Edit report at https://bugs.php.net/bug.php?id=66675&edit=1
ID: 66675
Updated by: php-bugs@lists.php.net
Reported by: phpreq at byom dot de
Summary: sometimes segfault while processing .js as .php
-Status: Feedback
+Status: No Feedback
Type: Bug
Package: *General Issues
Operating System: Debian 7.2 x64
PHP Version: 5.5.9
Private report: N
New Comment:
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
Previous Comments:
------------------------------------------------------------------------
[2014-10-02 23:28:07] michael at alphageek dot com dot au
I have also experienced this. Here's my backtrace:
#0 0x00007f034cd0996d in zend_stack_push (stack=stack@entry=0x7f034d4cfca0
<compiler_globals+608>, element=element@entry=0x7f034d4cfc78 <compiler_globals+568>,
size=size@entry=40) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_stack.c:42
No locals.
#1 0x00007f034ccd530e in compile_file (file_handle=file_handle@entry=0x7fff94794c10, type=2) at
Zend/zend_language_scanner.l:586
original_lex_state = {yy_leng = 0, yy_start = 0x0, yy_text = 0x0, yy_cursor = 0x0, yy_marker
= 0x0, yy_limit = 0x0, yy_state = 0, state_stack = {top = 0, max = 0, elements = 0x0},
heredoc_label_stack = {top = 0, max = 0,
elements = 0x0, top_element = 0x0, persistent = 0 '\000'}, in = 0x0, lineno =
0, filename = 0x0, script_org = 0x0, script_org_size = 0, script_filtered = 0x0,
script_filtered_size = 0, input_filter = 0x0,
output_filter = 0x0, script_encoding = 0x0}
op_array = 0x7f0350d40040
original_active_op_array = 0x0
retval = 0x7f0350d40040
compiler_result = <optimized out>
compilation_successful = 0 '\000'
retval_znode = {op_type = 1, u = {op = {constant = 1, var = 1, num = 1, hash = 1, opline_num
= 1, jmp_addr = 0x1, zv = 0x1, literal = 0x1, ptr = 0x1}, constant = {value = {lval = 1, dval =
4.9406564584124654e-324, str = {
val = 0x1 <error: Cannot access memory at address 0x1>, len = 1355599370},
ht = 0x1, obj = {handle = 1, handlers = 0x7f0350ccce0a}}, refcount__gc = 1, type = 1
'\001', is_ref__gc = 0 '\000'}, op_array = 0x1},
EA = 1352782496}
original_in_compilation = 0 '\000'
#2 0x00007f034ccfaaea in dtrace_compile_file (file_handle=0x7fff94794c10, type=<optimized
out>) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_dtrace.c:40
res = 0x7f0350d41218
#3 0x00007f034cb83cb4 in phar_compile_file (file_handle=<optimized out>, type=<optimized
out>) at /build/buildd/php5-5.5.9+dfsg/ext/phar/phar.c:3383
__orig_bailout = 0x7fff94794c90
__bailout = {{__jmpbuf = {139652217134240, 1560366938000916389, 140735684365136,
140735684365328, 139652158519872, 0, -1560319682279440475, -1467874381389299803}, __mask_was_saved =
0, __saved_mask = {__val = {139652217126952,
0, 0, 139652217132542, 139652217128344, 139652217127072, 9, 139652217128728,
139652209727463, 139652219264008, 206158430232, 140735684365152, 140735684364960, 139652217228296,
140735684365056, 80}}}}
res = <optimized out>
name = 0x0
failed = 0
phar = 0x7f0350cb4028
#4 0x00007f034cd0c56f in zend_execute_scripts (type=type@entry=2, retval=retval@entry=0x0,
file_count=file_count@entry=1) at /build/buildd/php5-5.5.9+dfsg/Zend/zend.c:1308
files = {{gp_offset = 32, fp_offset = 32515, overflow_arg_area = 0x7fff94794be0,
reg_save_area = 0x7fff94794b70}}
i = 0
file_handle = 0x7fff94794c10
orig_op_array = 0x0
orig_retval_ptr_ptr = 0x0
orig_interactive = 0
