Bug #68121 [Fbk->NoF]: ZTS opcache inconsistent memory alloc/free semantics

Edit report at https://bugs.php.net/bug.php?id=68121&edit=1 ID: 68121 Updated by: php-bugs@lists.php.net Reported by: rrh at newrelic dot com Summary: ZTS opcache inconsistent memory alloc/free semantics -Status: Feedback +Status: No Feedback Type: Bug Package: opcache Operating System: linux PHP Version: 5.6.0 Assigned To: dmitry Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2015-04-06 19:57:12] dmitry@php.net I can't reproduce this with GCC 4.9.2. ------------------------------------------------------------------------ [2014-10-15 16:57:40] dmitry@php.net I have no idea, that can be wrong (I'll wait for Fedora release with gcc 4.9) Is it reproducible with valgrind? USE_ZEND_ALLOC=0 valgrind --db-attach=yes php-cgi ... ------------------------------------------------------------------------ [2014-09-30 23:01:27] rrh at newrelic dot com Description: ------------ In php 5.6.0 (that's all I've looked at), the opcache related function accel_new_interned_string does no interning, and returns the argument string if compiled for ZTS. Unfortunately, the related free-like function accel_clean_non_persistent_constant doesn't special case for ZTS, and still appears to free as if the string were created by internment. If you compile php 5.6 in ZTS mode, using a modern gcc (such as 4.9.1) which supports -fsanitize=address (aka "asan"), and then run in cgi mode, you'll see that the asan runtime system reports an illegal free stemming from the call to accell_clean_non_persistent_constant Here's a gdb backtrace:#0 0x00007f909ae21bb9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007f909ae24fc8 in __GI_abort () at abort.c:89 #2 0x00007f909ae5ee14 in __libc_message (do_abort=do_abort@entry=1, fmt=fmt@entry=0x7f909af6d668 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007f909ae69b77 in malloc_printerr (action=<optimized out>, str=0x7f909af6d9e8 "munmap_chunk(): invalid pointer", ptr=<optimized out>) at malloc.c:4996 #4 0x00007f909453be00 in accel_clean_non_persistent_constant (c=0x604000048850, tsrm_ls=0x60300000efb0) at /opt/nr/lamp/build/php-5.6.0-zts/ext/opcache/ZendAccelerator.c:2327 #5 0x00007f909eebe633 in zend_hash_reverse_apply (ht=0x607000054bf0, apply_func=0x7f909453bdcb <accel_clean_non_persistent_constant>, tsrm_ls=0x60300000efb0) at /opt/nr/lamp/build/php-5.6.0-zts/Zend/zend_hash.c:729 #6 0x00007f909453c2d2 in zend_accel_fast_shutdown (tsrm_ls=0x60300000efb0) at /opt/nr/lamp/build/php-5.6.0-zts/ext/opcache/ZendAccelerator.c:2360 #7 0x00007f909453c3fc in accel_deactivate () at /opt/nr/lamp/build/php-5.6.0-zts/ext/opcache/ZendAccelerator.c:2385 #8 0x00007f909ee322b3 in zend_extension_deactivator (extension=0x611000073550, tsrm_ls=0x60300000efb0) at /opt/nr/lamp/build/php-5.6.0-zts/Zend/zend_execute_API.c:101 #9 0x00007f909ee4bbc0 in zend_llist_apply (l=0x7f90a0ec4b20 <zend_extensions>, func=0x7f909ee32267 <zend_extension_deactivator>, tsrm_ls=0x60300000efb0) at /opt/nr/lamp/build/php-5.6.0-zts/Zend/zend_llist.c:191 #10 0x00007f909ee3468f in shutdown_executor (tsrm_ls=0x60300000efb0) at /opt/nr/lamp/build/php-5.6.0-zts/Zend/zend_execute_API.c:246 #11 0x00007f909ee7d4ec in zend_deactivate (tsrm_ls=0x60300000efb0) at /opt/nr/lamp/build/php-5.6.0-zts/Zend/zend.c:949 #12 0x00007f909ec65e65 in php_request_shutdown (dummy=0x0) at /opt/nr/lamp/build/php-5.6.0-zts/main/main.c:1884 #13 0x00007f909f2504a5 in main (argc=5, argv=0x7fff9fe0bdc8) at /opt/nr/lamp/build/php-5.6.0-zts/sapi/cgi/cgi_main.c:2508 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68121&edit=1