Edit report at https://bugs.php.net/bug.php?id=53716&edit=1
ID: 53716 Comment by: silvio dot ginter at volz-itsc dot de Reported by: anthon dot pang at gmail dot com Summary: segfault in $stmt->execute() Status: Feedback Type: Bug Package: PDO related Operating System: Ubuntu 10.04 PHP Version: 5.3.5 Block user comment: N Private report: N New Comment: +1 for me.... This problem still exists in PHP 5.3.9 under OpenSUSE 11.4. All packages were taken from OpenSUSE Yast Repositories. Output of Apache HTTP Daemon: ----------------------------- [Wed Jan 18 16:45:06 2012] [notice] Apache/2.2.21 (Linux/SUSE) mod_ssl/2.2.21 OpenSSL/1.0.0c PHP/5.3.9 configured -- resuming normal operations *** glibc detected *** /usr/sbin/httpd2-prefork: free(): invalid pointer: 0x00007f1902d75608 *** Output of php -i | grep mysql ----------------------------- /etc/php5/conf.d/mysql.ini, /etc/php5/conf.d/mysqli.ini, /etc/php5/conf.d/mysqlnd.ini, /etc/php5/conf.d/pdo_mysql.ini, mysql Client API version => mysqlnd 5.0.8-dev - 20102224 - $Revision: 321634 $ mysql.allow_local_infile => On => On mysql.allow_persistent => On => On mysql.connect_timeout => 60 => 60 mysql.default_host => no value => no value mysql.default_password => no value => no value mysql.default_port => no value => no value mysql.default_socket => /var/lib/mysql/mysql.sock => /var/lib/mysql/mysql.sock mysql.default_user => no value => no value mysql.max_links => Unlimited => Unlimited mysql.max_persistent => Unlimited => Unlimited mysql.trace_mode => Off => Off mysqli Client API library version => mysqlnd 5.0.8-dev - 20102224 - $Revision: 321634 $ mysqli.allow_local_infile => On => On mysqli.allow_persistent => On => On mysqli.default_host => no value => no value mysqli.default_port => 3306 => 3306 mysqli.default_pw => no value => no value mysqli.default_socket => /var/lib/mysql/mysql.sock => /var/lib/mysql/mysql.sock mysqli.default_user => no value => no value mysqli.max_links => Unlimited => Unlimited mysqli.max_persistent => Unlimited => Unlimited mysqli.reconnect => Off => Off mysqlnd mysqlnd => enabled Version => mysqlnd 5.0.8-dev - 20102224 - $Revision: 321634 $ Tracing => d:t:x:O,/tmp/mysqlnd.trace PDO drivers => mysql, odbc, pgsql, sqlite, sqlite2 pdo_mysql Client API version => mysqlnd 5.0.8-dev - 20102224 - $Revision: 321634 $ pdo_mysql.default_socket => /var/lib/mysql/mysql.sock => /var/lib/mysql/mysql.sock Previous Comments: ------------------------------------------------------------------------ [2011-06-13 03:33:31] fel...@php.net Please try using this snapshot: http://snaps.php.net/php5.3-latest.tar.gz For Windows: http://windows.php.net/snapshots/ ------------------------------------------------------------------------ [2011-02-09 05:27:34] max at axismedia dot ru In update to my previous message: 5. If i switch persistent connection off (PDO::ATTR_PERSISTENT => false) everithing is fine too. ------------------------------------------------------------------------ [2011-02-09 05:15:32] max at axismedia dot ru Looks like I have very similar problem. In short php 5.3 in CLI or Apach module mode, PDO compiled againt mysqlnd crashes when using MySQL native prepared queries with segmentation fault. EXAMPLE SCRIPT <?php $driver_options = array(PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,. PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES 'UTF8';", PDO::ATTR_PERSISTENT => true, PDO::MYSQL_ATTR_DIRECT_QUERY => false); $sql = 'SELECT NOW()'; $pdo = new PDO('mysql:host=localhost;dbname=m_shop', 'max', null, $driver_options); $st = $pdo->prepare($sql, array(PDO::ATTR_CURSOR => PDO::CURSOR_FWDONLY)); print "before execute\n"; $st->execute(); print "after execute\n"; $st->closeCursor(); $pdo = null; ?