Edit report at https://bugs.php.net/bug.php?id=69816&edit=1
ID: 69816
Comment by: arjen at react dot com
Reported by: filip at prochazka dot su
Summary: SIGSEGV in zend_hash_index_find_bucket
Status: Assigned
Type: Bug
Package: Reproducible crash
Operating System: Linux
PHP Version: 7.0.0alpha1
Assigned To: laruence
Block user comment: N
Private report: N
New Comment:
Poor mans debugging: register a tick function which prints the current file and line every n ticks
(current file and line can be fetched from debug_backtrace()).
declare(ticks=1);
register_tick_function(function(){
$bt = debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS, 2);
//gc_collect_cycles(); // uncomment to run gc collection to find invalid object destruction early,
not at end of request
echo $bt[0]['file'] . '::' . $bt[0]['line'] . PHP_EOL;
});
This has worked for me to find exact location (file, line) of errors in big projects.
Previous Comments:
------------------------------------------------------------------------
[2015-06-13 14:35:43] filip at prochazka dot su
I've encountered this problem on localhost and the software is proprietary. I'll try more
to isolate it, but it's dying on me at very deep point of application in a getter. I'm not
sure how to isolate that...
------------------------------------------------------------------------
[2015-06-13 13:28:39] laruence@php.net
I can only see the adroit is wrong...
it's better you can have a reproducible script...otherwise... I can not do much thing here..(or
maybe grant me a ssh access :))
------------------------------------------------------------------------
[2015-06-13 00:51:28] filip at prochazka dot su
(gdb) bt full
#0 0x0000000000ae3517 in zend_hash_index_find_bucket (ht=0x7f2e1b7066c0, h=0) at
/opt/php-7.0.0alpha1/Zend/zend_hash.c:464
nIndex = 0
idx = 11421359
p = 0x7f2e1b7066c0
arData = 0x1e
__PRETTY_FUNCTION__ = "zend_hash_index_find_bucket"
#1 0x0000000000ae7a18 in zend_hash_index_exists (ht=0x7f2e1b7066c0, h=0) at
/opt/php-7.0.0alpha1/Zend/zend_hash.c:1935
p = 0x7f2e1c218a80
#2 0x00000000008f8c91 in zif_array_key_exists (execute_data=0x7f2e1c218a20,
return_value=0x7f2e1c2185f0) at /opt/php-7.0.0alpha1/ext/standard/array.c:5009
key = 0x7f2e1c218a80
array = 0x7f2e1b7066c0
__PRETTY_FUNCTION__ = "zif_array_key_exists"
#3 0x0000000000b2a747 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:692
call = 0x7f2e1c218a20
fbc = 0x2416100
ret = 0x7f2e1c2185f0
__PRETTY_FUNCTION__ = "ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER"
#4 0x0000000000b29bab in execute_ex (ex=0x7f2e1c216010) at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:394
ret = 0
orig_opline = 0x7f2e1b281ec0
orig_execute_data = 0x7f2e1c215d80
#5 0x0000000000ab8c79 in zend_call_function (fci=0x7fff346aff60, fci_cache=0x7fff346aff30) at
/opt/php-7.0.0alpha1/Zend/zend_execute_API.c:841
call_via_handler = 0
i = 1
calling_scope = 0x7f2e1b2d6840
call = 0x7f2e1c216010
dummy_execute_data = {opline = 0x7f2e1b4cc008, call = 0x7fff346aff70, return_value =
0x7f2e1c215ff0, func = 0x7f2e1b35f000, This = {value = {lval = 140734072815264, dval =
6,9531870577342426e-310, counted = 0x7fff346afea0,
str = 0x7fff346afea0, arr = 0x7fff346afea0, obj = 0x7fff346afea0, res =
0x7fff346afea0, ref = 0x7fff346afea0, ast = 0x7fff346afea0, zv = 0x7fff346afea0, ptr =
0x7fff346afea0, ce = 0x7fff346afea0, func = 0x7fff346afea0, ww = {
w1 = 879427232, w2 = 32767}}, u1 = {v = {type = 176 '\260', type_flags = 7
'\a', const_flags = 66 'B', reserved = 27 '\033'}, type_info =
457312176}, u2 = {var_flags = 32558, next = 32558, cache_slot = 32558, lineno = 32558,
