Gearman worker crashing

[vivek]

HI,
I have updated my gearman server and worker version to gearmand-1.1.11. After updating gearman client is crashing on NO_JOB packet.

Server logs:
DEBUG 2014-01-13 11:11:16.655486 [ 4 ] 10.0.2.219:34874 Ready POLLIN -> libgearman-server/gearmand_con.cc:138
   INFO 2014-01-13 11:11:16.655545 [ 4 ] Peer connection has called close()
   INFO 2014-01-13 11:11:16.655557 [ 4 ] Disconnected 10.0.2.219:34874
   INFO 2014-01-13 11:11:16.655985 [ 4 ] Gear connection disconnected: -:-
  DEBUG 2014-01-13 11:11:16.656028 [ 4 ] Received RUN wakeup event -> libgearman-server/gearmand_thread.cc:624
  DEBUG 2014-01-13 11:11:18.103339 [ main ] accept() fd:32 -> libgearman-server/gearmand.cc:874
   INFO 2014-01-13 11:11:18.103389 [ main ] Accepted connection from 10.0.2.219:34913
  DEBUG 2014-01-13 11:11:18.103493 [ 2 ] Received CON wakeup event -> libgearman-server/gearmand_thread.cc:619
  DEBUG 2014-01-13 11:11:18.103563 [ 2 ] 10.0.2.219:34913 Watching POLLIN -> libgearman-server/gearmand_thread.cc:151
  DEBUG 2014-01-13 11:11:18.103577 [ 2 ] Gear connection made: 10.0.2.219:34913 -> libgearman-server/plugins/protocol/gear/protocol.cc:407
  DEBUG 2014-01-13 11:11:18.103833 [ 2 ] 10.0.2.219:34913 Ready POLLIN -> libgearman-server/gearmand_con.cc:138
  DEBUG 2014-01-13 11:11:18.103884 [ 2 ] read 25 bytes -> libgearman-server/io.cc:798
  DEBUG 2014-01-13 11:11:18.103901 [ 2 ] Gear unpack -> libgearman-server/plugins/protocol/gear/protocol.cc:117
  DEBUG 2014-01-13 11:11:18.103916 [ 2 ] Received GEARMAN_CAN_DO -> libgearman-server/thread.cc:311
  DEBUG 2014-01-13 11:11:18.103947 [ 2 ] Gear unpack -> libgearman-server/plugins/protocol/gear/protocol.cc:117
  DEBUG 2014-01-13 11:11:18.103994 [ proc ] PACKET COMMAND: GEARMAN_CAN_DO -> libgearman-server/server.cc:119
  DEBUG 2014-01-13 11:11:18.103963 [ 2 ] Received GEARMAN_GRAB_JOB_UNIQ -> libgearman-server/thread.cc:311
  DEBUG 2014-01-13 11:11:18.104014 [ proc ] Registering function: 2 -> libgearman-server/server.cc:522
  DEBUG 2014-01-13 11:11:18.104026 [ proc ] PACKET COMMAND: GEARMAN_GRAB_JOB_UNIQ -> libgearman-server/server.cc:119
  DEBUG 2014-01-13 11:11:18.104034 [ 2 ] 10.0.2.219:34913 Watching POLLIN -> libgearman-server/gearmand_thread.cc:151
  DEBUG 2014-01-13 11:11:18.104059 [ 2 ] Received RUN wakeup event -> libgearman-server/gearmand_thread.cc:624
  DEBUG 2014-01-13 11:11:18.104085 [ 2 ] send() 12 bytes to peer -> libgearman-server/io.cc:403
  DEBUG 2014-01-13 11:11:18.104096 [ 2 ] Sent NO_JOB -> libgearman-server/thread.cc:356

client crashed after this.

Client backtrace:

#0 gearman_connection_st::receiving (this=0x0, packet_arg=..., ret=@0x7ffff0ceac18, recv_data=true) at libgearman/connection.cc:961
#1 0x00007ffff7140f42 in gearman_worker_grab_job (worker_shell=<value optimized out>, job=0x0, ret_ptr=0x7ffff0ceac18) at libgearman/worker.cc:818

full stacktrace

#0 gearman_connection_st::receiving (this=0x0, packet_arg=..., ret=@0x7ffff0ceac18, recv_data=true) at libgearman/connection.cc:961
        __func__ = "receiving"
        tmp_packet_arg = <value optimized out>
#1 0x00007ffff7140f42 in gearman_worker_grab_job (worker_shell=<value optimized out>, job=0x0, ret_ptr=0x7ffff0ceac18) at libgearman/worker.cc:818
        worker = 0x768500
        function = <value optimized out>
        active = <value optimized out>
        unused = 32767
        no_job = false
        __func__ = "gearman_worker_grab_job"

p recv_state
Cannot access memory at address 0xc

Running program inside valgrind shows following warning:
==2812== Invalid read of size 1
==2812== at 0x58C2174: gearman_connection_st::send_packet(gearman_packet_st const&, bool) (connection.cc:396)
==2812== by 0x58CC005: gearman_worker_grab_job (worker.cc:755)

==2812== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==2812== Access not within mapped region at address 0x1
==2812== at 0x58C2174: gearman_connection_st::send_packet(gearman_packet_st const&, bool) (connection.cc:396)
==2812== by 0x58CC005: gearman_worker_grab_job (worker.cc:755)

[chjgcn (chjgcn)]

Use the latest version (1.1.12) and test that this bug exists or not.