#44546 [Opn]: crash with SplHeap::next()

ID: 44546 Updated by: colder@php.net Reported By: l dot alberton at quipo dot it Status: Open Bug Type: SPL related Operating System: Windows PHP Version: 5.3CVS-2008-03-27 (snap) New Comment: Doesn't look in any way related to spl heaps.... Seems like the build is somehow broken Previous Comments: ------------------------------------------------------------------------ [2008-03-27 17:00:23] l dot alberton at quipo dot it BTW: I don't get a crash when running the script from the command line, but Apache crashes when running it in a web browser ------------------------------------------------------------------------ [2008-03-27 16:58:55] l dot alberton at quipo dot it Entry point msvcrt!_endthreadex+3a Create time 27/03/2008 17.28.46 Time spent in user mode 0 Days 0:0:0.15 Time spent in kernel mode 0 Days 0:0:0.31 Function Arg 1 Arg 2 Arg 3 Source 0x00000000 06050040 05a2e398 05f5eea9 php5ts!execute+21e 05f5ec98 05a2e398 00000000 php5ts!zend_execute_scripts+107 00000008 05a2e398 00000000 php5ts!php_execute_script+222 056ffe74 05a2e398 00000005 php5apache2_2!php_handler+5d0 05a2b560 006db248 05a2b560 libhttpd!ap_run_handler+21 05a2b560 05a2b560 05a2b560 libhttpd!ap_invoke_handler+ae 00000000 05a24168 056fff38 libhttpd!ap_die+24e 05a2b560 00000000 00692170 libhttpd!ap_get_request_note+1c6c 05a24168 05a24168 05a24168 libhttpd!ap_run_process_connection+21 05a24168 006ec2c0 056fff80 libhttpd!ap_process_connection+33 05a24168 0596b330 7c92849f libhttpd!ap_regkey_value_remove+c0c 05a24160 7c92849f 00d50648 msvcrt!_endthreadex+a9 00fff9e8 7c92849f 00d50648 kernel32!BaseThreadStart+37 77c0a341 00fff9e8 00000000 In httpd__PID__4704__Date__03_27_2008__Time_05_41_03PM__406__First chance exception 0XC0000005.dmp the module C:\PHP\php5ts.dll has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 247 Module Information Image Name: C:\PHP\php5ts.dll Symbol Type: PDB Base address: 0x00770000 Time Stamp: Thu Mar 27 13:17:55 2008 Checksum: 0x00000000 Comments: COM DLL: False Company Name: The PHP Group ISAPIExtension: False File Description: PHP Script Interpreter ISAPIFilter: False File Version: 5.3.0-dev Managed DLL: False Internal Name: PHP Script Interpreter VB DLL: False Legal Copyright: Copyright © 1997-2008 The PHP Group Loaded Image Name: php5ts.dll Legal Trademarks: PHP Mapped Image Name: C:\PHP\php5ts.dll Original filename: php5ts.dll Module name: php5ts Private Build: Single Threaded: False Product Name: PHP Module Size: 5,07 MBytes Product Version: 5.3.0-dev Symbol File Name: C:\PHP\debugpack\php5ts.pdb Special Build: & ------------------------------------------------------------------------ [2008-03-27 16:53:50] l dot alberton at quipo dot it Entry point msvcrt!_endthreadex+3a Create time 27/03/2008 17.28.46 Time spent in user mode 0 Days 0:0:0.15 Time spent in kernel mode 0 Days 0:0:0.31 Function Arg 1 Arg 2 Arg 3 Source 0x00000000 06050040 05a2e398 05f5eea9 php5ts!execute+21e 05f5ec98 05a2e398 00000000 php5ts!zend_execute_scripts+107 00000008 05a2e398 00000000 php5ts!php_execute_script+222 056ffe74 05a2e398 00000005 php5apache2_2!php_handler+5d0 05a2b560 006db248 05a2b560 libhttpd!ap_run_handler+21 05a2b560 05a2b560 05a2b560 libhttpd!ap_invoke_handler+ae 00000000 05a24168 056fff38 libhttpd!ap_die+24e 05a2b560 00000000 00692170 libhttpd!ap_get_request_note+1c6c 05a24168 05a24168 05a24168 libhttpd!ap_run_process_connection+21 05a24168 006ec2c0 056fff80 libhttpd!ap_process_connection+33 05a24168 0596b330 7c92849f libhttpd!ap_regkey_value_remove+c0c 05a24160 7c92849f 00d50648 msvcrt!_endthreadex+a9 00fff9e8 7c92849f 00d50648 kernel32!BaseThreadStart+37 77c0a341 00fff9e8 00000000 In httpd__PID__4704__Date__03_27_2008__Time_05_41_06PM__750__Second_Chance_Exception_C0000005.dmp the module C:\PHP\php5ts.dll has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 247 Module Information Image Name: C:\PHP\php5ts.dll Symbol Type: PDB Base address: 0x00770000 Time Stamp: Thu Mar 27 13:17:55 2008 Checksum: 0x00000000 Comments: COM DLL: False Company Name: The PHP Group ISAPIExtension: False File Description: PHP Script Interpreter ISAPIFilter: False File Version: 5.3.0-dev Managed DLL: False Internal Name: PHP Script Interpreter VB DLL: False Legal Copyright: Copyright © 1997-2008 The PHP Group Loaded Image Name: php5ts.dll Legal Trademarks: PHP Mapped Image Name: C:\PHP\php5ts.dll Original filename: php5ts.dll Module name: php5ts Private Build: Single Threaded: False Product Name: PHP Module Size: 5,07 MBytes Product Version: 5.3.0-dev Symbol File Name: C:\PHP\debugpack\php5ts.pdb Special Build: & ------------------------------------------------------------------------ [2008-03-27 15:26:38] felipe@php.net Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php for *NIX and http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32 Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. ------------------------------------------------------------------------ [2008-03-27 15:22:20] l dot alberton at quipo dot it I'm using the latest snapshot. Etienne told me it works with Linux, but I can consistently reproduce this bug on windows (I already experienced it in the 19/03 snapshot and ever since, haven't checked before). This is the error message in the Apache error.log file: [notice] Parent: child process exited with status 3221225477 -- Restarting. [notice] Apache/2.2.4 (Win32) PHP/5.3.0-dev configured -- resuming normal operations ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/44546 -- Edit this bug report at http://bugs.php.net/?id=44546&edit=1