#27472 [Com]: Segfault with dom nodelist and new domelement
ID: 27472
Comment by: ds at cyberspace dot co dot za
Reported By: info at rhalff dot com
Status: Feedback
Bug Type: Reproducible crash
Operating System: linux
PHP Version: 5.0.0b4 (beta4)
New Comment:
Seems to similar to a problem I experienced when calling domDocument in
a class method (bug #27467) with PHP 5 cvs.
Previous Comments:
[2004-03-03 04:38:31] [EMAIL PROTECTED]
Please try using this CVS snapshot:
http://snaps.php.net/php5-latest.tar.gz
For Windows:
http://snaps.php.net/win32/php5-win32-latest.zip
I could not reproduce this at all. But can you please just provide a
script that segfaults (without any other comments in there that say
this works)? But first try the latest snapshop.
[2004-03-02 20:32:43] info at rhalff dot com
Description:
Just running the class Bug will work.
But running Segvault after that will crash the running
process.
The part causing problems is the coexistence of the
nodelist assignement to $k and a new domelement being
assigned to a property inside another class.
Reproduce code:
---
?
error_reporting(E_ALL);
$Bug = new Bug;
$Bug-start();
$segv = new Segvault();
$segv-now();
class Segvault {
function now() {
/* These will work: */
// $x = new domdocument;
// $this-x = new stdClass;
/* This segvaults */
$this-x = new domdocument;
//$this-x = new domelement;
}
}
class Bug
{
function start()
{
$dom = new domdocument;
$dom-loadXml(rootbug/bug/root);
//This works:
//echo $dom-getElementsByTagname('bug')-lenght;
$k = $dom-getElementsByTagname('bug');
echo $k-length;
}
}
?
Expected result:
1
Actual result:
--
[EMAIL PROTECTED]:/www/hosts/www.rhalff.com/php5/test#
gdb /usr/sbin/httpd
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public
License, and you are
welcome to change it and/or distribute copies of it under
certain conditions.
Type show copying to see the conditions.
There is absolutely no warranty for GDB. Type show
warranty for details.
This GDB was configured as i386-slackware-linux...(no
debugging symbols found)...
(gdb) run -X -k start -f /etc/apache2/php5/httpd.conf
Starting program: /usr/sbin/httpd -X -k start
-f /etc/apache2/php5/httpd.conf
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...
(no debugging symbols found)...[New Thread 1024 (LWP
16650)]
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 16650)]
0x40660790 in zend_get_extension ()
from /usr/lib/apache2/libphp5.so
(gdb) bt
#0 0x40660790 in zend_get_extension ()
from /usr/lib/apache2/libphp5.so
#1 0x40661d74 in zend_hash_destroy ()
from /usr/lib/apache2/libphp5.so
#2 0x404ea31b in dom_objects_free_storage ()
from /usr/lib/apache2/libphp5.so
#3 0x4066fa9b in zend_objects_store_del_ref ()
from /usr/lib/apache2/libphp5.so
#4 0x406588ec in _zval_dtor ()
from /usr/lib/apache2/libphp5.so
#5 0x4064f0c5 in _zval_ptr_dtor ()
from /usr/lib/apache2/libphp5.so
#6 0x40658c7a in _zval_ptr_dtor_wrapper ()
from /usr/lib/apache2/libphp5.so
#7 0x40661da7 in zend_hash_destroy ()
from /usr/lib/apache2/libphp5.so
#8 0x4066d03f in zend_objects_free_object_storage ()
from /usr/lib/apache2/libphp5.so
#9 0x4066f8d9 in zend_objects_store_free_object_storage
() from /usr/lib/apache2/libphp5.so
#10 0x4064ee09 in shutdown_executor ()
from /usr/lib/apache2/libphp5.so
#11 0x4065a1f5 in zend_deactivate ()
from /usr/lib/apache2/libphp5.so
#12 0x4061f038 in php_request_shutdown ()
from /usr/lib/apache2/libphp5.so
#13 0x406a4bf4 in zend_init_opcodes_handlers ()
from /usr/lib/apache2/libphp5.so
#14 0x406a5120 in zend_init_opcodes_handlers ()
from /usr/lib/apache2/libphp5.so
#15 0x806b7d9 in ap_run_handler () at eval.c:88
#16 0x806bd23 in ap_invoke_handler () at eval.c:88
#17 0x8069036 in ap_process_request () at eval.c:88
#18 0x80650aa in _start () at eval.c:88
#19 0x8073a28 in ap_run_process_connection () at eval.c:88
#20 0x8073ccc in ap_process_connection () at eval.c:88
#21 0x806a4b0 in ap_graceful_stop_signalled () at
eval.c:88
#22 0x806a56c in ap_graceful_stop_signalled () at
eval.c:88
#23 0x806a661 in ap_graceful_stop_signalled () at
eval.c:88
#24 0x806a95c in ap_mpm_run () at eval.c:88
#25 0x806ffee in main () at eval.c:88
#26 0x402c92eb in __libc_start_main (main=0x806f870
main, argc=6, ubp_av=0xbb14, init=0x8062450 _init,
fini=0x808678c _fini,
rtld_fini=0x4000c130 _dl_fini,
#27472 [Com]: Segfault with dom nodelist and new domelement
ID: 27472
Comment by: ds at cyberspace dot co dot za
Reported By: info at rhalff dot com
Status: Feedback
Bug Type: Reproducible crash
Operating System: linux
PHP Version: 5.0.0b4 (beta4)
New Comment:
$ php repro.php
1
Hm. Can't reproduce either, works from 5 CVS..
