Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: Stefan Fritsch <sf@sfritsch.de>
To: dev@httpd.apache.org
Subject: Re: Proxy regressions
Date: Tue, 9 Nov 2010 21:54:17 +0100
User-Agent: KMail/1.13.5 (Linux/2.6.32-5-amd64; KDE/4.4.5; x86_64; ; )
References: <201011032112.06345.sf@sfritsch.de>
 <201011032128.12775.sf@sfritsch.de>
 <6224351D-B10A-43C0-AC9C-5349C3BE4DDB@sharp.fm>
In-Reply-To: <6224351D-B10A-43C0-AC9C-5349C3BE4DDB@sharp.fm>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="iso-8859-15"
Content-Transfer-Encoding: 7bit
Message-Id: <201011092154.19384.sf@sfritsch.de>

On Thursday 04 November 2010, Graham Leggett wrote:
> On 03 Nov 2010, at 10:28 PM, Stefan Fritsch wrote:
> > Strange, I have these problems only with prefork, not with event.
> > But with event I get a segfault in the reslist cleanup code.
> > 
> > Can somebody cross-check this?
> 
> This smelled like a pool lifetime issue, and looking closer it
> looked like we were cleaning up a brigade after we had returned
> the backend to the pool. The attached patch stops the crash, and
> it seems to run at a sensible speed again (I suspect the late
> cleanup of the brigade was sending the code into a spin). Can you
> give it a try?
> 
> One proxy test still fails though:
> 
> t/modules/proxy.............ok 7/15# Failed test 10 in t/modules/
> proxy.t at line 34
> t/modules/proxy.............FAILED test 10
> 	Failed 1/15 tests, 93.33% okay
> 
> This fails because the first bucket of the response has been
> corrupted:
> 
> graham-leggetts-macbook-pro-3:httpd-test minfrin$ curl
> http://localhost:8536/reverse/modules/cgi/nph-102.pl sl/2.3.9-dev
> OpenS
> 
> I've seen this a few weeks ago and it went away, so I suspect this
> isn't proxy that's doing it. Need to dig further.

The fix in r1030855 is wrong: ap_proxy_buckets_lifetime_transform is 
not copying the data but only creates transient buckets from the data 
in the buckets in bb. If you then destroy bb before passing pass_bb, 
the data where the buckets in pass_bb point gets freed and later gets 
overwritten.

Cheers,
Stefan