joyent/node — Issue #2438: segfault in node v0.6.6
Author: ry
Created: 2011-12-29 21:35:37+00:00
State: open

Experiencing crashes in what appears to be a bad ref in node_http_parser.cc during `StringPtr::Update`.

```
(gdb) bt
#0 0x00007f470e1fcd30 in memcpy () from /lib/libc.so.6
#1 0x000000000053e58b in node::StringPtr::Update (p_=,
at=0x662efea "92395c572&now=1325093117.714518 HTTP/1.1\r\nHost: prod-nr263.vox^?\226?\217\027RIR\031J\026\222\231{94\\?\202??\235\a??.?K? \017\004\061a\n 9d8\nyR\026S]\234??S?c?@\034\030?9@??ſ?\217z\213\004\061f\n 9ec\nyj???\016??\212?ȿ\fs\225H\035?\210\205?a\f?GU?y/f\017\004\061b\n a00\ny\212\217\035m޺?\226\204"...,
length=31) at /usr/include/bits/string3.h:52
#2 node::Parser::on_url_ (p_=,
at=0x662efea "92395c572&now=1325093117.714518 HTTP/1.1\r\nHost: prod-nr263.vox^?\226?\217\027RIR\031J\026\222\231{94\\?\202??\235\a??.?K? \017\004\061a\n 9d8\nyR\026S]\234??S?c?@\034\030?9@??ſ?\217z\213\004\061f\n 9ec\nyj???\016??\212?ȿ\fs\225H\035?\210\205?a\f?GU?y/f\017\004\061b\n a00\ny\212\217\035m޺?\226\204"...,
length=31) at ../src/node_http_parser.cc:250
#3 node::Parser::on_url (p_=,
at=0x662efea "92395c572&now=1325093117.714518 HTTP/1.1\r\nHost: prod-nr263.vox^?\226?\217\027RIR\031J\026\222\231{94\\?\202??\235\a??.?K? \017\004\061a\n 9d8\nyR\026S]\234??S?c?@\034\030?9@??ſ?\217z\213\004\061f\n 9ec\nyj???\016??\212?ȿ\fs\225H\035?\210\205?a\f?GU?y/f\017\004\061b\n a00\ny\212\217\035m޺?\226\204"...,
length=31) at ../src/node_http_parser.cc:248
#4 0x000000000057aa5b in http_parser_execute (parser=0x4bb72e8, settings=0xc3d000, data=,
len=) at ../deps/http_parser/http_parser.c:993
#5 0x000000000053e3b6 in node::Parser::Execute (args=) at ../src/node_http_parser.cc:457
#6 0x00000000005a9d41 in v8::internal::Builtin_HandleApiCall(v8::internal::(anonymous namespace)::BuiltinArguments<(v8::internal::BuiltinExtraArguments)1>, v8::internal::Isolate*) ()
```

Crashes are very rare. At first we thought this was a problem with missing `HandleScope` and made 73cf8e82e768af870964d6f3375ab758e774165c to fix it. It turns out that didn't stop the problems and was reverted in 448c5e07ca594399f3d3f93ea6f97124ea56af95.

cc @mranney @bnoordhuis