos=0x31a52fa "", end=0x31a5314 ")�") at src/http/v2/ngx_http_v2.c:2216
#1  0x00000000004ab672 in ngx_http_v2_state_head (h2c=0x32c8aa0,
pos=0x31a52f6 "", end=0x31a5314 ")�") at src/http/v2/ngx_http_v2.c:774
#2  0x00000000004aa806 in ngx_http_v2_read_handler (rev=0x7f95b6ad2330) at
src/http/v2/ngx_http_v2.c:379
#3  0x00000000004b31cb in ngx_http_v2_handle_connection_handler
(rev=0x7f95b6ad2330) at src/http/v2/ngx_http_v2.c:4121
#4  0x00000000004424d6 in ngx_event_process_posted (cycle=0x2749100,
posted=0x71d430 <ngx_posted_events>) at src/event/ngx_event_posted.c:33
#5  0x000000000043fc66 in ngx_process_events_and_timers (cycle=0x2749100)
at src/event/ngx_event.c:259
#6  0x000000000044e1f1 in ngx_worker_process_cycle (cycle=0x2749100,
data=0x1) at src/os/unix/ngx_process_cycle.c:753
#7  0x000000000044a8cf in ngx_spawn_process (cycle=0x2749100, proc=0x44e0fc
<ngx_worker_process_cycle>, data=0x1, name=0x4d8c1b "worker process",
respawn=-4)
    at src/os/unix/ngx_process.c:198
#8  0x000000000044cf97 in ngx_start_worker_processes (cycle=0x2749100,
n=16, type=-4) at src/os/unix/ngx_process_cycle.c:358
#9  0x000000000044caca in ngx_master_process_cycle (cycle=0x2749100) at
src/os/unix/ngx_process_cycle.c:243
#10 0x00000000004104b1 in main (argc=1, argv=0x7ffd8b71fe48) at
src/core/nginx.c:36
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx-devel/attachments/20170313/e19e52fc/attachment.html>