Bug #68583 [NEW]: Crash in timeout thread

From: ab Operating system: Windows PHP version: Irrelevant Package: Scripting Engine problem Bug Type: Bug Bug description:Crash in timeout thread Description: ------------ php-cgi.exe (5.6.0 x86) crashes with the exit value: INVALID_POINTER_READ 0xc0000005 Primarily this is on Win7sp1x64, primarily from Chinese locale, also Japanese (2 byte unicode charsets) and Russian. Only ~1% of hits are for English locale. It has 3 threads running: It appears to crash in zend_fetch_dimension_address_read(), around line zend_execute_api.c:1306. Maybe it’s the line: ZVAL_COPY_VALUE(&tmp, dim); That seems like a strange place for a crash. Let me know what you think :) and I can try to find the correct information. 020afd98 6c8a485f user32+0xb891 020afdd0 6d32f2e9 php5!timeout_thread_proc+0x9f [c:\php-sdk\php56\vc11\x86\php-5.6.0\zend\zend_execute_api.c @ 1306] 020afe08 6d32f2cd msvcr110+0x2f2e9 020afe14 75148543 msvcr110+0x2f2cd 020afe20 776dac69 kernel32+0x28543 020afe64 776dac3c ntdll+0x5ac69 020afe7c 00000000 ntdll+0x5ac3c And the other 2 threads 00a3ce3c 751856c0 ntdll+0x41318 00a3ceb0 7518586a kernel32+0x656c0 00a3cec4 75157828 kernel32+0x6586a 00a3ced0 771807c4 kernel32+0x37828 00a3cf6c 776fc11c KERNELBASE+0x907c4 00a3fc1c 776dac3c ntdll+0x7c11c 00a3fc34 00000000 ntdll+0x5ac3c 02fafe7c 75148543 ntdll+0x42828 02fafe88 776dac69 kernel32+0x28543 02fafecc 776dac3c ntdll+0x5ac69 02fafee4 00000000 ntdll+0x5ac3c This crash is being reported for PHP-5.6 on win7 x86 and x64, but the same code causing it is present also in earlier PHP versions. The code with the custom thread for timeout handling seems to descend from the even pre XP era and should be replaced with something more modern. Expected result: ---------------- no crash Actual result: -------------- crash -- Edit bug report at https://bugs.php.net/bug.php?id=68583&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68583&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68583&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68583&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68583&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68583&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68583&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68583&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68583&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68583&r=support Expected behavior: https://bugs.php.net/fix.php?id=68583&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68583&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68583&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68583&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68583&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68583&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68583&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68583&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68583&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68583&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68583&r=mysqlcfg