Bug #69816 [Com]: SIGSEGV in zend_hash_index_find_bucket

Edit report at https://bugs.php.net/bug.php?id=69816&edit=1 ID: 69816 Comment by: filip at prochazka dot su Reported by: filip at prochazka dot su Summary: SIGSEGV in zend_hash_index_find_bucket Status: Assigned Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: 7.0.0alpha1 Assigned To: laruence Block user comment: N Private report: N New Comment: I've encountered this problem on localhost and the software is proprietary. I'll try more to isolate it, but it's dying on me at very deep point of application in a getter. I'm not sure how to isolate that... Previous Comments: ------------------------------------------------------------------------ [2015-06-13 13:28:39] laruence@php.net I can only see the adroit is wrong... it's better you can have a reproducible script...otherwise... I can not do much thing here..(or maybe grant me a ssh access :)) ------------------------------------------------------------------------ [2015-06-13 00:51:28] filip at prochazka dot su (gdb) bt full #0 0x0000000000ae3517 in zend_hash_index_find_bucket (ht=0x7f2e1b7066c0, h=0) at /opt/php-7.0.0alpha1/Zend/zend_hash.c:464 nIndex = 0 idx = 11421359 p = 0x7f2e1b7066c0 arData = 0x1e __PRETTY_FUNCTION__ = "zend_hash_index_find_bucket" #1 0x0000000000ae7a18 in zend_hash_index_exists (ht=0x7f2e1b7066c0, h=0) at /opt/php-7.0.0alpha1/Zend/zend_hash.c:1935 p = 0x7f2e1c218a80 #2 0x00000000008f8c91 in zif_array_key_exists (execute_data=0x7f2e1c218a20, return_value=0x7f2e1c2185f0) at /opt/php-7.0.0alpha1/ext/standard/array.c:5009 key = 0x7f2e1c218a80 array = 0x7f2e1b7066c0 __PRETTY_FUNCTION__ = "zif_array_key_exists" #3 0x0000000000b2a747 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at /opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:692 call = 0x7f2e1c218a20 fbc = 0x2416100 ret = 0x7f2e1c2185f0 __PRETTY_FUNCTION__ = "ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER" #4 0x0000000000b29bab in execute_ex (ex=0x7f2e1c216010) at /opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:394 ret = 0 orig_opline = 0x7f2e1b281ec0 orig_execute_data = 0x7f2e1c215d80 #5 0x0000000000ab8c79 in zend_call_function (fci=0x7fff346aff60, fci_cache=0x7fff346aff30) at /opt/php-7.0.0alpha1/Zend/zend_execute_API.c:841 call_via_handler = 0 i = 1 calling_scope = 0x7f2e1b2d6840 call = 0x7f2e1c216010 dummy_execute_data = {opline = 0x7f2e1b4cc008, call = 0x7fff346aff70, return_value = 0x7f2e1c215ff0, func = 0x7f2e1b35f000, This = {value = {lval = 140734072815264, dval = 6,9531870577342426e-310, counted = 0x7fff346afea0, str = 0x7fff346afea0, arr = 0x7fff346afea0, obj = 0x7fff346afea0, res = 0x7fff346afea0, ref = 0x7fff346afea0, ast = 0x7fff346afea0, zv = 0x7fff346afea0, ptr = 0x7fff346afea0, ce = 0x7fff346afea0, func = 0x7fff346afea0, ww = { w1 = 879427232, w2 = 32767}}, u1 = {v = {type = 176 '\260', type_flags = 7 '\a', const_flags = 66 'B', reserved = 27 '\033'}, type_info = 457312176}, u2 = {var_flags = 32558, next = 32558, cache_slot = 32558, lineno = 32558, num_args = 32558, fe_pos = 32558, fe_iter_idx = 32558}}, run_time_cache = 0x7f2e1b4cc008, literals = 0x7f2e1b373f88, called_scope = 0x7fff346afea0, prev_execute_data = 0xadef63 <zend_fcall_info_args+37>, symbol_table = 0x7f2e1c216000} fci_cache_local = {initialized = 32 ' ', function_handler = 0x40a00000000, calling_scope = 0x7f2e1b4207c0, called_scope = 0x7f2e1b4cc028, object = 0x7f2e1b4cc028} func = 0x7f2e1c20faa0 orig_scope = 0x7f2e1b3f0628 __PRETTY_FUNCTION__ = "zend_call_function" #6 0x00000000008fe9a8 in zif_call_user_func_array (execute_data=0x7f2e1c215f90, return_value=0x7f2e1c215e90) at /opt/php-7.0.0alpha1/ext/standard/basic_functions.c:4805 params = 0x7f2e1c216000 retval = {value = {lval = 0, dval = 0, counted = 0x0, str = 0x0, arr = 0x0, obj = 0x0, res = 0x0, ref = 0x0, ast = 0x0, zv = 0x0, ptr = 0x0, ce = 0x0, func = 0x0, ww = {w1 = 0, w2 = 0}}, u1 = {v = {type = 0 '\000', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 0}, u2 = {var_flags = 32558, next = 32558, cache_slot = 32558, lineno = 32558, num_args = 32558, fe_pos = 32558, fe_iter_idx = 32558}} fci = {size = 72, function_table = 0x7f2e1b2d6880, function_name = {value = {lval = 139836001742848, dval = 6,9088164512937874e-310, counted = 0x7f2e1b35f000, str = 0x7f2e1b35f000, arr = 0x7f2e1b35f000, obj = 0x7f2e1b35f000, res = 0x7f2e1b35f000, ref = 0x7f2e1b35f000, ast = 0x7f2e1b35f000, zv = 0x7f2e1b35f000, ptr = 0x7f2e1b35f000, ce = 0x7f2e1b35f000, func = 0x7f2e1b35f000, ww = {w1 = 456519680, w2 = 32558}}, u1 = {v = {type = 7 '\a', type_flags = 28 '\034', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 7175}, u2 = {var_flags = 32767, next = 32767, cache_slot = 32767, lineno = 32767, num_args = 32767, fe_pos = 32767, fe_iter_idx = 32767}}, symbol_table = 0x0, retval = 0x7fff346aff20, params = 0x7f2e1b4207b0, object = 0x7f2e1c266240, no_separation = 1 '\001', param_count = 1} fci_cache = {initialized = 1 '\001', function_handler = 0x7f2e1c20faa0, calling_scope = 0x7f2e1b2d6840, called_scope = 0x7f2e1b2d6840, object = 0x7f2e1c266240} __PRETTY_FUNCTION__ = "zif_call_user_func_array" #7 0x0000000000b2a747 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at /opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:692 call = 0x7f2e1c215f90 fbc = 0x23b8720 ret = 0x7f2e1c215e90 __PRETTY_FUNCTION__ = "ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER" #8 0x0000000000b29bab in execute_ex (ex=0x7f2e1c215030) at /opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:394 ret = 0 orig_opline = 0x0 orig_execute_data = 0x0 #9 0x0000000000b29cbe in zend_execute (op_array=0x7f2e1c273000, return_value=0x0) at /opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:434 execute_data = 0x7f2e1c215030 #10 0x0000000000ad0a73 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /opt/php-7.0.0alpha1/Zend/zend.c:1389 files = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff346b01f0, reg_save_area = 0x7fff346b0130}} i = 1 file_handle = 0x7fff346b2520 op_array = 0x7f2e1c273000 #11 0x0000000000a3df50 in php_execute_script (primary_file=0x7fff346b2520) at /opt/php-7.0.0alpha1/main/main.c:2475 realfile = "a\356\224\313\000\200\377\377\320\024k4\377\177\000\000\003", '\000' <repeats 31 times>, "\220gT\002\000\000\000\000\006\024\000\000\000\000\000\000\220u\202\r\000\000\000\000/\025d\037.\177\000\000\000\000\001\000\002\000\023\000+\000k4\377\177\000\000P\032k4\377\177", '\000' <repeats 34 times>, "\234\216\214'.\177\000\000\377\377\377\377\377\377\377\377\220u\202\r\000\000\000\000\034\000\000\000\000\000\000\000D\000\000\000\000\000\000\000xz\251'.\177\000\000\026\230\214'.