> Output: office tmp # php bug.php before execute after execute Segmentation fault (core dumped) BACKTRACE (gdb) bt #0 0xb6acb02d in free () from /lib/libc.so.6 #1 0x082f8208 in _mysqlnd_pefree (ptr=0x0, persistent=1 '\001', tsrm_ls=0x0) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_debug.c:1062 #2 0x082e97c8 in php_mysqlnd_stmt_free_result_bind_pub (s=0x8b56024, result_bind=0x8b24a60, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_ps.c:2296 #3 0x082e9856 in mysqlnd_stmt_separate_result_bind (s=0x8b56024, tsrm_ls=<value optimized out>) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_ps.c:2029 #4 0x082e98d3 in php_mysqlnd_stmt_free_result_pub (s=0x8b56024, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_ps.c:1961 #5 0x081e8e11 in pdo_mysql_stmt_cursor_closer (stmt=0x8b24240, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/pdo_mysql/mysql_statement.c:906 #6 0x081e4471 in zim_PDOStatement_closeCursor (ht=0, return_value=0x8b24154, return_value_ptr=0x0, this_ptr=0x8b24170, return_value_used=0, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/pdo/pdo_stmt.c:2141 #7 0x0839edf1 in zend_do_fcall_common_helper_SPEC (execute_data=0x8b56058, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/Zend/zend_vm_execute.h:316 #8 0x0839f2f1 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0x1, tsrm_ls=0x8b24a54) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/Zend/zend_vm_execute.h:421 #9 0x083786a6 in execute (op_array=0x8b23124, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/Zend/zend_vm_execute.h:107 #10 0x08353317 in zend_execute_scripts (type=8, tsrm_ls=0x891e280, retval=0x0, file_count=3) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/Zend/zend.c:1194 #11 0x082fcee9 in php_execute_script (primary_file=0xbfbfa920, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/main/main.c:2265 #12 0x083d6fe6 in main (argc=2, argv=0xbfbfaa24) at /var/tmp/portage/dev- lang/php-5.3.5/work/sapis-build/cli/sapi/cli/php_cli.c:1193 NOTES 1. If i do not call $st->closeCursor() i still get segmentation fault but with a bit different backtrace (same problem but on php environment shutdown): #0 0xffffe424 in __kernel_vsyscall () #1 0xb6a4c401 in raise () from /lib/libc.so.6 #2 0xb6a4db42 in abort () from /lib/libc.so.6 #3 0xb6a87815 in ?? () from /lib/libc.so.6 #4 0xb6a8d6d1 in ?? () from /lib/libc.so.6 #5 0xb6a8ef38 in ?? () from /lib/libc.so.6 #6 0xb6a9203d in free () from /lib/libc.so.6 #7 0x082f8208 in _mysqlnd_pefree (ptr=0x0, persistent=48 '0', tsrm_ls=0x400) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_debug.c:1062 #8 0x082e97c8 in php_mysqlnd_stmt_free_result_bind_pub (s=0x8b56024, result_bind=0x8b24a4c, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_ps.c:2296 #9 0x082e9856 in mysqlnd_stmt_separate_result_bind (s=0x8b56024, tsrm_ls=<value optimized out>) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_ps.c:2029 #10 0x082e99a3 in php_mysqlnd_stmt_free_stmt_content_pub (s=0x8b56024, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_ps.c:2125 #11 0x082eb441 in php_mysqlnd_stmt_net_close_priv (s=0x8b56024, implicit=0 '\000', tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_ps.c:2212 #12 0x082eaf9e in php_mysqlnd_stmt_dtor_pub (s=0x8b56024, implicit=6 '\006', tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/mysqlnd/mysqlnd_ps.c:2239 #13 0x081e9d89 in pdo_mysql_stmt_dtor (stmt=0x8b24560, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/pdo_mysql/mysql_statement.c:64 #14 0x081e357c in free_statement (stmt=0x8b24560, tsrm_ls=<value optimized out>) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/ext/pdo/pdo_stmt.c:2398 #15 0x081e36d8 in php_pdo_stmt_delref (stmt=0x0, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis-build/cli/ext/pdo/pdo_stmt.c:2440 #16 0x081e36f2 in pdo_dbstmt_free_storage (stmt=0x8b24560, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis-build/cli/ext/pdo/pdo_stmt.c:2446 #17 0x08374b9b in zend_objects_store_del_ref_by_handle_ex (handle=2, handlers=0x891c180, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/Zend/zend_objects_API.c:220 #18 0x08374cab in zend_objects_store_del_ref (zobject=0x8b240d8, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/Zend/zend_objects_API.c:172 #19 0x0835303e in _zval_dtor_func (zvalue=0x8b240d8) at /var/tmp/portage/dev- lang/php-5.3.5/work/sapis-build/cli/Zend/zend_variables.c:52 #20 0x083483f9 in _zval_dtor (zval_ptr=0x8b244bc) at /var/tmp/portage/dev- lang/php-5.3.5/work/sapis-build/cli/Zend/zend_variables.h:35 #21 _zval_ptr_dtor (zval_ptr=0x8b244bc) at /var/tmp/portage/dev-lang/php- 5.3.5/work/sapis-build/cli/Zend/zend_execute_API.c:443 #22 0x0835f42c in zend_hash_apply_deleter (ht=0x89204f0, p=0x8b244b0) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis-build/cli/Zend/zend_hash.c:614 #23 0x0835f4d8 in zend_hash_reverse_apply (ht=0x89204f0, apply_func=0x8347a56 <zval_call_destructor>, tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/Zend/zend_hash.c:763 #24 0x08348c79 in shutdown_destructors (tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis- build/cli/Zend/zend_execute_API.c:226 #25 0x08353dd2 in zend_call_destructors (tsrm_ls=0x891e280) at /var/tmp/portage/dev-lang/php-5.3.5/work/sapis-build/cli/Zend/zend.c:874 #26 0x082fd893 in php_request_shutdown (dummy=0x0) at /var/tmp/portage/dev- lang/php-5.3.5/work/sapis-build/cli/main/main.c:1587 #27 0x083d782b in main (argc=2, argv=0xbfbc8ae4) at /var/tmp/portage/dev- lang/php-5.3.5/work/sapis-build/cli/sapi/cli/php_cli.c:1374 2. If i use emulated prepares (PDO::MYSQL_ATTR_DIRECT_QUERY => true) everyting is fine. 3. If compile PDO against standard mysqlclientlib driver everything is fine. 4. Situation is reproduced at x86 and x86_64 ------------------------------------------------------------------------ [2011-01-12 17:24:04] anthon dot pang at gmail dot com I'm in the middle of a project. For reference, the segfault occurs in r3717: http://dev.piwik.org/trac/changeset/3717/trunk?old_path=%2F&format=zip Please keep this ticket open until I have some free time to troubleshoot and isolate a smaller test case. (I can already tell you it'll require database access and be more than the arbitrary 20 line limit.) Additional info: Same code doesn't crash when using MYSQLI or php 5.2.17. (Tested/segfaulted with 5.3.2, 5.3.3, 5.3.4, and 5.3.5. These are all vanilla builds using source downloads from php.net.) ------------------------------------------------------------------------ [2011-01-12 12:00:33] paj...@php.net Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=53716 -- Edit this bug report at https://bugs.php.net/bug.php?id=53716&edit=1
