Edit report at https://bugs.php.net/bug.php?id=69816&edit=1
ID: 69816
Updated by: laruence@php.net
Reported by: filip at prochazka dot su
Summary: SIGSEGV in zend_hash_index_find_bucket
Status: Open
Type: Bug
Package: Reproducible crash
Operating System: Linux
PHP Version: 7.0.0alpha1
Block user comment: N
Private report: N
New Comment:
I can only see the adroit is wrong...
it's better you can have a reproducible script...otherwise... I can not do much thing here..(or
maybe grant me a ssh access :))
Previous Comments:
------------------------------------------------------------------------
[2015-06-13 00:51:28] filip at prochazka dot su
(gdb) bt full
#0 0x0000000000ae3517 in zend_hash_index_find_bucket (ht=0x7f2e1b7066c0, h=0) at
/opt/php-7.0.0alpha1/Zend/zend_hash.c:464
nIndex = 0
idx = 11421359
p = 0x7f2e1b7066c0
arData = 0x1e
__PRETTY_FUNCTION__ = "zend_hash_index_find_bucket"
#1 0x0000000000ae7a18 in zend_hash_index_exists (ht=0x7f2e1b7066c0, h=0) at
/opt/php-7.0.0alpha1/Zend/zend_hash.c:1935
p = 0x7f2e1c218a80
#2 0x00000000008f8c91 in zif_array_key_exists (execute_data=0x7f2e1c218a20,
return_value=0x7f2e1c2185f0) at /opt/php-7.0.0alpha1/ext/standard/array.c:5009
key = 0x7f2e1c218a80
array = 0x7f2e1b7066c0
__PRETTY_FUNCTION__ = "zif_array_key_exists"
#3 0x0000000000b2a747 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:692
call = 0x7f2e1c218a20
fbc = 0x2416100
ret = 0x7f2e1c2185f0
__PRETTY_FUNCTION__ = "ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER"
#4 0x0000000000b29bab in execute_ex (ex=0x7f2e1c216010) at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:394
ret = 0
orig_opline = 0x7f2e1b281ec0
orig_execute_data = 0x7f2e1c215d80
#5 0x0000000000ab8c79 in zend_call_function (fci=0x7fff346aff60, fci_cache=0x7fff346aff30) at
/opt/php-7.0.0alpha1/Zend/zend_execute_API.c:841
call_via_handler = 0
i = 1
calling_scope = 0x7f2e1b2d6840
call = 0x7f2e1c216010
dummy_execute_data = {opline = 0x7f2e1b4cc008, call = 0x7fff346aff70, return_value =
0x7f2e1c215ff0, func = 0x7f2e1b35f000, This = {value = {lval = 140734072815264, dval =
6,9531870577342426e-310, counted = 0x7fff346afea0,
str = 0x7fff346afea0, arr = 0x7fff346afea0, obj = 0x7fff346afea0, res =
0x7fff346afea0, ref = 0x7fff346afea0, ast = 0x7fff346afea0, zv = 0x7fff346afea0, ptr =
0x7fff346afea0, ce = 0x7fff346afea0, func = 0x7fff346afea0, ww = {
w1 = 879427232, w2 = 32767}}, u1 = {v = {type = 176 '\260', type_flags = 7
'\a', const_flags = 66 'B', reserved = 27 '\033'}, type_info =
457312176}, u2 = {var_flags = 32558, next = 32558, cache_slot = 32558, lineno = 32558,
num_args = 32558, fe_pos = 32558, fe_iter_idx = 32558}}, run_time_cache =
0x7f2e1b4cc008, literals = 0x7f2e1b373f88, called_scope = 0x7fff346afea0, prev_execute_data =
0xadef63 <zend_fcall_info_args+37>,
symbol_table = 0x7f2e1c216000}
fci_cache_local = {initialized = 32 ' ', function_handler = 0x40a00000000,
calling_scope = 0x7f2e1b4207c0, called_scope = 0x7f2e1b4cc028, object = 0x7f2e1b4cc028}
func = 0x7f2e1c20faa0
orig_scope = 0x7f2e1b3f0628
__PRETTY_FUNCTION__ = "zend_call_function"
#6 0x00000000008fe9a8 in zif_call_user_func_array (execute_data=0x7f2e1c215f90,
