# Nginx crash only when using Chromium (in ubuntu) **URL:** \ **Category:** NGINX\ **Created:** [December 30, 2012, 5:10pm UTC](https://www.ruby-forum.com/t/nginx-crash-only-when-using-chromium-in-ubuntu/225337 "2012-12-30T17:10:37Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [December 30, 2012, 5:10pm UTC](https://www.ruby-forum.com/t/nginx-crash-only-when-using-chromium-in-ubuntu/225337/1 "2012-12-30T17:10:37Z")
i could not find the cause that only when using Chromium i get a crash but when using Firefox i never don’t. some hints to the nginx experts that might help: 1. i use my handler module + filter module. (when module is disabled - no crash) 2. i use C++ code in shared lib and sometimes the crash is in the c++ object deconstructor . the object is allocated on the stack (not ptr, just regular declaration like: obj\_t obj1) and freed automatically and end of function. 3. i attach here the headers of FF / CHR browsers. 4. when using valgrind - i get some warnings (see below) but never crash, even in CHR 5. the nginx runs on vurtual machine (centos 6.3) under ubuntu 12.10. the browser runs on the ubuntu. 6. the response handler runs when subrequest returns from an upstream server, then the handler continues and goes to the filter module. 7. sometimes when using palloc i got alignment errors so i used pnalloc. is it the source of the bug ? when to use palloc and when to use pnalloc ? (see below the function that uses pnalloc) 8. when restarting nginx and doing CTRL+F5 in CHR browser (right after the previous crash) - its easy to get another crash again with the same stack trace, while when browsing to anbother page - it takes time to reproduce the crash. =============== Thread [1] (Suspended: Signal ‘SIGABRT’ received. Description: Aborted.) 15 raise() 0x00007ffff64e18a5 14 abort() 0x00007ffff64e3085 13 \_\_libc\_message() 0x00007ffff651efe7 12 malloc\_printerr() 0x00007ffff6524916 11 \_int\_free() 0x00007ffff6527443 10 ngx\_destroy\_pool() ngx\_palloc.c:87 0x0000000000406a22 9 ngx\_http\_free\_request() ngx\_http\_request.c:3081 0x000000000044dbfb 8 ngx\_http\_close\_request() ngx\_http\_request.c:3006 0x000000000044d9b3 7 ngx\_http\_terminate\_handler() ngx\_http\_request.c:2176 0x000000000044bc38 6 ngx\_http\_run\_posted\_requests() ngx\_http\_request.c:1903 0x000000000044b1ad 5 ngx\_http\_request\_handler() ngx\_http\_request.c:1869 0x000000000044b0b6 4 ngx\_epoll\_process\_events() ngx\_epoll\_module.c:683 0x00000000004377d6 3 ngx\_process\_events\_and\_timers() ngx\_event.c:247 0x00000000004281f4 2 ngx\_single\_process\_cycle() ngx\_process\_cycle.c:316 0x0000000000434442 1 main() nginx.c:409 0x0000000000403cdc valgrind: ==27496== Address 0x90c0b2d is 29 bytes inside a block of size 3,366 free’d ==27496== at 0x4C2645F: operator delete(void\*) (vg\_replace\_malloc.c:387) ==27496== by 0x59B73AD: SBB::ResponseBean::~ResponseBean() (in /usr/local/lib/libClientAPI-C-Lib.so) ==27496== by 0x57ABB04: ngx\_sbb\_med\_handle\_va\_response (in /usr/local/lib/libngx\_sbb\_mediator.so) ==27496== by 0x4A933D: ngx\_sbb\_va\_response\_handler (ngx\_sbb\_module.c:274) ==27496== by 0x4AA372: ngx\_sbb\_post\_subrequest\_handler (ngx\_sbb\_mod\_utils.c:89) ==27496== by 0x44B3C0: ngx\_http\_finalize\_request (ngx\_http\_request.c:1961) ==27496== by 0x465407: ngx\_http\_upstream\_finalize\_request (ngx\_http\_upstream.c:3095) CHR headers: GET /index.php?cat=1&pag=1&det=108 HTTP/1.1 Host: — Connection: keep-alive Cache-Control: max-age=0 User-Agent: Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.4 (KHTML, like Gecko) Ubuntu/12.10 Chromium/22.0.1229.94 Chrome/22.0.1229.94 Safari/537.4 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,_/_;q=0.8 Referer: [http://yellowmockup.com/index.php?cat=1](http://yellowmockup.com/index.php?cat=1) Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8,he;q=0.6 Accept-Charset: UTF-8,\*;q=0.5 Cookie: adOtr=4aYP5; PRLST=Ya; UTGv2=h4a59e6b096ada50ad0a1243f0549366c032; x-autozoom=150f; SPSI=56aa48be644d6ac8ccec5dd82ade576d FF headers: GET /index.php?cat=1&pag=1&det=108 HTTP/1.1 Host: — User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86\_64; rv:16.0) Gecko/20100101 Firefox/16.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,_/_;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Cookie: UTGv2=h430c577bc94965b18d99cd502407af14a80; SPSI=63c40df4be7823f2acbc8e966a8817df; PRLST=zi/Jv/DT; adOtr=04Hd6 Pragma: no-cache Cache-Control: no-cache # another crash dump: Thread [1] (Suspended: Signal ‘SIGSEGV’ received. Description: Segmentation fault.) 