После обновления с 1.6.3 до 1.10.1 зачастили segfault'ы воркеров.

Ср Окт 5 21:30:59 UTC 2016

Всем привет! 
Subj. Воркеры стали падать по 11-му сигналу пару раз в день. В результате
"залипают" кэши некоторых страниц. Пока прикрутил вот такой костыль в кроне 

/usr/local/sbin/logtail /var/log/nginx/alert.log | /usr/bin/grep
'\[alert\].*exited on signal 11' && /usr/sbin/service nginx restart;
но долго так оставлять не хочется. Хотелось бы понять что надо подкрутит,
чтобы избавиться от этой напасти.
На nginx приходит в зависимости от времени суток 10k-30k запросов в секунду.
 Падения с нагрузкой не коррелируют.

# uname -a
FreeBSD zzz.zzzzzzz.zz 10.3-RELEASE-p7 FreeBSD 10.3-RELEASE-p7 #0: Thu Aug
11 18:38:15 UTC 2016    
root at amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

# nginx -V
nginx version: nginx/1.10.1
built with OpenSSL 1.0.2h  3 May 2016 (running with OpenSSL 1.0.2j  26 Sep
2016)
TLS SNI support enabled
configure arguments: --prefix=/usr/local/etc/nginx --with-cc-opt='-I
/usr/local/include' --with-ld-opt='-L /usr/local/lib'
--conf-path=/usr/local/etc/nginx/nginx.conf
--sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid
--error-log-path=/var/log/nginx/error.log --user=www --group=www
--with-file-aio --http-client-body-temp-path=/var/tmp/nginx/client_body_temp
--http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp
--http-proxy-temp-path=/var/tmp/nginx/proxy_temp
--http-scgi-temp-path=/var/tmp/nginx/scgi_temp
--http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp
--http-log-path=/var/log/nginx/access.log --with-http_dav_module
--with-http_geoip_module --with-http_gzip_static_module
--with-http_realip_module --with-http_slice_module
--with-http_stub_status_module --with-http_sub_module --with-pcre
--with-http_v2_module --with-stream --with-stream_ssl_module --with-threads
--with-http_ssl_module