return_value=0x7f2e1c215e90) at /opt/php-7.0.0alpha1/ext/standard/basic_functions.c:4805
params = 0x7f2e1c216000
retval = {value = {lval = 0, dval = 0, counted = 0x0, str = 0x0, arr = 0x0, obj = 0x0, res =
0x0, ref = 0x0, ast = 0x0, zv = 0x0, ptr = 0x0, ce = 0x0, func = 0x0, ww = {w1 = 0, w2 = 0}}, u1 =
{v = {type = 0 '\000',
type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0
'\000'}, type_info = 0}, u2 = {var_flags = 32558, next = 32558, cache_slot = 32558, lineno
= 32558, num_args = 32558, fe_pos = 32558, fe_iter_idx = 32558}}
fci = {size = 72, function_table = 0x7f2e1b2d6880, function_name = {value = {lval =
139836001742848, dval = 6,9088164512937874e-310, counted = 0x7f2e1b35f000, str = 0x7f2e1b35f000, arr
= 0x7f2e1b35f000, obj = 0x7f2e1b35f000,
res = 0x7f2e1b35f000, ref = 0x7f2e1b35f000, ast = 0x7f2e1b35f000, zv = 0x7f2e1b35f000,
ptr = 0x7f2e1b35f000, ce = 0x7f2e1b35f000, func = 0x7f2e1b35f000, ww = {w1 = 456519680, w2 =
32558}}, u1 = {v = {type = 7 '\a',
type_flags = 28 '\034', const_flags = 0 '\000', reserved = 0
'\000'}, type_info = 7175}, u2 = {var_flags = 32767, next = 32767, cache_slot = 32767,
lineno = 32767, num_args = 32767, fe_pos = 32767, fe_iter_idx = 32767}},
symbol_table = 0x0, retval = 0x7fff346aff20, params = 0x7f2e1b4207b0, object =
0x7f2e1c266240, no_separation = 1 '\001', param_count = 1}
fci_cache = {initialized = 1 '\001', function_handler = 0x7f2e1c20faa0,
calling_scope = 0x7f2e1b2d6840, called_scope = 0x7f2e1b2d6840, object = 0x7f2e1c266240}
__PRETTY_FUNCTION__ = "zif_call_user_func_array"
#7 0x0000000000b2a747 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:692
call = 0x7f2e1c215f90
fbc = 0x23b8720
ret = 0x7f2e1c215e90
__PRETTY_FUNCTION__ = "ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER"
#8 0x0000000000b29bab in execute_ex (ex=0x7f2e1c215030) at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:394
ret = 0
orig_opline = 0x0
orig_execute_data = 0x0
#9 0x0000000000b29cbe in zend_execute (op_array=0x7f2e1c273000, return_value=0x0) at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:434
execute_data = 0x7f2e1c215030
#10 0x0000000000ad0a73 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/opt/php-7.0.0alpha1/Zend/zend.c:1389
files = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff346b01f0, reg_save_area
= 0x7fff346b0130}}
i = 1
file_handle = 0x7fff346b2520
op_array = 0x7f2e1c273000
#11 0x0000000000a3df50 in php_execute_script (primary_file=0x7fff346b2520) at
/opt/php-7.0.0alpha1/main/main.c:2475
realfile = "a\356\224\313\000\200\377\377\320\024k4\377\177\000\000\003",
'\000' <repeats 31 times>,
"\220gT\002\000\000\000\000\006\024\000\000\000\000\000\000\220u\202\r\000\000\000\000/\025d\037.\177\000\000\000\000\001\000\002\000\023\000+\000k4\377\177\000\000P\032k4\377\177",
'\000' <repeats 34 times>,
"\234\216\214'.\177\000\000\377\377\377\377\377\377\377\377\220u\202\r\000\000\000\000\034\000\000\000\000\000\000\000D\000\000\000\000\000\000\000xz\251'.\177\000\000\026\230\214'.\177\000\000\002\000\000\000\000\000\000\000\000"...