16 memcpy() 0x00007ffff65381ab 15 sbb\_strncpy() ngx\_sbb\_utils.c:12 0x00000000004a9e5f 14 ngx\_sbb\_utils\_str2char() ngx\_sbb\_mod\_utils.c:253 0x00000000004aaab7 13 ngx\_sbb\_med\_prepare\_va\_request() 0x00007ffff725d7b4 12 ngx\_sbb\_handler() ngx\_sbb\_module.c:229 0x00000000004a913d 11 ngx\_http\_core\_rewrite\_phase() ngx\_http\_core\_module.c:931 0x000000000043d2a1 10 ngx\_http\_core\_run\_phases() ngx\_http\_core\_module.c:877 0x000000000043d103 9 ngx\_http\_handler() ngx\_http\_core\_module.c:860 0x000000000043d07a 8 ngx\_http\_process\_request() ngx\_http\_request.c:1687 0x000000000044ac51 7 ngx\_http\_process\_request\_headers() ngx\_http\_request.c:1135 0x0000000000449809 6 ngx\_http\_process\_request\_line() ngx\_http\_request.c:933 0x0000000000448fbe 5 ngx\_http\_init\_request() ngx\_http\_request.c:519 0x000000000044873f 4 ngx\_epoll\_process\_events() ngx\_epoll\_module.c:683 0x00000000004377d6 3 ngx\_process\_events\_and\_timers() ngx\_event.c:247 0x00000000004281f4 2 ngx\_single\_process\_cycle() ngx\_process\_cycle.c:316 0x0000000000434442 1 main() nginx.c:409 0x0000000000403cdc // copies exactly n bytes from src to dest, then adds null in n+1 (alloc dst to n+1 first !) u\_char \* sbb\_strncpy(u\_char \*dst, u\_char \*src, size\_t n) { memcpy(dst, src, n); dst[n] = ‘\0’; return dst; } // allocate, copy and add terminating null. do not return null but null\_str to avoid segmentation fault later (dereferencing null ptr) u\_char\* ngx\_sbb\_utils\_str2char(ngx\_http\_request\_t \*r, ngx\_str\_t \*ngx\_str) { u\_char \*res = NULL; if ( (!ngx\_str) || (!r)) return (u\_char\*)gv\_null\_str; ``` res = ngx_pnalloc(r->pool, ngx_str->len+1); if (!res) return (u_char*)gv_null_str; return sbb_strncpy(res, ngx_str->data, ngx_str->len); // adds ``` terminating null } Posted at Nginx Forum: > **[nginx crash only when using Chromium (in ubuntu)](https://forum.nginx.org/read.php?2,234580,234580#msg-234580)** > > i could not find the cause that only when using Chromium i get a crash but when using Firefox i never don't. some hints to the nginx experts that might help: 1. i use my handler module + filter module. (when module is disabled - no crash) 2. i use... ---
**Author:** ![gadh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/e19adc/32.png) [@gadh](https://www.ruby-forum.com/u/gadh)\ **Post date:** [December 30, 2012, 9:39pm UTC](https://www.ruby-forum.com/t/nginx-crash-only-when-using-chromium-in-ubuntu/225337/2 "2012-12-30T21:39:18Z")
forgot to add my nginx version: 1.2.5 Posted at Nginx Forum: > **[Re: nginx crash only when using Chromium (in ubuntu)](https://forum.nginx.org/read.php?2,234580,234583#msg-234583)** > > i could not find the cause that only when using Chromium i get a crash but when using Firefox i never don't. some hints to the nginx experts that might help: 1. i use my handler module + filter module. (when module is disabled - no crash) 2. i use... ---
**Author:** ![gadh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/e19adc/32.png) [@gadh](https://www.ruby-forum.com/u/gadh)\ **Post date:** [December 31, 2012, 10:11am UTC](https://www.ruby-forum.com/t/nginx-crash-only-when-using-chromium-in-ubuntu/225337/3 "2012-12-31T10:11:38Z")
i found that in some cases of the crash, the source of th crash was that nginx pnalloc() returned invalid ptr address 0x6632333834643264 \
i use 64 bit system, but all of my pointers are in the 32 bits bounds. is it related to the c/c++ code sharing ? any help please ? Posted at Nginx Forum: > **[Re: nginx crash only when using Chromium (in ubuntu)](https://forum.nginx.org/read.php?2,234580,234592#msg-234592)** > > i could not find the cause that only when using Chromium i get a crash but when using Firefox i never don't. some hints to the nginx experts that might help: 1. i use my handler module + filter module. (when module is disabled - no crash) 2. i use... ---
**Author:** ![gadh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/e19adc/32.png) [@gadh](https://www.ruby-forum.com/u/gadh)\ **Post date:** [January 1, 2013, 4:06pm UTC](https://www.ruby-forum.com/t/nginx-crash-only-when-using-chromium-in-ubuntu/225337/4 "2013-01-01T16:06:34Z")
i think i found the source of the crash - i often hibernate my vbox (virtual machine) and also my ubuntu (the host machine) so it appears that the memory was garbaged. after revooting only the vnox all is normal now, no crash. the one thing i cuold not understand is why i got the crash only when using Chromium and not in other browsers ? Posted at Nginx Forum: > **[Re: nginx crash only when using Chromium (in ubuntu)](https://forum.nginx.org/read.php?2,234580,234607#msg-234607)** > > i could not find the cause that only when using Chromium i get a crash but when using Firefox i never don't. some hints to the nginx experts that might help: 1. i use my handler module + filter module. (when module is disabled - no crash) 2. i use...