Previous Comments:
[2004-03-03 06:45:17] [EMAIL PROTECTED]
Different problem.
Did you try the snap yet as I cant reproduce this either?
[2004-03-03 06:39:34] ds at cyberspace dot co dot za
Seems to similar to a problem I experienced when calling domDocument in
a class method (bug #27467) with PHP 5 cvs.
[2004-03-03 04:38:31] [EMAIL PROTECTED]
Please try using this CVS snapshot:
http://snaps.php.net/php5-latest.tar.gz
For Windows:
http://snaps.php.net/win32/php5-win32-latest.zip
I could not reproduce this at all. But can you please just provide a
script that segfaults (without any other comments in there that say
this works)? But first try the latest snapshop.
[2004-03-02 20:32:43] info at rhalff dot com
Description:
Just running the class Bug will work.
But running Segvault after that will crash the running
process.
The part causing problems is the coexistence of the
nodelist assignement to $k and a new domelement being
assigned to a property inside another class.
Reproduce code:
---
?
error_reporting(E_ALL);
$Bug = new Bug;
$Bug-start();
$segv = new Segvault();
$segv-now();
class Segvault {
function now() {
/* These will work: */
// $x = new domdocument;
// $this-x = new stdClass;
/* This segvaults */
$this-x = new domdocument;
//$this-x = new domelement;
}
}
class Bug
{
function start()
{
$dom = new domdocument;
$dom-loadXml(rootbug/bug/root);
//This works:
//echo $dom-getElementsByTagname('bug')-lenght;
$k = $dom-getElementsByTagname('bug');
echo $k-length;
}
}
?
Expected result:
1
Actual result:
--
[EMAIL PROTECTED]:/www/hosts/www.rhalff.com/php5/test#
gdb /usr/sbin/httpd
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public
License, and you are
welcome to change it and/or distribute copies of it under
certain conditions.
Type show copying to see the conditions.
There is absolutely no warranty for GDB. Type show
warranty for details.
This GDB was configured as i386-slackware-linux...(no
debugging symbols found)...
(gdb) run -X -k start -f /etc/apache2/php5/httpd.conf
Starting program: /usr/sbin/httpd -X -k start
-f /etc/apache2/php5/httpd.conf
(no debugging symbols found)...(no debugging symbols
found)...(no debugging symbols found)...(no debugging
symbols found)...(no debugging symbols found)...
(no debugging symbols found)...[New Thread 1024 (LWP
16650)]
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 16650)]
0x40660790 in zend_get_extension ()
from /usr/lib/apache2/libphp5.so
(gdb) bt
#0 0x40660790 in zend_get_extension ()
from /usr/lib/apache2/libphp5.so
#1 0x40661d74 in zend_hash_destroy ()
from /usr/lib/apache2/libphp5.so
#2 0x404ea31b in dom_objects_free_storage ()
from /usr/lib/apache2/libphp5.so
#3 0x4066fa9b in zend_objects_store_del_ref ()
from /usr/lib/apache2/libphp5.so
#4 0x406588ec in _zval_dtor ()
from /usr/lib/apache2/libphp5.so
#5 0x4064f0c5 in _zval_ptr_dtor ()
from /usr/lib/apache2/libphp5.so
#6 0x40658c7a in _zval_ptr_dtor_wrapper ()
from /usr/lib/apache2/libphp5.so
#7 0x40661da7 in zend_hash_destroy ()
from /usr/lib/apache2/libphp5.so
#8 0x4066d03f in zend_objects_free_object_storage ()
from /usr/lib/apache2/libphp5.so
#9 0x4066f8d9 in zend_objects_store_free_object_storage
() from /usr/lib/apache2/libphp5.so
#10 0x4064ee09 in shutdown_executor ()
from /usr/lib/apache2/libphp5.so
#11 0x4065a1f5 in zend_deactivate ()
from /usr/lib/apache2/libphp5.so
#12 0x4061f038 in php_request_shutdown ()
from /usr/lib/apache2/libphp5.so
#13 0x406a4bf4 in zend_init_opcodes_handlers ()
from /usr/lib/apache2/libphp5.so
#14 0x406a5120 in zend_init_opcodes_handlers ()
from /usr/lib/apache2/libphp5.so
#15 0x806b7d9 in ap_run_handler () at eval.c:88
#16 0x806bd23 in ap_invoke_handler () at eval.c:88
#17 0x8069036 in ap_process_request () at eval.c:88
#18 0x80650aa in _start () at eval.c:88
#19 0x8073a28 in ap_run_process_connection () at eval.c:88
#20 0x8073ccc in ap_process_connection () at eval.c:88
#21 0x806a4b0 in ap_graceful_stop_signalled () at
eval.c:88
