Edit report at https://bugs.php.net/bug.php?id=64606&edit=1
ID: 64606
User updated by: pbxanime at gmail dot com
Reported by: pbxanime at gmail dot com
Summary: php crashes when wrtiting stream
Status: Open
Type: Bug
Package: Streams related
Operating System: Centos 5.8
-PHP Version: 5.4.13
+PHP Version: 5.4.14
Block user comment: N
Private report: N
New Comment:
These same errors still occur in 5.4.14 I think I have a better clue of why
this is happening. When I upgraded to 5.4.14 I ran the make test and got these
results:
=====================================================================
FAILED TEST SUMMARY
---------------------------------------------------------------------
Bug #43073 (TrueType bounding box is wrong for angle<>0) freetype < 2.4.10
[ext/gd/tests/bug43073.phpt]
Bug #48801 (Problem with imagettfbbox) freetype < 2.4.10
[ext/gd/tests/bug48801.phpt]
Test posix_getgrgid() function : basic functionality
[ext/posix/tests/posix_getgrgid_basic.phpt]
Bug #32330 (session_destroy, "Failed to initialize storage module", custom
session handler) [ext/session/tests/bug32330.phpt]
Bug #60634 (Segmentation fault when trying to die() in SessionHandler::write())
- fatal error in close during exec [ext/session/tests/bug60634_error_5.phpt]
session rfc1867 [ext/session/tests/rfc1867.phpt]
session rfc1867 [ext/session/tests/rfc1867_cleanup.phpt]
session rfc1867 disabled [ext/session/tests/rfc1867_disabled.phpt]
session rfc1867 disabled 2 [ext/session/tests/rfc1867_disabled_2.phpt]
session rfc1867 [ext/session/tests/rfc1867_inter.phpt]
session rfc1867 no name [ext/session/tests/rfc1867_no_name.phpt]
session rfc1867 sid cookie [ext/session/tests/rfc1867_sid_cookie.phpt]
session rfc1867 sid get [ext/session/tests/rfc1867_sid_get.phpt]
session rfc1867 sid get 2 [ext/session/tests/rfc1867_sid_get_2.phpt]
session rfc1867 sid cookie [ext/session/tests/rfc1867_sid_invalid.phpt]
session rfc1867 sid only cookie [ext/session/tests/rfc1867_sid_only_cookie.phpt]
session rfc1867 sid only cookie 2
[ext/session/tests/rfc1867_sid_only_cookie_2.phpt]
session rfc1867 sid post [ext/session/tests/rfc1867_sid_post.phpt]
Test session_module_name() function : variation
[ext/session/tests/session_module_name_variation3.phpt]
Test session_name() function : error functionality
[ext/session/tests/session_name_basic.phpt]
Test session_name() function : variation
[ext/session/tests/session_name_variation1.phpt]
Test session_save_path() function : error functionality
[ext/session/tests/session_save_path_error.phpt]
Test session_save_path() function : variation
[ext/session/tests/session_save_path_variation1.phpt]
Test session_set_save_handler() function : basic functionality
[ext/session/tests/session_set_save_handler_basic.phpt]
Test session_set_save_handler() function : using closures as callbacks
[ext/session/tests/session_set_save_handler_closures.phpt]
Test session_set_save_handler() function : error functionality
[ext/session/tests/session_set_save_handler_error3.phpt]
Test session_set_save_handler() function : variation
[ext/session/tests/session_set_save_handler_variation4.phpt]
Bug #44394 (Last two bytes missing from output) with session.use_trans_id
[ext/standard/tests/general_functions/bug44394_2.phpt]
Test setlocale() function : usage variations - Setting all available locales in
the platform [ext/standard/tests/strings/setlocale_variation2.phpt]
=====================================================================
=====================================================================
WARNED TEST SUMMARY
---------------------------------------------------------------------
Bug #52062 (large timestamps with DateTime::getTimestamp and
DateTime::setTimestamp) (32 bit) [ext/date/tests/bug52062.phpt] (warn: XFAIL
section but test passes)
=====================================================================
Previous Comments:
------------------------------------------------------------------------
[2013-04-11 16:57:05] pbxanime at gmail dot com
I don't know what other information I can supply, but if there's anything else
I can provide, just tell me.