\177\000\000\002\000\000\000\000\000\000\000\000"... __orig_bailout = 0x7fff346b2590 __bailout = {{__jmpbuf = {16, 8727222397168074030, 4497440, 140734072835232, 0, 0, 8727222398067752238, -8727066670248674002}, __mask_was_saved = 0, __saved_mask = {__val = {140734072821232, 193291732856, 18206501, 140734072824576, 11074847, 18446744069414584319, 8589934592, 8589934592, 0, 0, 140734072824416, 128, 140734072820816, 140734072820816, 140734072821216, 140734072821216}}}} prepend_file_p = 0x0 append_file_p = 0x0 prepend_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'} append_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'} old_cwd = 0x7fff346b01f0 "/" use_heap = 0 '\000' retval = 0 #12 0x0000000000ba03b3 in main (argc=3, argv=0x7fff346b4ca8) at /opt/php-7.0.0alpha1/sapi/fpm/fpm/fpm_main.c:1940 primary_script = 0x7f2e1c203500 "/var/www/hosts/rohlik.l/index.php" __orig_bailout = 0x0 __bailout = {{__jmpbuf = {0, 8727222400552877358, 4497440, 140734072835232, 0, 0, 8727222397170171182, -8727066585289507538}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}} exit_status = 0 cgi = 0 c = -1 use_extended_info = 0 file_handle = {handle = {fd = 472237312, fp = 0x7f2e1c25c500, stream = {handle = 0x7f2e1c25c500, isatty = 0, mmap = {len = 528, pos = 0, map = 0x0, buf = 0x7f2e27ac7000 <error: Cannot access memory at address 0x7f2e27ac7000>, old_handle = 0x0, old_closer = 0x0}, reader = 0xa5bde4 <_php_stream_read>, fsizer = 0xa3b7f6 <php_zend_stream_fsizer>, closer = 0xa3b7d0 <php_zend_stream_mmap_closer>}}, filename = 0x7f2e1c203000 "/var/www/hosts/rohlik.l/index.php", opened_path = 0x0, type = ZEND_HANDLE_MAPPED, free_filename = 0 '\000'} orig_optind = 1 orig_optarg = 0x0 ini_entries_len = 0 max_requests = 500 requests = 1 fcgi_fd = 0 request = {listen_socket = 0, tcp = 0, fd = 3, id = 1, keep = 0, closed = 0, in_len = 0, in_pad = 0, out_hdr = 0x0, out_pos = 0x0, out_buf = "h'k4\377\177\000\000\001\006\000\001\001T\004\000\\n\";\n\t\tfor (var i = 0, scripts = debug.getElementsByTagName('script'); i < scripts.length; i++) {\n\t\t\t(window.execScript || function(data) {\n\t\t\t\twindow['eval'].call(window, data);\n\t\t\t})"..., reserved = "Sheets.l\000\000\000\000\000\000\000", hook = {on_accept = 0xba2d3e <fpm_request_accepting>, on_read = 0xba2dff <fpm_request_reading_headers>, on_close = 0xba339c <fpm_request_finished>}, has_env = 12124692, env = {hash_table = {0x1, 0x0, 0x2548f00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25490b0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2549290, 0x0, 0x0, 0x0, 0x2548ff0, 0x0, 0x0, 0x0, 0x25492c0, 0x0, 0x0, 0x0, 0x2549380, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2549080, 0x0, 0x2549020, 0x2549050, 0x0 <repeats 18 times>, 0x2549170, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2548fc0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2549260, 0x0, 0x2549200, 0x0, 0x25492f0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2549230, 0x2549440, 0x0, 0x0, 0x25491d0, 0x0, 0x0, 0x0, 0x0, 0x2549470, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2548f60, 0x0, 0x2549410, 0x0, 0x0, 0x0, 0x0, 0x25490e0, 0x0, 0x25491a0, 0x0, 0x0, 0x0, 0x25494a0, 0x2548f90, 0x0, 0x2549350, 0x0, 0x0, 0x0, 0x0, 0x2549320, 0x25493e0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, list = 0x25493b0, buckets = 0x25494a0, data = 0x2548ef0}} fpm_config = 0x7fff346b4f6f "" fpm_prefix = 0x0 fpm_pid = 0x0 test_conf = 0 force_daemon = -1 force_stderr = 0 php_information = 0 php_allow_to_run_as_root = 0 __func__ = "main" ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=69816 -- Edit this bug report at https://bugs.php.net/bug.php?id=69816&edit=1