echo_exec can not after echo, may cause worker process exited on signal 11

Nginx Conf

events {
 use epoll;
 multi_accept off;
 reuse_port on;
 worker_connections  1048576;
 debug_connection 127.0.0.1;
 debug_connection localhost;
}

error_log /var/log/nginx/error.log debug;

server {                                                                                                                                                                            
   listen       80 backlog=65535;
   server_name  lua.biliops.com;

   location / {
    set $name "higkoo";
    echo "name: $name"; # Error on add, normal on del.
    echo_exec /version;
   }

   location /version {
    content_by_lua '
        if jit then
            ngx.say(jit.version)
        else
            ngx.say(_VERSION)
        end
    ';
   }
}

Error Info

# curl -i lua.biliops.com
curl: (52) Empty reply from server

Configure

# nginx -V
Tengine version: Tengine/2.1.1 (nginx/1.6.2)
built by gcc 4.9.2 (Debian 4.9.2-10) 
TLS SNI support enabled
configure arguments: --with-debug --user=www-data --group=www-data --with-pcre-jit \
--prefix=/usr/share/nginx --sbin-path=/usr/sbin/nginx --dso-tool-path=/usr/sbin/dso_tool \
--dso-path=/usr/share/nginx/modules --conf-path=/etc/nginx/nginx.conf \
--http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log \
--lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid \
--http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi \
--http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi \
--http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-syslog --with-jemalloc --with-mail \
--with-http_lua_module --with-mail_ssl_module --with-http_ssl_module \
--with-http_auth_request_module --with-http_dav_module --with-http_gzip_static_module \
--with-http_image_filter_module --with-http_spdy_module --with-http_stub_status_module \
--with-http_realip_module --with-luajit-inc=/usr/include/luajit-2.0 \
--with-luajit-lib=/usr/lib/x86_64-linux-gnu --with-ld-opt=-Wl,-z,relro \
--with-cc-opt='-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -D_FORTIFY_SOURCE=2' \
--add-module=../echo-nginx-module-0.58 --add-module=../ngx_cache_path_status-1.0 \
--add-module=../redis2-nginx-module-0.12 --add-module=../headers-more-nginx-module-0.261 \
--add-module=../ngx-fancyindex-0.3.5 --add-module=../memc-nginx-module-0.16 \
--add-module=../nginx-rtmp-module-1.1.7 --add-module=../ngx_slowfs_cache_p2p-1.10 \
--add-module=../ngx_devel_kit-0.2.19

System log

nginx[2233]: segfault at 0 ip 000000000041fc54 sp 00007ffc9bd76ac0 error 4 in nginx[400000+198000]

