Bug #64896 [Com]: Segfault with gc_collect_cycles using unserialize on certain objects

From: Date: Wed, 18 Dec 2013 09:59:29 +0000
Subject: Bug #64896 [Com]: Segfault with gc_collect_cycles using unserialize on certain objects
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-183392@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=64896&edit=1

 ID:                 64896
 Comment by:         teppo-dev at sulate dot net
 Reported by:        mark dot chong at acquireap dot com
 Summary:            Segfault with gc_collect_cycles using unserialize on
                     certain objects
 Status:             Assigned
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   ubuntu
 PHP Version:        5.4.15
 Assigned To:        laruence
 Block user comment: N
 Private report:     N

 New Comment:

Just wanted to mention (if it's still not obvious) that this bug has nothing to do with
serialize/unserialize, but only with gc_collect_cycles. (Maybe the bug title should be refined?)

(Creating identical clones "manually" without unserialize triggers the bug the same.)


Previous Comments:
------------------------------------------------------------------------
[2013-11-21 10:28:23] arjen at react dot com

A test was added with reason "We can not fix this bug without a significant (performace slow
down) change to gc" in https://github.com/php/php-src/blob/PHP-5.5/Zend/tests/bug64896.phpt

Just wanted to document this in this relevant issue..

------------------------------------------------------------------------
[2013-08-30 10:10:35] arjen at react dot com

Still crashes 5.4-git, testscript attached.

------------------------------------------------------------------------
[2013-06-11 21:56:47] webm4st0r at gmail dot com

I believe I am hitting a similar issue to this through running some test suites. 
I've not yet been able to get a smaller script to reproduce the problem, though 
the one in this issue does fail to run.

I have tested this on 5.4.16 on 64bit CentOS 6. I would be interested in testing 
a patch for this to determine if it truly is the same problem, as the crash I'm 
seeing in the test run is during php_request_shutdown, sometimes within a 
gc_collect_cycles, sometimes within a destroy_zend_class.

I am unable to reproduce these failures with zend.enable_gc = 0, or in a debug 
build.

I can provide some stack traces for both failures I've seen if that would be 
useful in looking into this.

------------------------------------------------------------------------
[2013-06-05 13:32:34] laruence@php.net

Ha, I can reproduce this with non-debug build now. thanks

------------------------------------------------------------------------
[2013-06-05 11:18:22] arjen at react dot com

I can confirm the segfault using PHP-5.4.15 build from php.net sources.

Backtrace is same as above @ https://gist.github.com/anonymous/5713123
Valgrind trace @ https://gist.github.com/anonymous/5713183

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=64896


-- 
Edit this bug report at https://bugs.php.net/bug.php?id=64896&edit=1


Thread (13 messages)

« previous php.bugs (#183392) next »