#5 0x00007f034cdbc4ed in php_handler (r=<optimized out>) at
/build/buildd/php5-5.5.9+dfsg/sapi/apache2handler/sapi_apache2.c:669
zfd = {type = ZEND_HANDLE_MAPPED, filename = 0x7f0350cb5ca0
"/var/www/html/site_details_removed/js/stumble.js.php",
opened_path = 0x7f0350d401a8
"/var/www/html/site_details_removed/js/stumble.js.php", handle = {fd = 1356071640, fp =
0x7f0350d402d8, stream = {handle = 0x7f0350d402d8, isatty = 0, mmap = {len = 309,
pos = 0, map = 0x0, buf = 0x7f0350cb8000 <error: Cannot access memory at address
0x7f0350cb8000>, old_handle = 0x0, old_closer = 0x0}, reader = 0x7f034ccc24d0
<_php_stream_read>,
fsizer = 0x7f034cca8cd0 <php_zend_stream_fsizer>, closer = 0x7f034cca8cb0
<php_zend_stream_mmap_closer>}}, free_filename = 0 '\000'}
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {139652217127072, 1560366938000654245, 139652217127072,
139652221501312, 0, 139652217270928, -1560319682222817371, -1467873582333755483}, __mask_was_saved =
0, __saved_mask = {__val = {139652218377176,
139652218107936, 139652217229512, 1, 139652218107936, 139652217229520,
139652217270432, 139652221501312, 0, 139652217270928, 139652164910243, 139652217134314, 2,
139652217229520, 139652217127072, 139652217988304}}}}
ctx = 0x7f0350cbced8
conf = <optimized out>
brigade = 0x7f0350cb6620
bucket = <optimized out>
rv = <optimized out>
parent_req = 0x7f0350cb90a0
#6 0x00007f0350e9b680 in ap_run_handler (r=0x7f0350cb40a0) at config.c:169
pHook = 0x7f0350d864f8
n = 2
rv = 1356075544
#7 0x00007f0350e9bbc9 in ap_invoke_handler (r=r@entry=0x7f0350cb40a0) at config.c:439
handler = <optimized out>
p = <optimized out>
result = <optimized out>
old_handler = 0x7f0350d98828 "application/x-httpd-php"
ignore = <optimized out>
#8 0x00007f0350eb116a in ap_process_async_request (r=0x7f0350cb40a0) at http_request.c:317
access_status = 0
#9 0x00007f0350eb1444 in ap_process_request (r=r@entry=0x7f0350cb40a0) at http_request.c:363
bb = <optimized out>
b = <optimized out>
c = 0x7f0350cd7290
rv = <optimized out>
#10 0x00007f0350eadf02 in ap_process_http_sync_connection (c=0x7f0350cd7290) at http_core.c:190
r = 0x7f0350cb40a0
cs = 0x0
csd = 0x7f0350cd70a0
mpm_state = 1
#11 ap_process_http_connection (c=0x7f0350cd7290) at http_core.c:231
No locals.
#12 0x00007f0350ea4cc0 in ap_run_process_connection (c=0x7f0350cd7290) at connection.c:41
pHook = 0x7f0350d86a40
n = 0
rv = 1356075544
#13 0x00007f0350ea50a8 in ap_process_connection (c=c@entry=0x7f0350cd7290, csd=<optimized
out>) at connection.c:202
rc = <optimized out>
#14 0x00007f034d6dc767 in child_main (child_num_arg=child_num_arg@entry=30) at prefork.c:704
current_conn = 0x7f0350cd7290
csd = 0x7f0350cd70a0
thd = 0x7f0350cd90a0
osthd = 139652218701696
ptrans = 0x7f0350cd7028
allocator = 0x7f035186d4b0
status = <optimized out>
i = <optimized out>
lr = <optimized out>
pollset = 0x7f0350cd9158
sbh = 0x7f0350cd9150
bucket_alloc = 0x7f0350cd3028
last_poll_idx = 0
lockfile = <optimized out>
#15 0x00007f034d6dc9a6 in make_child (s=0x7f0350e0ade0, slot=30) at prefork.c:800
pid = 0
#16 0x00007f034d6dd60e in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:902
i = <optimized out>
idle_count = <optimized out>
ws = <optimized out>
free_length = <optimized out>
free_slots = {28, 30, 34, 35, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52,
53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65}