Debug log

[debug] 2233#0: accept on 0.0.0.0:80, ready: 0
[debug] 2233#0: posix_memalign: 00007FED1284C300:256 @16
[debug] 2233#0: *3 accept: 192.168.9.199 fd:4
[debug] 2233#0: event dummy accept filter
[debug] 2233#0: posix_memalign: 00007FED1284C400:256 @16
[debug] 2233#0: *3 event timer add: 4: 60000:1451411133579
[debug] 2233#0: *3 reusable connection: 1
[debug] 2233#0: *3 epoll add event: fd:4 op:1 ev:80002001
[debug] 2233#0: *3 http wait request handler
[debug] 2233#0: *3 malloc: 00007FED12839C00:1024
[debug] 2233#0: *3 recv: fd:4 79 of 1024
[debug] 2233#0: *3 reusable connection: 0
[debug] 2233#0: *3 posix_memalign: 00007FED128DC000:4096 @16
[debug] 2233#0: *3 http process request line
[debug] 2233#0: *3 http request line: "GET / HTTP/1.1"
[debug] 2233#0: *3 http uri: "/"
[debug] 2233#0: *3 http args: ""
[debug] 2233#0: *3 http exten: ""
[debug] 2233#0: *3 http process request header line
[debug] 2233#0: *3 http header: "User-Agent: curl/7.38.0"
[debug] 2233#0: *3 http header: "Host: lua.biliops.com"
[debug] 2233#0: *3 posix_memalign: 00007FED1292D000:4096 @16
[debug] 2233#0: *3 http header: "Accept: */*"
[debug] 2233#0: *3 http header done
[debug] 2233#0: *3 event timer del: 4: 1451411133579
[debug] 2233#0: *3 generic phase: 0
[debug] 2233#0: *3 rewrite phase: 1
[debug] 2233#0: *3 test location: "/"
[debug] 2233#0: *3 using configuration "/"
[debug] 2233#0: *3 http cl:-1 max:67108864
[debug] 2233#0: *3 rewrite phase: 3
[debug] 2233#0: *3 http script value: "higkoo"
[debug] 2233#0: *3 http script set $name
[debug] 2233#0: *3 post rewrite phase: 4
[debug] 2233#0: *3 generic phase: 5
[debug] 2233#0: *3 generic phase: 6
[debug] 2233#0: *3 generic phase: 7
[debug] 2233#0: *3 generic phase: 8
[debug] 2233#0: *3 access phase: 9
[debug] 2233#0: *3 access phase: 10
[debug] 2233#0: *3 access phase: 11
[debug] 2233#0: *3 post access phase: 12
[debug] 2233#0: *3 http script copy: "name: "
[debug] 2233#0: *3 http script var: "higkoo"
[debug] 2233#0: *3 lua capture header filter, uri "/"
[debug] 2233#0: *3 HTTP/1.1 200 OK
Server: Tengine
Date: Tue, 29 Dec 2015 23:33:33 GMT
Content-Type: text/plain
Transfer-Encoding: chunked
Connection: keep-alive
[debug] 2233#0: *3 write new buf t:1 f:0 00007FED1292D378, pos 00007FED1292D378, size: 151 file: 0, size: 0
[debug] 2233#0: *3 http write filter: l:0 f:0 s:151
[debug] 2233#0: *3 http output filter "/?"
[debug] 2233#0: *3 http copy filter: "/?"
[debug] 2233#0: *3 lua capture body filter, uri "/"
[debug] 2233#0: *3 http trim filter
[debug] 2233#0: *3 http footer body filter
[debug] 2233#0: *3 image filter
[debug] 2233#0: *3 http postpone filter "/?" 00007FED1292D488
[debug] 2233#0: *3 http chunk: 12
[debug] 2233#0: *3 http chunk: 1
[debug] 2233#0: *3 write old buf t:1 f:0 00007FED1292D378, pos 00007FED1292D378, size: 151 file: 0, size: 0
[debug] 2233#0: *3 write new buf t:1 f:0 00007FED1292D528, pos 00007FED1292D528, size: 3 file: 0, size: 0
[debug] 2233#0: *3 write new buf t:0 f:0 00007FED1292D248, pos 00007FED1292D248, size: 12 file: 0, size: 0
[debug] 2233#0: *3 write new buf t:0 f:0 00000000007B06A8, pos 00000000007B06A8, size: 1 file: 0, size: 0
[debug] 2233#0: *3 write new buf t:0 f:0 0000000000000000, pos 000000000054A17D, size: 2 file: 0, size: 0
[debug] 2233#0: *3 http write filter: l:0 f:0 s:169
[debug] 2233#0: *3 http copy filter: 0 "/?"
[debug] 2233#0: *3 internal redirect: "/version?"
[debug] 2233#0: *3 rewrite phase: 1
[debug] 2233#0: *3 test location: "/"
[debug] 2233#0: *3 test location: "version"
[debug] 2233#0: *3 using configuration "/version"
[debug] 2233#0: *3 http cl:-1 max:67108864
[debug] 2233#0: *3 rewrite phase: 3
[debug] 2233#0: *3 post rewrite phase: 4
[debug] 2233#0: *3 generic phase: 5
[debug] 2233#0: *3 generic phase: 6
[debug] 2233#0: *3 generic phase: 7
[debug] 2233#0: *3 generic phase: 8
[debug] 2233#0: *3 access phase: 9
[debug] 2233#0: *3 access phase: 10
[debug] 2233#0: *3 access phase: 11
[debug] 2233#0: *3 post access phase: 12
[debug] 2233#0: *3 lua content handler, uri:"/version" c:2
[debug] 2233#0: *3 lua reset ctx
[debug] 2233#0: *3 lua creating new thread
[debug] 2233#0: *3 http cleanup add: 00007FED1292D7E0
[debug] 2233#0: *3 lua run thread, top:0 c:2
[debug] 2233#0: *3 lua allocate new chainlink and new buf of size 13, cl:00007FED1292D7F8
[debug] 2233#0: *3 lua say response
[debug] 2233#0: *3 http output filter "/version?"
[debug] 2233#0: *3 http copy filter: "/version?"
[debug] 2233#0: *3 lua capture body filter, uri "/version"
[debug] 2233#0: *3 http trim filter
[debug] 2233#0: *3 http footer body filter
[debug] 2233#0: *3 image filter
[debug] 2233#0: *3 http postpone filter "/version?" 00007FED1292D7F8
[debug] 2233#0: *3 http chunk: 13
[alert] 2333#0: worker process 2233 exited on signal 11
[debug] 3333#0: epoll add event: fd:4 op:1 ev:00002001

Reproduce the crash with the provided Nginx configuration, especially the combination of echo and echo_exec followed by the /version Lua handler. Trace the echo_exec request flow using the debug log and inspect the module's handling of the preceding output. Done means the worker no longer segfaults and curl receives a valid response.