num_args = 32558, fe_pos = 32558, fe_iter_idx = 32558}}, run_time_cache =
0x7f2e1b4cc008, literals = 0x7f2e1b373f88, called_scope = 0x7fff346afea0, prev_execute_data =
0xadef63 <zend_fcall_info_args+37>,
symbol_table = 0x7f2e1c216000}
fci_cache_local = {initialized = 32 ' ', function_handler = 0x40a00000000,
calling_scope = 0x7f2e1b4207c0, called_scope = 0x7f2e1b4cc028, object = 0x7f2e1b4cc028}
func = 0x7f2e1c20faa0
orig_scope = 0x7f2e1b3f0628
__PRETTY_FUNCTION__ = "zend_call_function"
#6 0x00000000008fe9a8 in zif_call_user_func_array (execute_data=0x7f2e1c215f90,
return_value=0x7f2e1c215e90) at /opt/php-7.0.0alpha1/ext/standard/basic_functions.c:4805
params = 0x7f2e1c216000
retval = {value = {lval = 0, dval = 0, counted = 0x0, str = 0x0, arr = 0x0, obj = 0x0, res =
0x0, ref = 0x0, ast = 0x0, zv = 0x0, ptr = 0x0, ce = 0x0, func = 0x0, ww = {w1 = 0, w2 = 0}}, u1 =
{v = {type = 0 '\000',
type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0
'\000'}, type_info = 0}, u2 = {var_flags = 32558, next = 32558, cache_slot = 32558, lineno
= 32558, num_args = 32558, fe_pos = 32558, fe_iter_idx = 32558}}
fci = {size = 72, function_table = 0x7f2e1b2d6880, function_name = {value = {lval =
139836001742848, dval = 6,9088164512937874e-310, counted = 0x7f2e1b35f000, str = 0x7f2e1b35f000, arr
= 0x7f2e1b35f000, obj = 0x7f2e1b35f000,
res = 0x7f2e1b35f000, ref = 0x7f2e1b35f000, ast = 0x7f2e1b35f000, zv = 0x7f2e1b35f000,
ptr = 0x7f2e1b35f000, ce = 0x7f2e1b35f000, func = 0x7f2e1b35f000, ww = {w1 = 456519680, w2 =
32558}}, u1 = {v = {type = 7 '\a',
type_flags = 28 '\034', const_flags = 0 '\000', reserved = 0
'\000'}, type_info = 7175}, u2 = {var_flags = 32767, next = 32767, cache_slot = 32767,
lineno = 32767, num_args = 32767, fe_pos = 32767, fe_iter_idx = 32767}},
symbol_table = 0x0, retval = 0x7fff346aff20, params = 0x7f2e1b4207b0, object =
0x7f2e1c266240, no_separation = 1 '\001', param_count = 1}
fci_cache = {initialized = 1 '\001', function_handler = 0x7f2e1c20faa0,
calling_scope = 0x7f2e1b2d6840, called_scope = 0x7f2e1b2d6840, object = 0x7f2e1c266240}
__PRETTY_FUNCTION__ = "zif_call_user_func_array"
#7 0x0000000000b2a747 in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:692
call = 0x7f2e1c215f90
fbc = 0x23b8720
ret = 0x7f2e1c215e90
__PRETTY_FUNCTION__ = "ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER"
#8 0x0000000000b29bab in execute_ex (ex=0x7f2e1c215030) at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:394
ret = 0
orig_opline = 0x0
orig_execute_data = 0x0
#9 0x0000000000b29cbe in zend_execute (op_array=0x7f2e1c273000, return_value=0x0) at
/opt/php-7.0.0alpha1/Zend/zend_vm_execute.h:434
execute_data = 0x7f2e1c215030
#10 0x0000000000ad0a73 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/opt/php-7.0.0alpha1/Zend/zend.c:1389
files = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff346b01f0, reg_save_area
= 0x7fff346b0130}}
i = 1
file_handle = 0x7fff346b2520
op_array = 0x7f2e1c273000
#11 0x0000000000a3df50 in php_execute_script (primary_file=0x7fff346b2520) at
/opt/php-7.0.0alpha1/main/main.c:2475
realfile = "a\356\224\313\000\200\377\377\320\024k4\377\177\000\000\003",
'\000' <repeats 31 times>,
"\220gT\002\000\000\000\000\006\024\000\000\000\000\000\000\220u\202\r\000\000\000\000/\025d\037.\177\000\000\000\000\001\000\002\000\023\000+\000k4\377\177\000\000P\032k4\377\177",
'\000' <repeats 34 times>,
"\234\216\214'.\177\000\000\377\377\377\377\377\377\377\377\220u\202\r\000\000\000\000\034\000\000\000\000\000\000\000D\000\000\000\000\000\000\000xz\251'.\177\000\000\026\230\214'.\177\000\000\002\000\000\000\000\000\000\000\000"...
