Edit report at https://bugs.php.net/bug.php?id=53768&edit=1
ID: 53768
Updated by: fel...@php.net
Reported by: landeholm at gmail dot com
Summary: Segfault at zend_vm_execute.h:428 in shutdown
function
-Status: Open
+Status: Feedback
Type: Bug
Package: Reproducible crash
Operating System: Linux 2.6.18-194.17.1
PHP Version: 5.3.5
Block user comment: N
Private report: N
New Comment:
Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves.
A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external
resources such as databases, etc. If the script requires a
database to demonstrate the issue, please make sure it creates
all necessary tables, stored procedures etc.
Please avoid embedding huge scripts into the report.
Previous Comments:
------------------------------------------------------------------------
[2011-01-17 16:08:56] landeholm at gmail dot com
Description:
------------
Just upgraded to 5.3.5 and PHP segfaults in a shutdown function (which is a
closure) that calls session_write_close which has a registered callback for
write (which is also a closure).
I have APC enabled but I disabled it and got the same problem. The line of PHP
causing the segfault is basically a $object->function() call. Otherwise no
weird extensions installed.
Test script:
---------------
I haven't bothered isolating the bug to a small testcase. It's not a single
call or small piece of data causing the segfault but rather a complex code
context. The actual line is a call to a class instance function of a database
abstraction object instance in a closure.. in a session callback.. in a
shutdown function closure... in a shutdown function closure. Just replacing the
instance with a foo bar class instance makes the bug go away. It's also only
happens in a production environment which is hard to interact with. Isolating
it to a small testcase could take me hours, I hope you can figure it out by
looking at the backtrace.
Expected result:
----------------
No segfault.
Actual result:
--------------
Backtrace from gdb:
Program received signal SIGSEGV, Segmentation fault.
ZEND_RECV_SPEC_HANDLER (execute_data=0x2af31f8d5250) at
/root/php/php/php-5.3.5/Zend/zend_vm_execute.h:428
428 zval **param = zend_vm_stack_get_arg(arg_num TSRMLS_CC);
(gdb) backtrace
#0 ZEND_RECV_SPEC_HANDLER (execute_data=0x2af31f8d5250) at
/root/php/php/php-5.3.5/Zend/zend_vm_execute.h:428
#1 0x00002af3234d2da0 in execute (op_array=0x10396ed0) at
/root/php/php/php-5.3.5/Zend/zend_vm_execute.h:107
#2 0x00002af3234a1dff in zend_call_function (fci=0x7fff5cf09480,
fci_cache=<value optimized out>) at
/root/php/php/php-5.3.5/Zend/zend_execute_API.c:964
#3 0x00002af3234a21a0 in call_user_function_ex (function_table=<value
optimized out>, object_pp=<value optimized out>, function_name=0xffffffff,
retval_ptr_ptr=0x4,
param_count=32, params=0x101010101010101, no_separation=1,
symbol_table=0x0) at /root/php/php/php-5.3.5/Zend/zend_execute_API.c:754
#4 0x00002af3234a38b2 in call_user_function (function_table=0xfea9ac0,
object_pp=0x0, function_name=0xffffffff, retval_ptr=0x7fff5cf09540,
param_count=32,
params=<value optimized out>) at
/root/php/php/php-5.3.5/Zend/zend_execute_API.c:727
#5 0x00002af3233d98d7 in user_shutdown_function_call
(shutdown_function_entry=0x10561610) at
/root/php/php/php-5.3.5/ext/standard/basic_functions.c:4984
#6 0x00002af3234b9915 in zend_hash_apply (ht=0x102d8df0,
apply_func=0x2af3233d9880 <user_shutdown_function_call>) at
/root/php/php/php-5.3.5/Zend/zend_hash.c:676
#7 0x00002af3233d79b6 in php_call_shutdown_functions () at
/root/php/php/php-5.3.5/ext/standard/basic_functions.c:5076
#8 0x00002af32345aefa in php_request_shutdown (dummy=<value optimized out>) at
/root/php/php/php-5.3.5/main/main.c:1582
#9 0x00002af323536fe7 in php_apache_request_dtor (r=<value optimized out>) at
/root/php/php/php-5.3.5/sapi/apache2handler/sapi_apache2.c:509
#10 php_handler (r=<value optimized out>) at
/root/php/php/php-5.3.5/sapi/apache2handler/sapi_apache2.c:681
#11 0x0000000000443075 in ap_run_handler ()
#12 0x0000000000443966 in ap_invoke_handler ()
#13 0x000000000046661c in ap_internal_redirect ()
#14 0x00002af329166cd5 in ?? () from /usr/lib/apache2/modules/mod_rewrite.so
#15 0x0000000000443075 in ap_run_handler ()
#16 0x0000000000443966 in ap_invoke_handler ()
#17 0x0000000000465aeb in ap_process_request ()
#18 0x0000000000462a37 in ap_process_http_connection ()
#19 0x000000000044cdb6 in ap_run_process_connection ()
#20 0x000000000044d2a3 in ap_process_connection ()
#21 0x0000000000480348 in process_socket ()
#22 0x0000000000482241 in child_main ()
#23 0x00000000004831d4 in make_child ()
#24 0x0000000000483529 in create_new_childs ()
#25 0x000000000048358d in check_for_new_childs ()
#26 0x0000000000483fcd in ap_mpm_run ()
#27 0x00000000004297e9 in main ()
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=53768&edit=1
