If a request is finalized in the first call to the ngx_http_upstream_process_upgraded() function, e.g., because upstream server closed the connection for some reason, in the second call the u->peer.connection pointer will be null, resulting in segmentation fault. Fix is to avoid second direct call, and post event instead. This ensures that ngx_http_upstream_process_upgraded() won't be called again if a request is finalized.
Backed out 05a56ebb084a, as it turns out that kernel can return connections without any delay if syncookies are used. This basically means we can't assume anything about connections returned with deferred accept set. To solve original problem the 05a56ebb084a tried to solve, i.e. to don't wait longer than needed if a connection was accepted after deferred accept timeout, this patch changes a timeout set with setsockopt(TCP_DEFER_ACCEPT) to 1 second, unconditionally. This is believed to be enough for speed improvements, and doesn't imply major changes to timeouts used. Note that before 2.6.32 connections were dropped after a timeout. Though it is believed that 1s is still appropriate for kernels before 2.6.32, as previously tcp_synack_retries controlled the actual timeout and 1s results in more than 1 minute actual timeout by default.
Read event on a client connection might have been disabled during previous processing, and we at least need to handle events. Calling ngx_http_upstream_process_upgraded() is a simpliest way to do it. Notably this change is needed for select, poll and /dev/poll event methods. Previous version of this patch was posted here: http://mailman.nginx.org/pipermail/nginx/2014-January/041839.html
While processing a DATA frame, the link to related stream is stored in spdy connection object as part of connection state. But this stream can be closed between receiving parts of the frame.
If a request had an empty request body (with Content-Length: 0), and there were preread data available (e.g., due to a pipelined request in the buffer), the "zero size buf in output" alert might be logged while proxying the request to an upstream. Similar alerts appeared with client_body_in_file_only if a request had an empty request body.
On win32, time_t is 64 bits wide by default, and passing an ngx_msec_int_t argument for %T format specifier doesn't work. This doesn't manifest itself on other platforms as time_t and ngx_msec_int_t are usually of the same size.