Sebastian Bergmann wrote:
>   Win32, Apache 2.0.36-dev, PHP 4.2.0-dev (both current CVS)
> 
> ap_save_brigade(ap_filter_t * 0x00800e40, apr_bucket_brigade * *
> 0x00800a8c, apr_bucket_brigade * * 0x10e6fe6c, apr_pool_t * 0x007ff898)
> line 562 + 49 bytes
> php_output_filter(ap_filter_t * 0x00800e40, apr_bucket_brigade *
> 0x00800f60) line 354 + 32 bytes
> ap_pass_brigade(ap_filter_t * 0x00800e40, apr_bucket_brigade * 0x00800f60)
> line 534 + 16 bytes
> default_handler(request_rec * 0x007ff8d0) line 3248
> ap_run_handler(request_rec * 0x007ff8d0) line 194 + 78 bytes
> ap_invoke_handler(request_rec * 0x007ff8d0) line 373 + 9 bytes
> ap_process_request(request_rec * 0x007ff8d0) line 261 + 9 bytes
> ap_process_http_connection(conn_rec * 0x007eb760) line 291 + 9 bytes
> ap_run_process_connection(conn_rec * 0x007eb760) line 85 + 78 bytes
> ap_process_connection(conn_rec * 0x007eb760, void * 0x007eb6a0) line 209
> worker_main(long 249) line 1110
> _threadstartex(void * 0x0087d638) line 212 + 13 bytes


This looks similar to what I'm seeing. I posted the following to dev@httpd:
--------------------------------------------------------------------------
I'm trying to get a PHP4 OS/2 port working with Apache 2.0.35 but have hit
a problem that may need a filtering guru to fix. I'm working with the 4.2.0
branch as that's what's slated to be released before long.

The problem I've found is that the SG(server_context), which holds a
pointer to data allocated from the request pool, lives into the next
request which causes a crash in ap_save_brigade() called from
php_output_filter().

Tracing through with a debugger, the sequence of events is:

- SG(server_context) starts life as NULL
- php_output_filter() sets it, uses it, executes script, NULLs it again
- php_input_filter() sets it, uses it
- request ends
- next request, php_output_filter() sees it's non-null & tries to use it,
SEGFAULT!

So it looks like SG(server_context) needs to be NULLed at the end of the
request but I can't see an appropriate place to do that.

It also seems fishy to me (and is probably the real problem) that
php_input_filter() is run AFTER php_execute_script() has finished. Isn't
that's too late?


-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to