__orig_bailout = 0x7fff346b2590
__bailout = {{__jmpbuf = {16, 8727222397168074030, 4497440, 140734072835232, 0, 0,
8727222398067752238, -8727066670248674002}, __mask_was_saved = 0, __saved_mask = {__val =
{140734072821232, 193291732856, 18206501, 140734072824576,
11074847, 18446744069414584319, 8589934592, 8589934592, 0, 0, 140734072824416, 128,
140734072820816, 140734072820816, 140734072821216, 140734072821216}}}}
prepend_file_p = 0x0
append_file_p = 0x0
prepend_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len
= 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0,
closer = 0x0}}, filename = 0x0,
opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
append_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len =
0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0, old_closer = 0x0}, reader = 0x0, fsizer = 0x0,
closer = 0x0}}, filename = 0x0,
opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'}
old_cwd = 0x7fff346b01f0 "/"
use_heap = 0 '\000'
retval = 0
#12 0x0000000000ba03b3 in main (argc=3, argv=0x7fff346b4ca8) at
/opt/php-7.0.0alpha1/sapi/fpm/fpm/fpm_main.c:1940
primary_script = 0x7f2e1c203500 "/var/www/hosts/rohlik.l/index.php"
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {0, 8727222400552877358, 4497440, 140734072835232, 0, 0,
8727222397170171182, -8727066585289507538}, __mask_was_saved = 0, __saved_mask = {__val = {0
<repeats 16 times>}}}}
exit_status = 0
cgi = 0
c = -1
use_extended_info = 0
file_handle = {handle = {fd = 472237312, fp = 0x7f2e1c25c500, stream = {handle =
0x7f2e1c25c500, isatty = 0, mmap = {len = 528, pos = 0, map = 0x0, buf = 0x7f2e27ac7000 <error:
Cannot access memory at address 0x7f2e27ac7000>,
old_handle = 0x0, old_closer = 0x0}, reader = 0xa5bde4 <_php_stream_read>,
fsizer = 0xa3b7f6 <php_zend_stream_fsizer>, closer = 0xa3b7d0
<php_zend_stream_mmap_closer>}},
filename = 0x7f2e1c203000 "/var/www/hosts/rohlik.l/index.php", opened_path =
0x0, type = ZEND_HANDLE_MAPPED, free_filename = 0 '\000'}
orig_optind = 1
orig_optarg = 0x0
ini_entries_len = 0
max_requests = 500
requests = 1
fcgi_fd = 0
request = {listen_socket = 0, tcp = 0, fd = 3, id = 1, keep = 0, closed = 0, in_len = 0,
in_pad = 0, out_hdr = 0x0, out_pos = 0x0,
out_buf = "h'k4\377\177\000\000\001\006\000\001\001T\004\000\\n\";\n\t\tfor
(var i = 0, scripts = debug.getElementsByTagName('script'); i < scripts.length; i++)
{\n\t\t\t(window.execScript || function(data) {\n\t\t\t\twindow['eval'].call(window,
data);\n\t\t\t})"..., reserved = "Sheets.l\000\000\000\000\000\000\000", hook =
{on_accept = 0xba2d3e <fpm_request_accepting>, on_read = 0xba2dff
<fpm_request_reading_headers>, on_close = 0xba339c <fpm_request_finished>},
has_env = 12124692, env = {hash_table = {0x1, 0x0, 0x2548f00, 0x0, 0x0, 0x0, 0x0, 0x0,
0x25490b0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2549290, 0x0, 0x0, 0x0, 0x2548ff0, 0x0, 0x0, 0x0,
0x25492c0, 0x0, 0x0, 0x0, 0x2549380, 0x0, 0x0,
0x0, 0x0, 0x0, 0x2549080, 0x0, 0x2549020, 0x2549050, 0x0 <repeats 18 times>,
0x2549170, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2548fc0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2549260, 0x0,
0x2549200, 0x0, 0x25492f0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x2549230, 0x2549440, 0x0, 0x0, 0x25491d0, 0x0, 0x0, 0x0, 0x0, 0x2549470, 0x0, 0x0,
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2548f60, 0x0, 0x2549410, 0x0, 0x0, 0x0, 0x0, 0x25490e0, 0x0,
0x25491a0, 0x0, 0x0, 0x0, 0x25494a0, 0x2548f90,
0x0, 0x2549350, 0x0, 0x0, 0x0, 0x0, 0x2549320, 0x25493e0, 0x0, 0x0, 0x0, 0x0, 0x0,
0x0}, list = 0x25493b0, buckets = 0x25494a0, data = 0x2548ef0}}
fpm_config = 0x7fff346b4f6f ""
fpm_prefix = 0x0
fpm_pid = 0x0
test_conf = 0
force_daemon = -1
force_stderr = 0
php_information = 0
php_allow_to_run_as_root = 0
__func__ = "main"
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=69816
--
Edit this bug report at https://bugs.php.net/bug.php?id=69816&edit=1