Nginx 0.4.9 crashes using /dev/poll on Solaris 10 on Sparc

[Per Jonsson]

We're running Nginx 0.4.9 on Solaris 10 on Sparc, and are experiencing 
worker processes that are crashing with SIGSEGV.

Running a debugger which I'm not feeling very at home with, I believe that 
I managed to locate the offending code.

The debugger gives:
root at facexpaces objs # mdb nginx
> ::run
mdb: fork1 detected: follow (p)arent or (c)hild? c
mdb: target forked child process 15778 (debugger following child)
mdb: fork1 detected: follow (p)arent or (c)hild? c
mdb: target forked child process 15779 (debugger following child)
mdb: stop on SIGSEGV
mdb: target stopped at:
ngx_devpoll_process_events+0x208:       ld        [%i1 + 0xc], %g1
mdb: You've got symbols!
Loading modules: [ ld.so.1 libc.so.1 ]
> ::regs
%g0 = 0x00000000                 %l0 = 0x00000001 
%g1 = 0x00000194                 %l1 = 0x00000001 
%g2 = 0x00000000                 %l2 = 0x00000016 
%g3 = 0x00000000                 %l3 = 0x00096a88 
%g4 = 0x00000000                 %l4 = 0x00000000 
%g5 = 0x00000000                 %l5 = 0x00092c00 
%g6 = 0x00000000                 %l6 = 0x04000000 
%g7 = 0xff392000                 %l7 = 0x00004000 
%o0 = 0x000d4250                 %i0 = 0x0008ac00 
%o1 = 0x00096d50                 %i1 = 0x00000000 
%o2 = 0xffbff9d0                 %i2 = 0x00000000 
%o3 = 0x00000000                 %i3 = 0x00000000 
%o4 = 0x00096a88                 %i4 = 0x0006bc00 
%o5 = 0x000cb7f8                 %i5 = 0x0006bc00 
%o6 = 0xffbff968                 %i6 = 0xffbff9f0 
%o7 = 0x0002efe0 ngx_devpoll_process_events+0x44c %i7 = 0x00023750 
ngx_process_events_and_timers+0xb8

 %psr = 0xfe901006 impl=0xf ver=0xe icc=NzvC
                   ec=0 ef=4096 pil=0 s=0 ps=0 et=0 cwp=0x6
   %y = 0x00000003
  %pc = 0x0002ed9c ngx_devpoll_process_events+0x208
 %npc = 0x0002eda0 ngx_devpoll_process_events+0x20c
  %sp = 0xffbff968
  %fp = 0xffbff9f0

 %wim = 0x00000000
 %tbr = 0x00000000
> 

Looking at the code I believe that it's line 403 in ngx_devpoll_module.c, 
inside the function ngx_devpoll_process_events.
     for (i = 0; i < events; i++) {
        c = ngx_cycle->files[event_list[i].fd];

>       if (c->fd == -1) {
            if (c->read->closed) {
                continue;
            }

            ngx_log_error(NGX_LOG_ALERT, cycle->log, 0, "unexpected event");
            continue;
        }



I hope that this bugreport is helpful, and are willing to help locating the
problem further, and testing possible solutions.

Best Regards,



Per
Lysator Academic Computer Society