ngx.req.raw_header segfaults with spdy

Hello!

This simple code crashes the nginx worker when using it inside a server block with spdy, when requesting the page with a browser that supports spdy:

location /lua {
content_by_lua '
local h = ngx.req.raw_header()
';
}

No problem if i enable only ssl

I tried with nginx 1.6.3 and nginx 1.8.0, with the latest lua-nginx-module

Core was generated by `nginx: worker process '.
Program terminated with signal 11, Segmentation fault.
#0 ngx_http_lua_ngx_req_raw_header (L=0x97257d8) at lua-nginx-module/src/ngx_http_lua_headers.c:126

126 if (mr->request_line.data >= b->start
#0 ngx_http_lua_ngx_req_raw_header (L=0x97257d8) at lua-nginx-module/src/ngx_http_lua_headers.c:126

    n = <optimized out>
    line_break_len = 1
    data = <optimized out>
    p = <optimized out>
    last = <optimized out>
    pos = <optimized out>
    no_req_line = 0
    found = <optimized out>
    size = 0
    b = 0x0
    first = 0x0
    i = <optimized out>
    j = <optimized out>
    c = 0x97c8188
    r = 0x97c9138
    mr = 0x97c9138
    hc = 0x9608c34

I read there are problems with some functions and spdy but this one wasn't listed. Sorry if you were already aware of the problem.

Start with ngx_http_lua_ngx_req_raw_header in lua-nginx-module/src/ngx_http_lua_headers.c at line 126, then reproduce the crash using the provided server-block configuration with SPDY and ngx.req.raw_header(). Compare behavior across the reported nginx versions and use the supplied core dump to trace the fault; done means the worker no longer segfaults for this request.