Bug #60837 [Ctl]: Segmentation fail, if use trait

From: Date: Mon, 23 Jan 2012 03:24:56 +0000
Subject: Bug #60837 [Ctl]: Segmentation fail, if use trait
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-166710@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=60837&edit=1

 ID:                 60837
 Updated by:         laruence@php.net
 Reported by:        piphon at gmail dot com
 Summary:            Segmentation fail, if use trait
 Status:             Critical
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   Ubuntu 11.10 64bit
 PHP Version:        5.4SVN-2012-01-22 (SVN)
 Block user comment: N
 Private report:     N

 New Comment:

I can not reproduce this... everything works well here.. (both svn-trunk and 5.4 
branch)


Previous Comments:
------------------------------------------------------------------------
[2012-01-22 12:30:40] piphon at gmail dot com

> Do you have a reproduce code by any chance?

Yes. Finally recreated it.

Small example with dependencies (zf, doctrine, e.t.c) on github.com:
git@github.com:alurin/zend-bug.git

Files:
  - Example/IdentityTrait.php - trait, add id field
  - Example/Temp.php - entity, used IdentityTrait
  - library/ - vendors libraries (submodules)
  - bootstrap.php - setup doctrine
  - script.php - Console interface for doctrine (if update or create data scheme).
  - index.php  - Test example

$ php script.php orm:schema-tool:create
ATTENTION: This operation should not be executed in a production environment.

Creating database schema...
Database schema created successfully!
Segmentation fail (core dumped)

$ php index.php
zend_mm_heap corrupted


All code in two files

index.php
---------
<?php

use Doctrine\ORM\EntityManager,
    Doctrine\ORM\Configuration;

define('PATH_TO_VENDORS', realpath(__DIR__ . '/library'));

// Подключение автозагрузки
классов библотек
require_once PATH_TO_VENDORS . '/zf2/library/Zend/Loader/AutoloaderFactory.php';
Zend\Loader\AutoloaderFactory::factory(
    array(
        'Zend\Loader\StandardAutoloader' => array(
            'namespaces' => array(
                'Zend'                      => PATH_TO_VENDORS .
'/zf2/library/Zend',
                'Doctrine\ORM'              => PATH_TO_VENDORS .
'/doctrine2/lib/Doctrine/ORM',
                'Doctrine\Common'           => PATH_TO_VENDORS .
'/doctrine2-common/lib/Doctrine/Common',
                'Doctrine\DBAL'             => PATH_TO_VENDORS .
'/doctrine2-dbal/lib/Doctrine/DBAL',
                'Symfony\Component\Console' => PATH_TO_VENDORS .
'/symfony-console',
                'Symfony\Component\Yaml'    => PATH_TO_VENDORS .
'/symfony-yaml',
            )
        )
    )
);

function create_doctrine() {
    $cache = new \Doctrine\Common\Cache\ArrayCache;

    $config = new Configuration;
    $config->setMetadataCacheImpl($cache);
    $driverImpl = $config->newDefaultAnnotationDriver(__DIR__ . '/Example');
    $config->setMetadataDriverImpl($driverImpl);
    $config->setQueryCacheImpl($cache);
    $config->setProxyDir('/path/to/myproject/lib/MyProject/Proxies');
    $config->setProxyNamespace('MyProject\Proxies');
    $config->setAutoGenerateProxyClasses(false);

    $connectionOptions = array(
        'driver'   => 'pdo_mysql',        /* Your DB driver here   */
        'host'     => 'localhost',        /* Your DB host here     */
        'user'     => 'php_bug',          /* Your DB user here     */
        'password' => 'A8haaWUH7wxjhfrn', /* Your DB user password */
        'dbname'   => 'php_bug',          /* Your DB name here     */
        'driverOptions' => array(
            1002 => "SET NAMES 'UTF8'"
        ),
    );

    $em = EntityManager::create($connectionOptions, $config);
    return $em;
}

$main = function() {
    $em = create_doctrine();

    include 'full-compounds.php';
    $temp = new Example\Temp();
    $em->persist($temp);
    $em->flush();