last_non_dead = <optimized out>
total_non_dead = <optimized out>
#17 prefork_run (_pconf=<optimized out>, plog=<optimized out>, s=<optimized out>)
at prefork.c:1090
status = 0
pid = {pid = -1, in = 0x7f0350ebc048, out = 0xa, err = 0x7f035059aff6}
child_slot = <optimized out>
exitwhy = APR_PROC_EXIT
processed_status = <optimized out>
index = <optimized out>
remaining_children_to_start = 0
rv = <optimized out>
#18 0x00007f0350e8269e in ap_run_mpm (pconf=0x7f0350e32028, plog=0x7f0350e06028, s=0x7f0350e0ade0)
at mpm_common.c:96
pHook = 0x7f0350d86da8
n = 0
rv = 1356075544
#19 0x00007f0350e7be36 in main (argc=3, argv=0x7fff94795318) at main.c:777
c = 0 '\000'
showcompile = 0
showdirectives = 0
confname = 0x7f0350ebb607 "apache2.conf"
def_server_root = 0x7f0350ebb5fa "/etc/apache2"
temp_error_log = 0x0
error = <optimized out>
process = 0x7f0350e3a118
pconf = 0x7f0350e32028
plog = 0x7f0350e06028
ptemp = 0x7f0350e08028
pcommands = 0x7f0350e10028
opt = 0x7f0350e10118
rv = <optimized out>
mod = 0x7f03510dd160 <ap_prelinked_modules+64>
opt_arg = 0x7f0350e3a028 "(\340\343P\003\177"
signal_server = <optimized out>
Additionally, here's the script that is causing the error:
<?php
header('Content-type: text/javascript');
?>
function bfb_doStumbleShare(url)
{
window.open(
'http://www.stumbleupon.com/submit?'+
'url='+url,
'sharer',
'top=' + (screen.height/2 - 160).toString() + ',left=' + (screen.width/2 -
290).toString() + ',toolbar=0,status=0,width=580,height=325'
);
}
------------------------------------------------------------------------
[2014-02-08 20:40:38] phpreq at byom dot de
I am unable to provide a script as a real php-script is not involved here.
Associate .js-files in Apache with php as seen above and download again and again a stock .js-script
of your choice, e.g. jquery.js or jquery-migrate.min.js, but it needs some thousand requests until
the segfault is hit.
I haven't hit a segfault with a script having a .php-file extension, maybe it is something
trivial like a file-extension check fixed to 3 digits or so summing up after some thousand hits...
------------------------------------------------------------------------
[2014-02-08 20:29:57] pajoye@php.net
Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves.
A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external
resources such as databases, etc. If the script requires a
database to demonstrate the issue, please make sure it creates
all necessary tables, stored procedures etc.
Please avoid embedding huge scripts into the report.
------------------------------------------------------------------------
[2014-02-08 20:25:06] phpreq at byom dot de
Description:
------------
Hi,
In my setup (Debian Wheezy 64 Bit, Kernel 3.12, Apache 2.4.7, php 5.5.9, gcc Debian 4.7.2-5)
I let php also parse and execute .js - files as some very few contain php-code to have dynamically
created .js files.
Done with: AddType application/x-httpd-php js
Apache segfaults about 5-6 times a day.
Doing a backtrace shows me that only files that end with .js cause the segfault.
The files are typically stock .js-files from a wordpress 3.8.1 installation. Parsing them by php
shouldn't be a problem, especially as they don't contain any <? ?>. But it seems
there is a problem with the file-buf as seen in gdb's frame 4: error: Cannot access memory at
address 0x100000001.