__orig_bailout = 0x7fff346b2590
__bailout = {{__jmpbuf = {16, 8727222397168074030, 4497440, 140734072835232, 0, 0,
8727222398067752238, -8727066670248674002}, __mask_was_saved = 0, __saved_mask = {__val =
{140734072821232, 193291732856, 18206501, 140734072824576,
11074847, 18446744069414584319, 8589934592, 8589934592, 0, 0, 140734072824416, 128,
140734072820816, 140734072820816, 140734072821216, 140734072821216}}}}
prepend_file_p = 0x0
append_file_p = 0x0
prepend_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len
= 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0,
closer = 0x0}}, filename = 0x0,
opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
append_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len =
0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0,
closer = 0x0}}, filename = 0x0,
opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
old_cwd = 0x7fff346b01f0 "/"
use_heap = 0 '\000'
retval = 0
#12 0x0000000000ba03b3 in main (argc=3, argv=0x7fff346b4ca8) at
/opt/php-7.0.0alpha1/sapi/fpm/fpm/fpm_main.c:1940
primary_script = 0x7f2e1c203500 "/var/www/hosts/rohlik.l/index.php"
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {0, 8727222400552877358, 4497440, 140734072835232, 0, 0,
8727222397170171182, -8727066585289507538}, __mask_was_saved = 0, __saved_mask = {__val = {0
<repeats 16 times>}}}}
exit_status = 0
cgi = 0
c = -1
use_extended_info = 0
file_handle = {handle = {fd = 472237312, fp = 0x7f2e1c25c500, stream = {handle =
0x7f2e1c25c500, isatty = 0, mmap = {len = 528, pos = 0, map = 0x0, buf = 0x7f2e27ac7000 <error:
Cannot access memory at address 0x7f2e27ac7000>,
old_handle = 0x0, old_closer = 0x0}, reader = 0xa5bde4 <_php_stream_read>,
fsizer = 0xa3b7f6 <php_zend_stream_fsizer>, closer = 0xa3b7d0
<php_zend_stream_mmap_closer>}},
filename = 0x7f2e1c203000 "/var/www/hosts/rohlik.l/index.php", opened_path =
0x0, type = ZEND_HANDLE_MAPPED, free_filename = 0 '\000'}
orig_optind = 1
orig_optarg = 0x0
ini_entries_len = 0
max_requests = 500
requests = 1
fcgi_fd = 0
request = {listen_socket = 0, tcp = 0, fd = 3, id = 1, keep = 0, closed = 0, in_len = 0,
in_pad = 0, out_hdr = 0x0, out_pos = 0x0,
out_buf = "h'k4\377\177\000\000\001\006\000\001\001T\004\000\\n\";\n\t\tfor
(var i = 0, scripts = debug.getElementsByTagName('script'); i < scripts.length; i++)
{\n\t\t\t(window.execScript || function(data) {\n\t\t\t\twindow['eval'].call(window,
data);\n\t\t\t})"..., reserved = "Sheets.l\000\000\000\000\000\000\000", hook =
{on_accept = 0xba2d3e <fpm_request_accepting>, on_read = 0xba2dff
<fpm_request_reading_headers>, on_close = 0xba339c <fpm_request_finished>},
has_env = 12124692, env = {hash_table = {0x1, 0x0, 0x2548f00, 0x0, 0x0, 0x0, 0x0, 0x0,
0x25490b0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2549290, 0x0, 0x0, 0x0, 0x2548ff0, 0x0, 0x0, 0x0,
0x25492c0, 0x0, 0x0, 0x0, 0x2549380, 0x0, 0x0,
0x0, 0x0, 0x0, 0x2549080, 0x0, 0x2549020, 0x2549050, 0x0 <repeats 18 times>,
0x2549170, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2548fc0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2549260, 0x0,
0x2549200, 0x0, 0x25492f0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x2549230, 0x2549440, 0x0, 0x0, 0x25491d0, 0x0, 0x0, 0x0, 0x0, 0x2549470, 0x0, 0x0,
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2548f60, 0x0, 0x2549410, 0x0, 0x0, 0x0, 0x0, 0x25490e0, 0x0,
0x25491a0, 0x0, 0x0, 0x0, 0x25494a0, 0x2548f90,
0x0, 0x2549350, 0x0, 0x0, 0x0, 0x0, 0x2549320, 0x25493e0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0}, list = 0x25493b0, buckets = 0x25494a0, data = 0x2548ef0}}
fpm_config = 0x7fff346b4f6f ""
fpm_prefix = 0x0
fpm_pid = 0x0
test_conf = 0
force_daemon = -1
force_stderr = 0
php_information = 0
php_allow_to_run_as_root = 0
__func__ = "main"
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=69816
--
Edit this bug report at https://bugs.php.net/bug.php?id=69816&edit=1