    $repo = $em->getRepository('Example\Temp');
    $temp = $repo->find(1);
    $temp->events()->attach('init', function() {
        echo "Init\n";
    });
};

call_user_func_array($main, array());

full-compunds.php
-----------------
<?php

namespace Example;

use Zend\EventManager\ProvidesEvents;

trait EntityTrait {

}

trait IdentityTrait {
    use EntityTrait;

    /**
     * Уникальный идентификатор
объекта в БД
     *
     * @Id @Column(type="integer")
     * @GeneratedValue(strategy="AUTO")
     * @since 0.1
     * @var int
     */
    private $id           = null;

    /**
     * Получить уникальный
идентификатор объекта в БД
     *
     * @return int
     * @since 0.1
     */
    public function getID() {
        return $this->id;
    }
}


/**
 * Модель описывающая
статическую страницу сайта
 *
 * @Entity
 */
class Temp {
    use IdentityTrait;
    use ProvidesEvents;
}

------------------------------------------------------------------------
[2012-01-22 11:40:40] gron@php.net

zend_opcode.c:295 is zend_hash_destroy(&ce->function_table);

I don't see why the function table would be problematic, but I will try to look 
into it today.

------------------------------------------------------------------------
[2012-01-22 09:57:41] pajoye@php.net

Do you have a reproduce code by any chance?

------------------------------------------------------------------------
[2012-01-22 08:34:45] piphon at gmail dot com

Description:
------------
Hello.

From first build (RC1), on my computer PHP 5.4 (all RC and last SVN version) mysteriously crushed on
clean up phase, if used trait. It not reproduces with small scripts, only if application has all
havy libraries: Doctrine2, Zend Framework 2 and many others.

It not serious error, if use application from console of open page in Firefox, but Chrome often
interrupts drawing of content.

Traits has attributes, abstract or static methods.

Actual result:
--------------
Valgrind output:
----------------

==18829== Invalid read of size 8
==18829==    at 0x7622E9: zend_mm_remove_from_free_list (zend_alloc.c:811)
==18829==    by 0x7624FD: _zend_mm_free_int (zend_alloc.c:2106)
==18829==    by 0x79693D: zend_hash_destroy (zend_hash.c:565)
==18829==    by 0x77F11B: destroy_zend_class (zend_opcode.c:295)
==18829==    by 0x79530B: zend_hash_apply_deleter (zend_hash.c:650)
==18829==    by 0x796E20: zend_hash_reverse_apply (zend_hash.c:804)
==18829==    by 0x77A5D5: shutdown_executor (zend_execute_API.c:305)
==18829==    by 0x788F64: zend_deactivate (zend.c:934)
==18829==    by 0x72939E: php_request_shutdown (main.c:1782)
==18829==    by 0x831053: do_cli (php_cli.c:1169)
==18829==    by 0x431A52: main (php_cli.c:1356)
==18829==  Address 0xd0bdd0b0d080d1b5 is not stack'd, malloc'd or (recently) free'd
==18829== 
==18829== 
==18829== Process terminating with default action of signal 11 (SIGSEGV)
==18829==  General Protection Fault
==18829==    at 0x7622E9: zend_mm_remove_from_free_list (zend_alloc.c:811)
==18829==    by 0x7624FD: _zend_mm_free_int (zend_alloc.c:2106)
==18829==    by 0x79693D: zend_hash_destroy (zend_hash.c:565)
==18829==    by 0x77F11B: destroy_zend_class (zend_opcode.c:295)
==18829==    by 0x79530B: zend_hash_apply_deleter (zend_hash.c:650)
==18829==    by 0x796E20: zend_hash_reverse_apply (zend_hash.c:804)
==18829==    by 0x77A5D5: shutdown_executor (zend_execute_API.c:305)
==18829==    by 0x788F64: zend_deactivate (zend.c:934)
==18829==    by 0x72939E: php_request_shutdown (main.c:1782)
==18829==    by 0x831053: do_cli (php_cli.c:1169)
==18829==    by 0x431A52: main (php_cli.c:1356)
==18829== 
==18829== HEAP SUMMARY:
==18829==     in use at exit: 16,535,737 bytes in 19,198 blocks
==18829==   total heap usage: 23,697 allocs, 4,499 frees, 17,668,454 bytes allocated
==18829== 
==18829== LEAK SUMMARY:
==18829==    definitely lost: 0 bytes in 0 blocks
==18829==    indirectly lost: 0 bytes in 0 blocks
==18829==      possibly lost: 0 bytes in 0 blocks
==18829==    still reachable: 16,535,737 bytes in 19,198 blocks
==18829==         suppressed: 0 bytes in 0 blocks
==18829== Reachable blocks (those to which a pointer was found) are not shown.
==18829== To see them, rerun with: --leak-check=full --show-reachable=yes
==18829== 
==18829== For counts of detected and suppressed errors, rerun with: -v
==18829== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 10 from 6)