See the output of gdb:
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f653a6948ef in i_create_execute_data_from_op_array (nested=0 '\000',
op_array=0x7f6540403148)
at /usr/local/src/php-5.5.9/Zend/zend_execute.c:1631
1631 EX(prev_execute_data) = EG(current_execute_data);
(gdb) bt
#0 0x00007f653a6948ef in i_create_execute_data_from_op_array (nested=0 '\000',
op_array=0x7f6540403148)
at /usr/local/src/php-5.5.9/Zend/zend_execute.c:1631
#1 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:388
#2 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:383
#3 0x00007f653a5e7b69 in zend_execute_scripts (type=type@entry=2, retval=0x0,
retval@entry=0x2201a60,
file_count=file_count@entry=1) at /usr/local/src/php-5.5.9/Zend/zend.c:1316
#4 0x00007f653a698105 in php_handler (r=0x21f1770)
at /usr/local/src/php-5.5.9/sapi/apache2handler/sapi_apache2.c:669
#5 0x000000000044ee50 in ap_run_handler (r=0x21f1770) at config.c:170
#6 0x000000000044f42b in ap_invoke_handler (r=r@entry=0x21f1770) at config.c:439
#7 0x000000000046354a in ap_process_async_request (r=0x21f1770) at http_request.c:317
#8 0x00000000004637ff in ap_process_request (r=r@entry=0x21f1770) at http_request.c:363
#9 0x000000000045fe05 in ap_process_http_sync_connection (c=0x21e18e0) at http_core.c:190
#10 ap_process_http_connection (c=0x21e18e0) at http_core.c:231
#11 0x0000000000458460 in ap_run_process_connection (c=0x21e18e0) at connection.c:41
#12 0x0000000000458860 in ap_process_connection (c=c@entry=0x21e18e0, csd=<optimized out>) at
connection.c:202
#13 0x000000000046986b in child_main (child_num_arg=child_num_arg@entry=2) at prefork.c:704
#14 0x0000000000469a77 in make_child (s=0x1eaf538, slot=2) at prefork.c:800
#15 0x000000000046a842 in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:902
#16 prefork_run (_pconf=<optimized out>, plog=<optimized out>, s=<optimized out>)
at prefork.c:1090
#17 0x0000000000435a0e in ap_run_mpm (pconf=0x1e86138, plog=0x1eb3378, s=0x1eaf538) at
mpm_common.c:98
#18 0x000000000042f12b in main (argc=3, argv=0x7fff5542e328) at main.c:777
(gdb) bt full
#0 0x00007f653a6948ef in i_create_execute_data_from_op_array (nested=0 '\000',
op_array=0x7f6540403148)
at /usr/local/src/php-5.5.9/Zend/zend_execute.c:1631
execute_data = 0x0
CVs_size = 0
Ts_size = <optimized out>
stack_size = <optimized out>
total_size = <optimized out>
call_slots_size = <optimized out>
#1 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:388
No locals.
#2 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:383
No locals.
#3 0x00007f653a5e7b69 in zend_execute_scripts (type=type@entry=2, retval=0x0,
retval@entry=0x2201a60,
file_count=file_count@entry=1) at /usr/local/src/php-5.5.9/Zend/zend.c:1316
files = {{gp_offset = 32, fp_offset = 28, overflow_arg_area = 0x7fff5542dba0,
reg_save_area = 0x7fff5542db30}}
i = <optimized out>
file_handle = 0x7fff5542dc00
orig_op_array = 0x0
orig_retval_ptr_ptr = 0x0
orig_interactive = 0
#4 0x00007f653a698105 in php_handler (r=0x21f1770)
at /usr/local/src/php-5.5.9/sapi/apache2handler/sapi_apache2.c:669
zfd = {type = ZEND_HANDLE_FILENAME,
filename = 0x21f2ef0 "/home/www/htdocs/wp-includes/js/jquery/jquery.js",
opened_path = 0x0, handle = {fd = 1067612014, fp = 0x7f653fa2776e
<apr_table_unset+158>, stream = {
handle = 0x7f653fa2776e <apr_table_unset+158>, isatty = 35598064, mmap = {len =
36590244,
pos = 35591928, map = 0x6440073f370,
buf = 0x100000001 <error: Cannot access memory at address 0x100000001>,
old_handle = 0x1,
old_closer = 0x7180567}, reader = 0x902, fsizer = 0x1, closer = 0x21e18e0}},
free_filename = 0 '\000'}
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {32654544, 6444143732774364179, 35592048, 35526880, 32175416, 0,
-6444483869346667501, -6366886698566065133}, __mask_was_saved = 0, __saved_mask =
{__val = {
32257640, 32563064, 35799832, 1, 32563064, 35799840, 0, 35526880, 32175416, 0,
140072810773443, 0,
0, 0, 0, 0}}}}
ctx = 0x21e9c48
conf = 0x1ee6160
brigade = 0x0
bucket = <optimized out>
rv = <optimized out>
parent_req = 0x2201a60
#5 0x000000000044ee50 in ap_run_handler (r=0x21f1770) at config.c:170
pHook = 0x1f244d0
n = 4
rv = 0
#6 0x000000000044f42b in ap_invoke_handler (r=r@entry=0x21f1770) at config.c:439
handler = <optimized out>
p = <optimized out>
result = <optimized out>
old_handler = 0x0
ignore = <optimized out>
#7 0x000000000046354a in ap_process_async_request (r=0x21f1770) at http_request.c:317
c = 0x21e18e0
access_status = 0
#8 0x00000000004637ff in ap_process_request (r=r@entry=0x21f1770) at http_request.c:363
bb = <optimized out>
b = <optimized out>
c = 0x21e18e0
rv = <optimized out>
#9 0x000000000045fe05 in ap_process_http_sync_connection (c=0x21e18e0) at http_core.c:190
r = 0x21f1770
cs = 0x0
csd = 0x21e16f0
mpm_state = 1
#10 ap_process_http_connection (c=0x21e18e0) at http_core.c:231
No locals.
