Здравствуйте.

Периодически, в произвольном порядке, отпадают workers по SIGSEGV. При этом соединение с клиентом разрывается и он получает ошибку "Connection was reset".

Похоже функция ngx_palloc передает неправильную ссылку.

Вот кое-какая отладочная информация. Пользуюсь связкой nginx + php-fpm.
Даже не знаю в какую сторону копать. Помогите, пожалуйста.

-------------------------------------------------------
(gdb) frame 1
#1 0x0000000000414d9a in ngx_pcalloc (pool=0x8066ad000, size=856) at src/core/ngx_palloc.c:307
307 ngx_memzero(p, size);

(gdb) p *pool
$1 = {d = {last = 0x8066adfff "P�Lyy.", end = 0x8066ae000 "�Lyy.", next = 0x8066ae000, failed = 0}, max = 4016, current = 0x8066ad000, chain = 0x0, large = 0x0, cleanup = 0x0,
log = 0x8057db160}

(gdb) p *pool.d->next
$2 = {d = {last = 0x2e79794cd0 <Address 0x2e79794cd0 out of bounds>, end = 0x8066af000 "��j\006\b", next = 0x0, failed = 0}, max = 268435456, current = 0x4fcb3b, chain = 0x0, large = 0x0,
cleanup = 0x0, log = 0x0}
-------------------------------------------------------
% uname -m -r -s
FreeBSD 9.0-RELEASE-p3 amd64

-------------------------------------------------------
# error.log
2012/11/22 04:34:19 [alert] 60064#0: worker process 93670 exited on signal 11
2012/11/22 04:34:19 [alert] 60064#0: worker process 98162 exited on signal 11
2012/11/22 04:34:23 [alert] 60064#0: worker process 93584 exited on signal 11
2012/11/22 04:34:38 [alert] 60064#0: worker process 93597 exited on signal 11

-------------------------------------------------------
# nginx.debug -V
nginx version: nginx/1.2.3
TLS SNI support enabled
configure arguments: --add-module=/usr/ports/www/nginx/files/nginx-push-stream-module
--prefix=/usr/local/etc/nginx
--with-cc-opt='-I /usr/local/include'
--with-ld-opt='-L /usr/local/lib'
--conf-path=/usr/local/etc/nginx/nginx.conf
--sbin-path=/usr/local/sbin/nginx
--pid-path=/var/run/nginx.pid
--error-log-path=/var/log/nginx-error.log
--user=www --group=www
--with-debug --with-ipv6
--http-client-body-temp-path=/var/tmp/nginx/client_body_temp --http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp --http-proxy-temp-path=/var/tmp/nginx/proxy_temp --http-scgi-temp-path=/var/tmp/nginx/scgi_temp --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp --http-log-path=/var/log/nginx-access.log
--with-http_addition_module
--add-module=/wrkdirs/usr/ports/www/nginx/work/agentzh-echo-nginx-module-d3eb42d
--add-module=/wrkdirs/usr/ports/www/nginx/work/agentzh-headers-more-nginx-module-6586984
--with-http_geoip_module --with-http_gzip_static_module --with-http_image_filter_module --with-http_perl_module
--add-module=/wrkdirs/usr/ports/www/nginx/work/nginx_http_push_module-0.692 --with-http_realip_module --with-http_stub_status_module --with-http_sub_module
--add-module=/wrkdirs/usr/ports/www/nginx/work/nginx_upload_module-2.2.0 --add-module=/wrkdirs/usr/ports/www/nginx/work/masterzen-nginx-upload-progress-module-a788dea
--with-pcre --with-http_ssl_module

-------------------------------------------------------
# gdb nginx.debug nginx-77347.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