------------------------------------------------------------------------
[2013-04-08 22:57:47] pbxanime at gmail dot com
here's php -v:
PHP 5.4.13 (cli) (built: Apr 2 2013 15:57:48)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2013 Zend Technologies
I turned off Xcache and here's results from 5 different core dumps spanning 5
hours:
#0 0x08304f47 in _php_stream_write (stream=0x90f5b08,
buf=0xb77495bc "set 34e0f7080b10afd7af2e03e9b1536c33 0 1440
38\r\nuser_session_last_access|i:1365458365;\r\n", count=88)
at /usr/src/php-5.4.13/main/streams/streams.c:1238
1238 if (buf == NULL || count == 0 || stream->ops->write == NULL) {
----------------------------
#0 0x04939510 in ?? ()
(gdb) bt
#0 0x04939510 in ?? ()
#1 0x08303995 in _php_stream_write_buffer (stream=0x90f5b18, buf=0x95e6958
"get 8185df46afa3fa484826ee530507445e\r\n",
count=38) at /usr/src/php-5.4.13/main/streams/streams.c:1134
#2 0x009a00bb in ?? ()
#3 0x090f5b18 in ?? ()
#4 0x095e6958 in ?? ()
#5 0x00000026 in ?? ()
#6 0x082f5029 in spprintf (pbuf=0x95e9374, max_len=3214955994, format=0x20
<Address 0x20 out of bounds>)
at /usr/src/php-5.4.13/main/spprintf.c:818
#7 0x009a346a in ?? ()
#8 0x095e9374 in ?? ()
#9 0xbfa055da in ?? ()
#10 0x00000020 in ?? ()
#11 0xbfa055da in ?? ()
#12 0x00000000 in ?? ()
(gdb) frame 1
#1 0x08303995 in _php_stream_write_buffer (stream=0x90f5b18, buf=0x95e6958
"get 8185df46afa3fa484826ee530507445e\r\n",
count=38) at /usr/src/php-5.4.13/main/streams/streams.c:1134
1134 justwrote = stream->ops->write(stream, buf, towrite
TSRMLS_CC);
(gdb) frame 6
#6 0x082f5029 in spprintf (pbuf=0x95e9374, max_len=3214955994, format=0x20
<Address 0x20 out of bounds>)
at /usr/src/php-5.4.13/main/spprintf.c:818
818 cc = vspprintf(pbuf, max_len, format, ap);
----------------------------
#0 0x08304eb3 in _php_stream_write_filtered (stream=0x90992a0, buf=<value
optimized out>, count=3214964224, flags=0) at
/usr/src/php-5.4.13/main/streams/streams.c:1177
1177 status = filter->fops->filter(stream, filter, brig_inp,
brig_outp,
(gdb) bt
#0 0x08304eb3 in _php_stream_write_filtered (stream=0x90992a0, buf=<value
optimized out>, count=3214964224, flags=0) at
/usr/src/php-5.4.13/main/streams/streams.c:1177
#1 0x009a2506 in ?? ()
#2 0x00000000 in ?? ()
(gdb) frame 0
#0 0x08304eb3 in _php_stream_write_filtered (stream=0x90992a0, buf=<value
optimized out>, count=3214964224, flags=0) at
/usr/src/php-5.4.13/main/streams/streams.c:1177
1177 status = filter->fops->filter(stream, filter, brig_inp,
brig_outp,
----------------------------
#0 0x30320032 in ?? ()
(gdb) bt
#0 0x30320032 in ?? ()
#1 0x08304ee5 in _php_stream_write_filtered (stream=0x90f5b18, buf=<value
optimized out>, count=<value optimized out>, flags=0)
at /usr/src/php-5.4.13/main/streams/streams.c:1177
#2 0x009a00bb in ?? ()
#3 0x00000000 in ?? ()
(gdb) frame 1
#1 0x08304ee5 in _php_stream_write_filtered (stream=0x90f5b18, buf=<value
optimized out>, count=<value optimized out>, flags=0)
at /usr/src/php-5.4.13/main/streams/streams.c:1177
1177 status = filter->fops->filter(stream, filter, brig_inp,
brig_outp,
----------------------------
#0 0x08304eb3 in _php_stream_write_filtered (stream=0x9098890, buf=<value
optimized out>, count=3214964224, flags=0) at
/usr/src/php-5.4.13/main/streams/streams.c:1177
1177 status = filter->fops->filter(stream, filter, brig_inp,
brig_outp,
(gdb) bt
#0 0x08304eb3 in _php_stream_write_filtered (stream=0x9098890, buf=<value
optimized out>, count=3214964224, flags=0) at
/usr/src/php-5.4.13/main/streams/streams.c:1177
#1 0x009a2506 in ?? ()
#2 0x00000000 in ?? ()
(gdb) frame 0
#0 0x08304eb3 in _php_stream_write_filtered (stream=0x9098890, buf=<value
optimized out>, count=3214964224, flags=0) at
/usr/src/php-5.4.13/main/streams/streams.c:1177
1177 status = filter->fops->filter(stream, filter, brig_inp,
brig_outp,
------------------------------------------------------------------------
[2013-04-08 16:40:32] pbxanime at gmail dot com
No, I haven't tested it with Xcache disabled. I didn't even think Xcache would
be an issue since it doesn't interact with the writing of the sessions. I will
disable Xcache for a few hours and see what results, I get thank you for the
response.
