Core: protection from subrequest loops. Without the protection, subrequest loop results in r->count overflow and SIGSEGV. Protection was broken in 0.7.25. Note that this also limits number of parallel subrequests. This wasn't exactly the case before 0.7.25 as local subrequests were completed directly. See here for details: http://nginx.org/pipermail/nginx-ru/2010-February/032184.html

--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2010,6 +2010,7 @@ ngx_http_finalize_request(ngx_http_reque
         if (r == c->data) {
 
             r->main->count--;
+            r->main->subrequests++;
 
             if (!r->logged) {