warning: core file may not match specified executable file.
Core was generated by `nginx'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/libcrypt.so.5...done.
Loaded symbols for /lib/libcrypt.so.5
Reading symbols from /usr/local/lib/libpcre.so.1...done.
Loaded symbols for /usr/local/lib/libpcre.so.1
Reading symbols from /usr/local/lib/libssl.so.8...done.
Loaded symbols for /usr/local/lib/libssl.so.8
Reading symbols from /usr/local/lib/libcrypto.so.8...done.
Loaded symbols for /usr/local/lib/libcrypto.so.8
Reading symbols from /lib/libz.so.6...done.
Loaded symbols for /lib/libz.so.6
Reading symbols from /usr/local/lib/libgd.so.4...done.
Loaded symbols for /usr/local/lib/libgd.so.4
Reading symbols from /usr/local/lib/libGeoIP.so.5...done.
Loaded symbols for /usr/local/lib/libGeoIP.so.5
Reading symbols from /usr/local/lib/perl5/5.14.2/mach/CORE/libperl.so...done.
Loaded symbols for /usr/local/lib/perl5/5.14.2/mach/CORE/libperl.so
Reading symbols from /lib/libm.so.5...done.
Loaded symbols for /lib/libm.so.5
Reading symbols from /lib/libutil.so.9...done.
Loaded symbols for /lib/libutil.so.9
Reading symbols from /lib/libc.so.7...done.
Loaded symbols for /lib/libc.so.7
Reading symbols from /lib/libthr.so.3...done.
Loaded symbols for /lib/libthr.so.3
Reading symbols from /usr/local/lib/libfontconfig.so.1...done.
Loaded symbols for /usr/local/lib/libfontconfig.so.1
Reading symbols from /usr/local/lib/libpng15.so.15...done.
Loaded symbols for /usr/local/lib/libpng15.so.15
Reading symbols from /usr/local/lib/libjpeg.so.11...done.
Loaded symbols for /usr/local/lib/libjpeg.so.11
Reading symbols from /usr/local/lib/libfreetype.so.9...done.
Loaded symbols for /usr/local/lib/libfreetype.so.9
Reading symbols from /usr/lib/libbz2.so.4...done.
Loaded symbols for /usr/lib/libbz2.so.4
Reading symbols from /usr/local/lib/libexpat.so.6...done.
Loaded symbols for /usr/local/lib/libexpat.so.6
Reading symbols from /usr/local/lib/perl5/site_perl/5.14.2/mach/auto/nginx/nginx.so...done.
Loaded symbols for /usr/local/lib/perl5/site_perl/5.14.2/mach/auto/nginx/nginx.so
Reading symbols from /libexec/ld-elf.so.1...done.
Loaded symbols for /libexec/ld-elf.so.1
#0 0x00000008023237e4 in memset () from /lib/libc.so.7
[New Thread 803807400 (LWP 229509/<unknown>)]
[New LWP 228743]
(gdb) bt full
#0 0x00000008023237e4 in memset () from /lib/libc.so.7
No symbol table info available.
#1 0x0000000000414d9a in ngx_pcalloc (pool=0x8066ad000, size=856) at src/core/ngx_palloc.c:307
p = (void *) 0x2e79794978
#2 0x0000000000475545 in ngx_http_upstream_create (r=0x8072b9500) at src/http/ngx_http_upstream.c:397
u = (ngx_http_upstream_t *) 0x0
#3 0x00000000004b6c6e in ngx_http_fastcgi_handler (r=0x8072b9500) at src/http/modules/ngx_http_fastcgi_module.c:588
rc = 5
u = (ngx_http_upstream_t *) 0x0
f = (ngx_http_fastcgi_ctx_t *) 0x5
flcf = (ngx_http_fastcgi_loc_conf_t *) 0x0
#4 0x000000000045326d in ngx_http_core_content_phase (r=0x8072b9500, ph=0x807a9f158) at src/http/ngx_http_core_module.c:1396
root = 34445361696
rc = 0
path = {len = 34488316200, data = 0x8072b9500 "HTTP"}
#5 0x0000000000451da2 in ngx_http_core_run_phases (r=0x8072b9500) at src/http/ngx_http_core_module.c:877
rc = -2
ph = (ngx_http_phase_handler_t *) 0x807a9f020
cmcf = (ngx_http_core_main_conf_t *) 0x8038fe228
#6 0x0000000000451d1d in ngx_http_handler (r=0x8072b9500) at src/http/ngx_http_core_module.c:860
cmcf = (ngx_http_core_main_conf_t *) 0x8038fe228
#7 0x0000000000455a1f in ngx_http_internal_redirect (r=0x8072b9500, uri=0x7fffffffd550, args=0x7fffffffd540) at src/http/ngx_http_core_module.c:2545
cscf = (ngx_http_core_srv_conf_t *) 0x80518a418
#8 0x0000000000452e46 in ngx_http_core_try_files_phase (r=0x8072b9500, ph=0x807a9f140) at src/http/ngx_http_core_module.c:1308
len = 38
root = 50
alias = 0
reserve = 11
allocated = 17
p = (u_char *) 0x45267e "H\211E�H\203}��u'H\213E�H\213\200�\003"
name = (u_char *) 0x8066adf49 "/index.php/orders/available_feed.html"
path = {len = 37, data = 0x8066adf49 "/index.php/orders/available_feed.html"}
args = {len = 0, data = 0x8072b9500 "HTTP"}
test_dir = 0
tf = (ngx_http_try_file_t *) 0x8051a7e88
of = {fd = -1, uniq = 0, mtime = 0, size = 0, fs_size = 0, directio = 9223372036854775807, read_ahead = 0, err = 2, failed = 0x4f6276 "stat()", valid = 60, min_uses = 1,
disable_symlinks_from = 0, disable_symlinks = 0, test_dir = 0, test_only = 1, log = 0, errors = 0, events = 0, is_dir = 0, is_file = 0, is_link = 0, is_exec = 0, is_directio = 0}
code = 0x472eb0 <ngx_http_script_copy_var_code>
e = {ip = 0x8051a8030 "", pos = 0x8066adf6e "", sp = 0x0, buf = {len = 0, data = 0x0}, line = {len = 0, data = 0x0}, args = 0x0, flushed = 1, skip = 0, quote = 0, is_args = 0, log = 0,
status = 0, request = 0x8072b9500}
clcf = (ngx_http_core_loc_conf_t *) 0x8051a69c8
lcode = 0x472e00 <ngx_http_script_copy_var_len_code>
#9 0x0000000000451da2 in ngx_http_core_run_phases (r=0x8072b9500) at src/http/ngx_http_core_module.c:877
rc = -2
ph = (ngx_http_phase_handler_t *) 0x807a9f020
cmcf = (ngx_http_core_main_conf_t *) 0x8038fe228
#10 0x0000000000451d1d in ngx_http_handler (r=0x8072b9500) at src/http/ngx_http_core_module.c:860
cmcf = (ngx_http_core_main_conf_t *) 0x80d008260
#11 0x00000000004609d4 in ngx_http_process_request (r=0x8072b9500) at src/http/ngx_http_request.c:1685
c = (ngx_connection_t *) 0x807c090d0

-------------------------------------------------------