#39620 [Opn]: SEGV in zend_do_fcall_common_helper_SPEC

ID: 39620 User updated by: jens at strawberry dot com Reported By: jens at strawberry dot com Status: Open Bug Type: Reproducible crash Operating System: Solaris 8, 32bit -PHP Version: 5.2.0 +PHP Version: 5.2.0, 5.2.1-dev New Comment: Bug also found in 5.2.1-dev Previous Comments: ------------------------------------------------------------------------ [2006-11-29 06:27:11] jens at strawberry dot com Hi, I've sent the output of phpinfo directly to tony2001@php.net Jens ------------------------------------------------------------------------ [2006-11-29 06:14:27] jens at strawberry dot com Hi, I tried it again with 5.2.0 on Solaris 10 x86 php5.2-200611281530 also on Solaris 10 x86 Both of them show the same behavior. This bug has heavy impact! It results in PHP being unusable at all in this environment. The bug is pretty reproducable. It happens everytime a script consisting of <?phpinfo()?> is called. However, I have a PHP 5.1.4 running on Solaris 10 Sparc in a 64 Bit environment which does not show this problems. At the time being I've only seen it in 32 bit environments. Jens ------------------------------------------------------------------------ [2006-11-24 15:11:55] tony2001@php.net Please try using this CVS snapshot: http://snaps.php.net/php5.2-latest.tar.gz For Windows: http://snaps.php.net/win32/php5.2-win32-latest.zip ------------------------------------------------------------------------ [2006-11-24 15:09:51] jens at strawberry dot com Description: ------------ I've compiled and installed PHP version 5.2.0 in the following environment: Server: SparcStation 20 dual CPU OS: Solaris 8, Kernel patch 117350-41 Apache: 2.2.2 The apache server starts and answers requests. Upon loading a php test page from this server, the http server process begins consuming 100% CPU and finally crashes in format_converter with signal 11 (SEGV). Reproduce code: --------------- Enable short tags in php.ini. Load the following page from the server test.php: <?phpinfo()?> Expected result: ---------------- Info page should show up. http process should keep stable. Actual result: -------------- http server enters a loop between the functions zend_do_fcall_common_helper_SPEC and execute_internal which after a while leads to the SEGV in format_converter The following output is produced using adb attached to a nonfork apache server: SIGSEGV: Segmentation Fault (address not mapped to object) stopped at: format_converter+8: st %i0, [%sp + 0x64] symbol not found process terminated $c ... execute_internal(0xed4bd430,0x14,0xefff7f08,0xed673178,0x501be8,0x50) + 204 [savfp=0xefff7f48,savpc=0xed4bd064] zend_do_fcall_common_helper_SPEC(0xefff8088,0xefff808c,0xce2c,0xefff8494,0x1,0x0) + 4c8 [savfp=0xefff7fa8,savpc=0xed4bcb18] execute_internal(0xed4bd430,0x1,0xefff8088,0xed673178,0x457a80,0x4) + 204 [savfp=0xefff80c8,savpc=0xed4bd064] zend_do_fcall_common_helper_SPEC(0xefff84a8,0xefff84ac,0xce2c,0xefff8724,0x1,0x0) + 4c8 [savfp=0xefff8128,savpc=0xed4bcb18] execute_internal(0xed4bd430,0x7,0xefff84a8,0xed673178,0x4f8578,0x1c) + 204 [savfp=0xefff84e8,savpc=0xed4bd064] zend_do_fcall_common_helper_SPEC(0xefff8768,0xefff876c,0xce2c,0xefff914c,0x1,0x0) + 4c8 [savfp=0xefff8548,savpc=0xed4bcb18] execute_internal(0xed4bd430,0xa,0xefff8768,0xed673178,0x5324e8,0x28) + 204 [savfp=0xefff87a8,savpc=0xed4bd064] zend_do_fcall_common_helper_SPEC(0xefffef80,0xefffef84,0xce2c,0xeffff0b4,0x1,0x0) + 4c8 [savfp=0xefff8808,savpc=0xed4bcb18] execute_internal(0xed4bd430,0x76,0xefffef80,0xed673178,0x41e4c0,0x1d8) + 204 [savfp=0xefffefc0,savpc=0xed489a30] zend_execute_scripts(0x8,0x0,0x3,0xeffff65c,0xed672f58,0x0) + 110 [savfp=0xeffff0b8,savpc=0xed4111f8] php_execute_script(0xa800,0x25edc8,0xed5c9f8c,0xed6729a8,0xd000,0x3c) + 350 [savfp=0xeffff5b8,savpc=0xed502f0c] php_handler(0x262178,0xd018,0xed5c9f8c,0xd400,0xc800,0x0) + 588 [savfp=0xeffff6e0,savpc=0x402e0] ap_run_handler(0x25cf98,0x94980,0x948f0,0xffffffff,0x6,0x948f0) + 48 [savfp=0xeffff740,savpc=0x409a4] ap_invoke_handler(0x25cf98,0x238018,0x25cf98,0x953a8,0x0,0x0) + f8 [savfp=0xeffff7a8,savpc=0x4d7cc] ap_process_request(0x25cf98,0x0,0xc8,0x25cf98,0x0,0x0) + 54 [savfp=0xeffff808,savpc=0x4ac78] ap_filter_protocol(0x246680,0x25cf98,0x79800,0x1,0x1000,0x5) + 31c [savfp=0xeffff868,savpc=0x46db8] ap_run_process_connection(0x246680,0x95064,0x95010,0xffffffff,0x3,0x95010) + 48 [savfp=0xeffff8c8,savpc=0x520a0] ap_graceful_stop_signalled(0x53dac,0x246680,0x7c400,0x7e800,0x0,0x1) + 40c [savfp=0xeffff960,savpc=0x52190] ap_graceful_stop_signalled(0x88448,0x0,0x94e0c,0x94de0,0xffffffff,0x79800) + 4fc [savfp=0xeffff9c0,savpc=0x5270c] ap_mpm_run(0x865a8,0x79800,0x88448,0x79800,0x79b6c,0x7c6e8) + 1c8 [savfp=0xeffffa40,savpc=0x2c8d4] main(0x79800,0x0,0x5e400,0x0,0x78958,0x88448) + 97c [savfp=0xeffffac8,savpc=0x2b714] ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=39620&edit=1