Core dump (gdb)
---------------

$ gdb /usr/local/bin/php  /home/alurin/temp/php/cores/core-php.19181
GNU gdb (Ubuntu/Linaro 7.3-0ubuntu2) 7.3-2011.08
This GDB was configured as "x86_64-linux-gnu".
Reading symbols from /usr/local/bin/php...done.
[New LWP 19181]

warning: Can't read pathname for load map: Ошибка
ввода/вывода.
[Thread debugging using libthread_db enabled]
Core was generated by `php www/index.php'.
Program terminated with signal 11, Segmentation fault.
#0  0x00000000007622e9 in zend_mm_remove_from_free_list (heap=0x298d2e0, mm_block=0x7f3a2281ff30) at
/home/alurin/temp/php/php-src-5.4/Zend/zend_alloc.c:811
811				while (*(cp = &(prev->child[prev->child[1] != NULL])) != NULL) {
(gdb) bt
#0  0x00000000007622e9 in zend_mm_remove_from_free_list (heap=0x298d2e0, mm_block=0x7f3a2281ff30) at
/home/alurin/temp/php/php-src-5.4/Zend/zend_alloc.c:811
#1  0x00000000007624fe in _zend_mm_free_int (heap=0x298d2e0, p=0x7f3a2281ffe0) at
/home/alurin/temp/php/php-src-5.4/Zend/zend_alloc.c:2106
#2  0x000000000079693e in zend_hash_destroy (ht=0x7f3a2281fad8) at
/home/alurin/temp/php/php-src-5.4/Zend/zend_hash.c:565
#3  0x000000000077f0f6 in destroy_zend_class (pce=<optimized out>) at
/home/alurin/temp/php/php-src-5.4/Zend/zend_opcode.c:293
#4  0x000000000079530c in zend_hash_apply_deleter (ht=0x298dc40, p=0x2bc1550) at
/home/alurin/temp/php/php-src-5.4/Zend/zend_hash.c:650
#5  0x0000000000796e21 in zend_hash_reverse_apply (ht=0x298dc40, apply_func=0x779e90
<clean_non_persistent_class>) at /home/alurin/temp/php/php-src-5.4/Zend/zend_hash.c:804
#6  0x000000000077a5d6 in shutdown_executor () at
/home/alurin/temp/php/php-src-5.4/Zend/zend_execute_API.c:305
#7  0x0000000000788f65 in zend_deactivate () at /home/alurin/temp/php/php-src-5.4/Zend/zend.c:934
#8  0x000000000072939f in php_request_shutdown (dummy=<optimized out>) at
/home/alurin/temp/php/php-src-5.4/main/main.c:1782
#9  0x0000000000831054 in do_cli (argc=2, argv=0x7fff793746b8) at
/home/alurin/temp/php/php-src-5.4/sapi/cli/php_cli.c:1169
#10 0x0000000000431a53 in main (argc=2, argv=0x7fff793746b8) at
/home/alurin/temp/php/php-src-5.4/sapi/cli/php_cli.c:1356


------------------------------------------------------------------------



-- 
Edit this bug report at https://bugs.php.net/bug.php?id=60837&edit=1

Thread (21 messages)

« previous php.bugs (#166710) next »