From:
Operating system: Linux
PHP version: 5.4.0RC3
Package: Reproducible crash
Bug Type: Bug
Bug description:cli/apache sapi segfault on objects manipulation
Description:
------------
[arekm@ixion-pld php-5.4.0RC3]$ export LC_ALL=C
[arekm@ixion-pld php-5.4.0RC3]$ ./sapi/cli/php -n ~/a.php
If you see this, try to increase OBJECT_COUNT to 100,000Segmentation fault
[arekm@ixion-pld php-5.4.0RC3]$ ./sapi/cli/php -n --version
PHP 5.4.0RC3 (cli) (built: Dec 22 2011 23:19:37)
Copyright (c) 1997-2011 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2011 Zend Technologies
Test script:
---------------
<?
define('OBJECT_COUNT', 130000);
class Object {
private static $world = array();
private static $maxGuid = 0;
protected $_guid = null;
public function __construct() {
self::$world[$this->_guid = self::$maxGuid++] = $this;
}
public function __destruct() {
unset(self::$world[$this->_guid]);
}
}
for ($i = 0; $i < OBJECT_COUNT; ++$i) {
new Object();
}
// You probably won't see this because of the "zend_mm_heap corrupted"
echo 'If you see this, try to increase OBJECT_COUNT to 100,000';
?>
Expected result:
----------------
cli not segfaulting
Actual result:
--------------
Starting program:
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/sapi/cli/.libs/php -n
/home/users/arekm/a.php
[Thread debugging using libthread_db enabled]
If you see this, try to increase OBJECT_COUNT to 100,000
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7a462b9 in gc_zval_possible_root (zv=0x7ffff5677420) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_gc.c:143
143 GC_ZOBJ_CHECK_POSSIBLE_ROOT(zv);
(gdb) bt
#0 0x00007ffff7a462b9 in gc_zval_possible_root (zv=0x7ffff5677420) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_gc.c:143
#1 0x00007ffff7a48ba2 in zend_object_std_dtor (object=0x7ffff56773d0) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_objects.c:54
#2 0x00007ffff7a48bd9 in zend_objects_free_object_storage
(object=0x7ffff56773d0) at /home/users/arekm/rpm/BUILD/php-
5.4.0RC3/Zend/zend_objects.c:137
#3 0x00007ffff7a4e56f in zend_objects_store_free_object_storage
(objects=0x7ffff7dda700)
at /home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_objects_API.c:92
#4 0x00007ffff7a18c83 in shutdown_executor () at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_execute_API.c:297
#5 0x00007ffff7a27555 in zend_deactivate () at
/home/users/arekm/rpm/BUILD/php-
5.4.0RC3/Zend/zend.c:934
#6 0x00007ffff79c820f in php_request_shutdown (dummy=<optimized out>) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/main/main.c:1781
#7 0x0000000000405538 in do_cli (argc=3, argv=0x7fffffffea38) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/sapi/cli/php_cli.c:1169
#8 0x0000000000404d4c in main (argc=3, argv=0x7fffffffea38) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/sapi/cli/php_cli.c:1356
(gdb) frame 0
#0 0x00007ffff7a462b9 in gc_zval_possible_root (zv=0x7ffff5677420) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_gc.c:143
143 GC_ZOBJ_CHECK_POSSIBLE_ROOT(zv);
(gdb) print zv
$1 = (zval *) 0x7ffff5677420
(gdb) print *zv
$2 = {
value = {
lval = 140737303870936,
dval = 6.9533466930949762e-310,
str = {
val = 0x7ffff500fdd8 "\270",
len = -184485184
},
ht = 0x7ffff500fdd8,
obj = {
handle = 4110482904,
handlers = 0x7ffff500fac0
}
},
refcount__gc = 4294967295,
type = 5 '\005',
is_ref__gc = 0 '\000'
}
(gdb)
--
Edit bug report at https://bugs.php.net/bug.php?id=60598&edit=1
--
Try a snapshot (PHP 5.4):
https://bugs.php.net/fix.php?id=60598&r=trysnapshot54
Try a snapshot (PHP 5.3):
https://bugs.php.net/fix.php?id=60598&r=trysnapshot53
Try a snapshot (trunk):
https://bugs.php.net/fix.php?id=60598&r=trysnapshottrunk
Fixed in SVN:
https://bugs.php.net/fix.php?id=60598&r=fixed
Fixed in SVN and need be documented:
https://bugs.php.net/fix.php?id=60598&r=needdocs
Fixed in release:
https://bugs.php.net/fix.php?id=60598&r=alreadyfixed
Need backtrace:
https://bugs.php.net/fix.php?id=60598&r=needtrace
Need Reproduce Script:
https://bugs.php.net/fix.php?id=60598&r=needscript
Try newer version:
https://bugs.php.net/fix.php?id=60598&r=oldversion
Not developer issue:
https://bugs.php.net/fix.php?id=60598&r=support
Expected behavior:
https://bugs.php.net/fix.php?id=60598&r=notwrong
Not enough info:
https://bugs.php.net/fix.php?id=60598&r=notenoughinfo
Submitted twice:
https://bugs.php.net/fix.php?id=60598&r=submittedtwice
register_globals:
https://bugs.php.net/fix.php?id=60598&r=globals
PHP 4 support discontinued:
https://bugs.php.net/fix.php?id=60598&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=60598&r=dst
IIS Stability:
https://bugs.php.net/fix.php?id=60598&r=isapi
Install GNU Sed:
https://bugs.php.net/fix.php?id=60598&r=gnused
Floating point limitations:
https://bugs.php.net/fix.php?id=60598&r=float
No Zend Extensions:
https://bugs.php.net/fix.php?id=60598&r=nozend
MySQL Configuration Error:
https://bugs.php.net/fix.php?id=60598&r=mysqlcfg