# gdb /usr/local/sbin/nginx ./nginx.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you
are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...
Core was generated by `nginx'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libthr.so.3...done.
Loaded symbols for /lib/libthr.so.3
Reading symbols from /lib/libcrypt.so.5...done.
Loaded symbols for /lib/libcrypt.so.5
Reading symbols from /usr/local/lib/libpcre.so.1...done.
Loaded symbols for /usr/local/lib/libpcre.so.1
Reading symbols from /usr/local/lib/libssl.so.8...done.
Loaded symbols for /usr/local/lib/libssl.so.8
Reading symbols from /usr/local/lib/libcrypto.so.8...done.
Loaded symbols for /usr/local/lib/libcrypto.so.8
Reading symbols from /lib/libz.so.6...done.
Loaded symbols for /lib/libz.so.6
Reading symbols from /usr/local/lib/libGeoIP.so.1...done.
Loaded symbols for /usr/local/lib/libGeoIP.so.1
Reading symbols from /lib/libc.so.7...done.
Loaded symbols for /lib/libc.so.7
Reading symbols from /libexec/ld-elf.so.1...done.
Loaded symbols for /libexec/ld-elf.so.1
#0  0x000000000047e707 in ngx_http_finalize_connection (r=0x81c88d020) at
src/http/ngx_http_request.c:2549
2549        if (clcf->lingering_close == NGX_HTTP_LINGERING_ALWAYS
[New Thread 802406400 (LWP 100194/<unknown>)]
(gdb) backtrace full
#0  0x000000000047e707 in ngx_http_finalize_connection (r=0x81c88d020) at
src/http/ngx_http_request.c:2549
        clcf = (ngx_http_core_loc_conf_t *) 0x81b8854c0
#1  0x000000000047cfc3 in ngx_http_finalize_request (r=0x81c88d020, rc=-4)
at src/http/ngx_http_request.c:2271
        c = (ngx_connection_t *) 0x80280fa20
        pr = (ngx_http_request_t *) 0x0
        clcf = (ngx_http_core_loc_conf_t *) 0x17700000000
#2  0x000000000049b03c in ngx_http_upstream_finalize_request (r=0x81c88d020,
u=0x81c88e020, rc=499) at src/http/ngx_http_upstream.c:4075
        flush = 34398228152
#3  0x00000000004a32f8 in ngx_http_upstream_check_broken_connection
(r=0x81c88d020, ev=0x81e407020) at src/http/ngx_http_upstream.c:1169
        n = 8
        buf = "\034"
        err = 32767
        event = 4711209
        c = (ngx_connection_t *) 0x80280fa20
        u = (ngx_http_upstream_t *) 0x81c88e020
#4  0x000000000049be71 in ngx_http_upstream_rd_check_broken_connection
(r=0x81c88d020) at src/http/ngx_http_upstream.c:1127
No locals.
#5  0x000000000047e320 in ngx_http_request_handler (ev=0x81e407020) at
src/http/ngx_http_request.c:2194
        c = (ngx_connection_t *) 0x80280fa20
        r = (ngx_http_request_t *) 0x81c88d020
#6  0x0000000000458ed7 in ngx_kqueue_process_events (cycle=0x8024b3050,
timer=200, flags=1) at src/event/modules/ngx_kqueue_module.c:669
        events = 4
        n = 2
        i = 2
        instance = 0
        level = 140737488349120
        err = 0
        ev = (ngx_event_t *) 0x81e407020
        queue = (ngx_queue_t *) 0x44ae8c
        ts = {tv_sec = 0, tv_nsec = 200000000}
        tp = (struct timespec *) 0x7fffffffe758
#7  0x0000000000448eee in ngx_process_events_and_timers (cycle=0x8024b3050)
at src/event/ngx_event.c:242
        flags = 1
        timer = 200
        delta = 1475698621569
#8  0x0000000000456f43 in ngx_worker_process_cycle (cycle=0x8024b3050,
data=0xb) at src/os/unix/ngx_process_cycle.c:753
        worker = 11
#9  0x00000000004531d0 in ngx_spawn_process (cycle=0x8024b3050,
proc=0x456e70 <ngx_worker_process_cycle>, data=0xb, name=0x527706 "worker
process", respawn=-4)
    at src/os/unix/ngx_process.c:198
        on = 1
        pid = 0
        s = 28
#10 0x0000000000454ec9 in ngx_start_worker_processes (cycle=0x8024b3050,
n=16, type=-4) at src/os/unix/ngx_process_cycle.c:358
        i = 11
        ch = {command = 1, pid = 7163, slot = 27, fd = 24}
#11 0x0000000000454c5e in ngx_master_process_cycle (cycle=0x8024b3050) at
src/os/unix/ngx_process_cycle.c:243
        title = 0x8097f203c "master process /usr/local/sbin/nginx"
        p = (u_char *) 0x8097f2060 ""
        size = 37
        i = 1
        n = 140737488349776
        sigio = 0
        set = {__bits = {0, 0, 0, 0}}
        itv = {it_interval = {tv_sec = 0, tv_usec = 34398023784}, it_value =
{tv_sec = 0, tv_usec = 0}}
        live = 1
        delay = 0
        ls = (ngx_listening_t *) 0x0
        ccf = (ngx_core_conf_t *) 0x8024b4b68
#12 0x0000000000413448 in main (argc=1, argv=0x7fffffffed60) at
src/core/nginx.c:367
        b = (ngx_buf_t *) 0x800749c00
        log = (ngx_log_t *) 0x75f878
        i = 34389200627
        cycle = (ngx_cycle_t *) 0x802483050
        init_cycle = {conf_ctx = 0x0, pool = 0x802406800, log = 0x75f878,
new_log = {log_level = 0, file = 0x0, connection = 0, disk_full_time = 0,
handler = 0,
    data = 0x0, writer = 0, wdata = 0x0, action = 0x0, next = 0x0},
log_use_stderr = 0, files = 0x0, free_connections = 0x0, free_connection_n =
0, modules = 0x0,
  modules_n = 0, modules_used = 0, reusable_connections_queue = {prev = 0x0,
next = 0x0}, listening = {elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool
= 0x0}, paths = {
    elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0}, config_dump =
{elts = 0x0, nelts = 0, size = 0, nalloc = 0, pool = 0x0}, open_files =
{last = 0x0, part = {
      elts = 0x0, nelts = 0, next = 0x0}, size = 0, nalloc = 0, pool = 0x0},
shared_memory = {last = 0x0, part = {elts = 0x0, nelts = 0, next = 0x0},
size = 0,
    nalloc = 0, pool = 0x0}, connection_n = 0, files_n = 0, connections =
0x0, read_events = 0x0, write_events = 0x0, old_cycle = 0x0, conf_file =
{len = 31,
    data = 0x523d28 "/usr/local/etc/nginx/nginx.conf"}, conf_param = {len =
0, data = 0x0}, conf_prefix = {len = 21, data = 0x523d28
"/usr/local/etc/nginx/nginx.conf"},
  prefix = {len = 21, data = 0x523d12 "/usr/local/etc/nginx/"}, lock_file =
{len = 0, data = 0x0}, hostname = {len = 0, data = 0x0}}
        cd = (ngx_conf_dump_t *) 0x80076e000
        ccf = (ngx_core_conf_t *) 0x802484d18
Current language:  auto; currently minimal
(gdb)

Posted at Nginx Forum: https://forum.nginx.org/read.php?21,270095,270095#msg-270095