Edit report at https://bugs.php.net/bug.php?id=61046&edit=1
ID: 61046
Comment by: ni...@php.net
Reported by: ni...@php.net
Summary: Segfault when memory limit is hit while copying hash
table
Status: Open
Type: Bug
Package: Reproducible crash
PHP Version: 5.4.0RC7
Block user comment: N
Private report: N
New Comment:
GDB Stacktrace:
#0 zend_mm_remove_from_free_list (heap=0x88da8d8, mm_block=0xb7fc5308)
at /home/nikic/dev/php-src-git/Zend/zend_alloc.c:805
#1 0x083ad608 in _zend_mm_free_int (heap=0x88da8d8, p=0xb7fc52f0)
at /home/nikic/dev/php-src-git/Zend/zend_alloc.c:2101
#2 0x083cd657 in destroy_op_array (op_array=0x8a5d4c8, tsrm_ls=0x88d9050)
at /home/nikic/dev/php-src-git/Zend/zend_opcode.c:380
#3 0x083cd777 in zend_function_dtor (function=0x8a5d4c8)
at /home/nikic/dev/php-src-git/Zend/zend_opcode.c:124
#4 0x083e49ae in zend_hash_apply_deleter (ht=0x88dae70, p=0x8a5d498)
at /home/nikic/dev/php-src-git/Zend/zend_hash.c:650
#5 0x083e63b1 in zend_hash_reverse_apply (ht=0x88dae70,
apply_func=0x83c7310 <clean_non_persistent_function>, tsrm_ls=0x88d9050)
at /home/nikic/dev/php-src-git/Zend/zend_hash.c:804
#6 0x083c7ecb in shutdown_executor (tsrm_ls=0x88d9050)
at /home/nikic/dev/php-src-git/Zend/zend_execute_API.c:304
#7 0x083d7c11 in zend_deactivate (tsrm_ls=0x88d9050)
at /home/nikic/dev/php-src-git/Zend/zend.c:934
#8 0x0836be33 in php_request_shutdown (dummy=0x0)
at /home/nikic/dev/php-src-git/main/main.c:1782
#9 0x0848d723 in do_cli (argc=4, argv=0xbffff3b4, tsrm_ls=0x88d9050)
at /home/nikic/dev/php-src-git/sapi/cli/php_cli.c:1169
#10 0x0806eaa3 in main (argc=4, argv=0xbffff3b4)
at /home/nikic/dev/php-src-git/sapi/cli/php_cli.c:1356
Previous Comments:
------------------------------------------------------------------------
[2012-02-10 17:28:02] ni...@php.net
Description:
------------
The attached test script triggers a segfault. It happens during the shutdown
after the memory limit is reached in the byRef($array) line.
Test script:
---------------
<?php
function byRef(&$ref) {}
ini_set('memory_limit', '500k');
$array = array_fill(0, 2000, '*');
$ref = $array;
byRef($array);
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=61046&edit=1