#11 0x0000000000458460 in ap_run_process_connection (c=0x21e18e0) at connection.c:41
pHook = 0x1f2eaa0
n = 1
rv = 0
#12 0x0000000000458860 in ap_process_connection (c=c@entry=0x21e18e0, csd=<optimized out>) at
connection.c:202
rc = <optimized out>
#13 0x000000000046986b in child_main (child_num_arg=child_num_arg@entry=2) at prefork.c:704
current_conn = 0x21e18e0
csd = 0x21e16f0
thd = 0x20aff70
osthd = 140072847148864
ptrans = 0x21e1678
allocator = 0x20afb70
status = <optimized out>
i = <optimized out>
lr = <optimized out>
pollset = 0x20b0050
sbh = 0x20b0048
bucket_alloc = 0x21e5698
last_poll_idx = 1
lockfile = <optimized out>
#14 0x0000000000469a77 in make_child (s=0x1eaf538, slot=2) at prefork.c:800
pid = 0
#15 0x000000000046a842 in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:902
i = <optimized out>
idle_count = <optimized out>
ws = <optimized out>
free_length = <optimized out>
free_slots = {2, 7, 12, 14, 28, 29, 30, 31, 32, 33, 34, 35, 36, 38, 39, 40, 57, 58, 59, 60,
61, 62, 63, 64,
65, 66, 67, 68, 69, 70, 71, 72}
last_non_dead = <optimized out>
total_non_dead = <optimized out>
#16 prefork_run (_pconf=<optimized out>, plog=<optimized out>, s=<optimized out>)
at prefork.c:1090
status = 0
pid = {pid = -1, in = 0x7f653aaf582d, out = 0x7f653efa8e60, err = 0x20}
child_slot = <optimized out>
exitwhy = APR_PROC_EXIT
processed_status = <optimized out>
index = <optimized out>
remaining_children_to_start = 0
rv = <optimized out>
#17 0x0000000000435a0e in ap_run_mpm (pconf=0x1e86138, plog=0x1eb3378, s=0x1eaf538) at
mpm_common.c:98
pHook = 0x1f2ebc8
n = 0
rv = 0
#18 0x000000000042f12b in main (argc=3, argv=0x7fff5542e328) at main.c:777
c = 0 '\000'
showcompile = 0
showdirectives = 0
confname = 0x46c1f0 "/usr/local/apache/conf/httpd.conf"
def_server_root = 0x46b8f8 "/usr/local/apache/2.4.7"
temp_error_log = <optimized out>
error = <optimized out>
process = 0x1e84218
pconf = 0x1e86138
plog = 0x1eb3378
ptemp = 0x1eb1348
pcommands = 0x1ea8248
opt = 0x1ea8338
rv = <optimized out>
mod = 0x689ac0 <ap_prelinked_modules+32>
opt_arg = 0x1e84128 "\b\001\350\001"
signal_server = <optimized out>
(gdb) frame 1
#1 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:388
388 zend_execute_ex(i_create_execute_data_from_op_array(op_array, 0 TSRMLS_CC)
TSRMLS_CC);
(gdb)
(gdb) frame 4
#4 0x00007f653a698105 in php_handler (r=0x2376c90)
at /usr/local/src/php-5.5.9/sapi/apache2handler/sapi_apache2.c:669
669 zend_execute_scripts(ZEND_INCLUDE TSRMLS_CC, NULL, 1, &zfd);
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=66675&edit=1