------------------------------------------------------------------------
[2013-04-08 16:10:56] s...@php.net
Does it reproduce without XCache?
Do you have a standalone testcase?
------------------------------------------------------------------------
[2013-04-07 19:41:41] pbxanime at gmail dot com
Description:
------------
I use the latest stable XCache and the latest stable Lighttpd.
I store sessions with memcache:
session.save_handler = memcache
session.save_path =
"unix:///tmp/memcached.socket:0?persistent=1&weight=1&timeout=1&retry_interval=15"
php is compiled with the following, I removed directories, but they are
correctly linked:
./configure \
--disable-fileinfo \
--disable-pdo \
--enable-exif \
--enable-fpm \
--enable-ftp \
--enable-gd-native-ttf \
--enable-libxml \
--enable-mbstring \
--enable-zip \
--prefix= \
--with-apxs2= \
--with-bz2 \
--with-curl= \
--with-freetype-dir= \
--with-gd \
--with-gettext \
--with-imap= \
--with-imap-ssl= \
--with-jpeg-dir= \
--with-png-dir= \
--with-kerberos \
--with-libxml-dir= \
--with-mcrypt= \
--with-mysql= \
--with-mysql-sock= \
--with-mysqli= \
--with-openssl= \
--with-openssl-dir= \
--with-pcre-regex= \
--with-png-dir= \
--with-xpm-dir= \
--with-zlib \
--with-zlib-dir=
Test script:
---------------
I store sessions like this:
IF (!ISSET($_SESSION)) {
SESSION_START();
}
IF($_SESSION['user_session_last_access']+180 < TIME()){
$_SESSION['user_session_last_access'] = TIME();
}
It's nothing special and it works normally.
Actual result:
--------------
I don't know how to dupicate this bug, it just happens randomly every few to
several hours:
FPM Log:
[07-Apr-2013 08:35:05.926454] DEBUG: pid 25374, fpm_got_signal(), line 72:
received SIGCHLD
[07-Apr-2013 08:35:05.926552] WARNING: pid 25374, fpm_children_bury(), line
252: [pool ] child 534 exited on signal 11 (SIGSEGV - core dumped) after
34.242946 seconds from start
[07-Apr-2013 08:35:05.926939] NOTICE: pid 25374, fpm_children_make(), line 421:
[pool ] child 575 started
[07-Apr-2013 08:35:05.926980] DEBUG: pid 25374, fpm_event_loop(), line 411:
event module triggered 1 events
Backtrace:
#0 0x08304f47 in _php_stream_write (stream=0x9556b88,
buf=0xb77c5000 "set 0b58f7308927b881bd2d5273f0dc8de7 0 1440
38\r\nuser_session_last_access|i:1365338080;\r\n", count=88)
at /usr/src/php-5.4.13/main/streams/streams.c:1238
1238 if (buf == NULL || count == 0 || stream->ops->write == NULL) {
(gdb) bt
#0 0x08304f47 in _php_stream_write (stream=0x9556b88,
buf=0xb77c5000 "set 0b58f7308927b881bd2d5273f0dc8de7 0 1440
38\r\nuser_session_last_access|i:1365338080;\r\n", count=88)
at /usr/src/php-5.4.13/main/streams/streams.c:1238
#1 0x00764506 in ?? ()
#2 0x09556b88 in ?? ()
#3 0xb77c5000 in ?? ()
#4 0x00000058 in ?? ()
#5 0xbfb79f0e in ?? ()
#6 0x00000000 in ?? ()
(gdb) frame 0
#0 0x08304f47 in _php_stream_write (stream=0x9556b88,
buf=0xb77c5000 "set 0b58f7308927b881bd2d5273f0dc8de7 0 1440
38\r\nuser_session_last_access|i:1365338080;\r\n", count=88)
at /usr/src/php-5.4.13/main/streams/streams.c:1238
1238 if (buf == NULL || count == 0 || stream->ops->write == NULL) {
Another Backtrace:
#0 _php_stream_write_filtered (stream=0x95564a8, buf=0x96c9100 "",
count=3216473280, flags=0) at /usr/src/php-5.4.13/main/streams/streams.c:1177
1177 status = filter->fops->filter(stream, filter, brig_inp,
brig_outp,
(gdb) bt
#0 _php_stream_write_filtered (stream=0x95564a8, buf=0x96c9100 "",
count=3216473280, flags=0) at /usr/src/php-5.4.13/main/streams/streams.c:1177
#1 0x007620bb in ?? ()
#2 0x00000000 in ?? ()
(gdb) frame 0
#0 _php_stream_write_filtered (stream=0x95564a8, buf=0x96c9100 "",
count=3216473280, flags=0) at /usr/src/php-5.4.13/main/streams/streams.c:1177
1177 status = filter->fops->filter(stream, filter, brig_inp,
brig_outp,
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=64606&edit=1
