Edit report at http://bugs.php.net/bug.php?id=54491&edit=1
ID: 54491 User updated by: msamson at chowly dot com Reported by: msamson at chowly dot com Summary: Crash during shutdown sequence Status: Open Type: Bug Package: Reproducible crash Operating System: Fedora 14 x64 PHP Version: 5.3.6 Block user comment: N Private report: N New Comment: Just reproduced the bug in Ubuntu 10.10 i386 with a php 5.3.6 ppa For a total of 2 different computers (both F14 x64) and 4 virtual machines: Fedora x64 RPM Fedora x64 Source Ubuntu x64 PPA Ubuntu x86 PPA Previous Comments: ------------------------------------------------------------------------ [2011-04-08 17:50:57] msamson at chowly dot com Valgrind output of `php webroot/index.php` </body> </html>zend_mm_heap corrupted ==3214== ==3214== HEAP SUMMARY: ==3214== in use at exit: 7,084,078 bytes in 14,840 blocks ==3214== total heap usage: 16,202 allocs, 1,362 frees, 7,502,798 bytes allocated ==3214== ==3214== LEAK SUMMARY: ==3214== definitely lost: 0 bytes in 0 blocks ==3214== indirectly lost: 0 bytes in 0 blocks ==3214== possibly lost: 5,259,364 bytes in 1,386 blocks ==3214== still reachable: 1,824,714 bytes in 13,454 blocks ==3214== suppressed: 0 bytes in 0 blocks ==3214== Rerun with --leak-check=full to see details of leaked memory ==3214== ==3214== For counts of detected and suppressed errors, rerun with: -v ==3214== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 42 from 8) ------------------------------------------------------------------------ [2011-04-08 17:05:12] msamson at chowly dot com No, the crash also occurs when the mongo.so extension is not loaded. At first, it thought it was the culprit, but it happens without mongo being loaded. One thing, the CLI version seems to be more resilient, it needs more data loaded to crash, whereas with the apache module, it's always crashing. Chromium reports `Error 324 (net::ERR_EMPTY_RESPONSE): Unknown error` when accessing a url. I was able to get a backtrace (with no execute or zbacktrace output) and around frame 30-ish, it specifies entering the shutdown sequence, cleaning up a closure and then the crash. Changing the summary to better reflect the problem. ------------------------------------------------------------------------ [2011-04-08 09:54:35] ahar...@php.net Does PHP only crash when the mongo extension is loaded? If so, please report this at http://pecl.php.net/package/mongo, as bugs in PECL extensions aren't dealt with in this bug tracker. ------------------------------------------------------------------------ [2011-04-08 06:28:38] msamson at chowly dot com Finally got a backtrace: /Zend/Zend_execute_API.c:437 437 Z_DELREF_PP(zval_ptr); There is a mention in another frame about requesting php shutdown. Then higher, it says it will cleanup a closure. Sadly, no execute and zbacktrace output was empty. ------------------------------------------------------------------------ [2011-04-08 05:27:10] msamson at chowly dot com Description: ------------ PHP crash either as a httpd module or as cli with `zend_mm_heap corrupted`. Please see https://bugzilla.redhat.com/show_bug.cgi?id=694630 This was initially thought as a fedora packaging bug, but even a compiled from source php is producing the same error. Test script: --------------- Please see https://bugzilla.redhat.com/show_bug.cgi?id=694630 for a simple script. Actual result: -------------- Tested is using a 2 different virtual machines both running Fedora 14 x64. One with php from yum, the other compiled. gdb reports no backtrace and says there is `no stack`. Apache 2.2 crashes, running php-cli too. relevant strace output: array(0) { } } </div> </div> </body> </html>) = 1681 write(2, "zend_mm_heap corrupted\n", 23zend_mm_heap corrupted ) = 23 exit_group(1) = ? Another one with sessions: pwrite(3, "cart|a:1:{s:2:\"id\";C:7:\"MongoId\""..., 63, 0) = 63 close(3) = 0 close(4) = 0 write(2, "zend_mm_heap corrupted\n", 23zend_mm_heap corrupted ) = 23 exit_group(1) It appears php is crashing at the end of the request just before delivering the content, when a database of some sort is used. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/bug.php?id=54491&edit=1
