﻿id	summary	reporter	owner	description	type	status	priority	milestone	component	version	resolution	keywords	cc	uname	nginx_version
1554	http2 client abort when upstream cause segment fault	crasyangel.lhy@…		"client canceled stream while reading response header from upstream

log:
""2018/05/13 23:11:07 [info] 124561#0: *198618980 client canceled stream 13 while reading response header from upstream""

then execute:
ev = fc->read;
ev->handler(ev);

ev->handler would be ngx_http_v2_close_stream_handler, then ngx_http_free_request 

request still used in ngx_http_upstream_handler, because upstream did not close when close stream

segment fault stacktrace:
(gdb) bt
Python Exception <type 'exceptions.ImportError'> No module named gdb.frames:
#0  ngx_http_upstream_handler (ev=0x7f5e16447c60) at src/http/ngx_http_upstream.c:1261
#1  0x000000000047bb16 in ngx_event_expire_timers () at src/event/ngx_event_timer.c:96
#2  0x000000000047b5af in ngx_process_events_and_timers (cycle=cycle@entry=0x1320bf0) at src/event/ngx_event.c:263
#3  0x00000000004834dc in ngx_worker_process_cycle (cycle=0x1320bf0, data=<optimized out>) at src/os/unix/ngx_process_cycle.c:749
#4  0x0000000000481ba2 in ngx_spawn_process (cycle=cycle@entry=0x1320bf0, proc=proc@entry=0x483449 <ngx_worker_process_cycle>, data=data@entry=0x4,
    name=name@entry=0x76c9d6 ""worker process"", respawn=respawn@entry=-3) at src/os/unix/ngx_process.c:198
#5  0x000000000048278e in ngx_start_worker_processes (cycle=cycle@entry=0x1320bf0, n=6, type=type@entry=-3) at src/os/unix/ngx_process_cycle.c:358
#6  0x0000000000483e45 in ngx_master_process_cycle (cycle=cycle@entry=0x1320bf0) at src/os/unix/ngx_process_cycle.c:130
#7  0x000000000045bd6e in main (argc=<optimized out>, argv=<optimized out>) at src/core/nginx.c:382"	defect	closed	critical		nginx-core	1.12.x	worksforme			2.6.32_1-16-0-0	"built by gcc 4.8.3 (GCC)
built with OpenSSL 1.0.2h  3 May 2016
TLS SNI support enabled
configure arguments: --with-debug --with-ipv6 --with-http_v2_module"
