Bug #70079 [Opn]: Segmentation fault after more than 100 SoapClient calls

Edit report at https://bugs.php.net/bug.php?id=70079&edit=1 ID: 70079 Updated by: laruence@php.net Reported by: dmifedorenko at gmail dot com Summary: Segmentation fault after more than 100 SoapClient calls Status: Open Type: Bug Package: Unknown/Other Function Operating System: Linux vm 3.13.0-37-generic #64-U PHP Version: 7.0Git-2015-07-15 (Git) Block user comment: N Private report: N New Comment: hmm, or maybe you could grant me a ssh access to that box? (if it is possible please sent it to me via mail). thanks Previous Comments: ------------------------------------------------------------------------ [2015-07-16 00:05:27] dmifedorenko at gmail dot com Sorry this is right bt from minimal code: --- #0 0x00007f4e23034aea in strlen () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f4e1f750651 in format_converter (odp=0x7fffea0f4660, fmt=0x7f4e1fd26111 "s(%d) : Freeing 0x%.8lX (%zu bytes), script=%s\n", ap=0x7fffea0f46a8) at /home/fedorenko/php7/php-src/main/snprintf.c:993 #2 0x00007f4e1f7510d8 in strx_printv (ccp=0x7fffea0f46a4, buf=0x7fffea0f4a10 "[Thu Jul 16 10:04:08 2015] Script: '/home/fedorenko/baza/www/test.php'\n", len=512, format=0x7f4e1fd26110 "%s(%d) : Freeing 0x%.8lX (%zu bytes), script=%s\n", ap=0x7fffea0f46a8) at /home/fedorenko/php7/php-src/main/snprintf.c:1248 #3 0x00007f4e1f751310 in ap_php_snprintf (buf=0x7fffea0f4a10 "[Thu Jul 16 10:04:08 2015] Script: '/home/fedorenko/baza/www/test.php'\n", len=512, format=0x7f4e1fd26110 "%s(%d) : Freeing 0x%.8lX (%zu bytes), script=%s\n") at /home/fedorenko/php7/php-src/main/snprintf.c:1293 #4 0x00007f4e1f74bb8f in php_message_handler_for_zend (message=4, data=0x7fffea0f5ac0) at /home/fedorenko/php7/php-src/main/main.c:1435 #5 0x00007f4e1f7e0b55 in zend_message_dispatcher (message=4, data=0x7fffea0f5ac0) at /home/fedorenko/php7/php-src/Zend/zend.c:996 #6 0x00007f4e1f7ad742 in zend_mm_check_leaks (heap=0x7f4e15800040) at /home/fedorenko/php7/php-src/Zend/zend_alloc.c:1905 #7 0x00007f4e1f7ada40 in zend_mm_shutdown (heap=0x7f4e15800040, full=0, silent=0) at /home/fedorenko/php7/php-src/Zend/zend_alloc.c:1973 #8 0x00007f4e1f7ae886 in shutdown_memory_manager (silent=0, full_shutdown=0) at /home/fedorenko/php7/php-src/Zend/zend_alloc.c:2392 #9 0x00007f4e1f74ca66 in php_request_shutdown (dummy=0x0) at /home/fedorenko/php7/php-src/main/main.c:1837 #10 0x00007f4e1f89e816 in php_apache_request_dtor (r=0x7f4e15a0a0a0) at /home/fedorenko/php7/php-src/sapi/apache2handler/sapi_apache2.c:513 #11 0x00007f4e1f89f141 in php_handler (r=0x7f4e15a0a0a0) at /home/fedorenko/php7/php-src/sapi/apache2handler/sapi_apache2.c:685 #12 0x00007f4e23ea1880 in ap_run_handler () #13 0x00007f4e23ea1dc9 in ap_invoke_handler () #14 0x00007f4e23eb789a in ap_process_async_request () #15 0x00007f4e23eb7b74 in ap_process_request () #16 0x00007f4e23eb4622 in ?? () #17 0x00007f4e23eab370 in ap_run_process_connection () #18 0x00007f4e202d6767 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #19 0x00007f4e202d69a6 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #20 0x00007f4e202d6a06 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #21 0x00007f4e202d76e0 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #22 0x00007f4e23e87c0e in ap_run_mpm () #23 0x00007f4e23e813c6 in main () ------------------------------------------------------------------------ [2015-07-16 00:02:31] dmifedorenko at gmail dot com Minimal source code to reproduce problem: --- <?php class JiraSoapClientEx extends SoapClient { } $jiraClient = new JiraSoapClientEx('http://aux.srv.loc:82/rpc/soap/jirasoapservice-v2?wsdl'); $token = $jiraClient->login('admin', 'XXXX'); for ($i = 1;$i<=150;$i++) { $jiraClient->getIssue($token, "BAZAR-240424"); } --- If I change 150 to 80 for example the code will work. Only after about 100 calls to SoapClient the script will fail. Jira server is still private, we try to find way to open it in public, but that is not easy task. New backtrace: --- #0 0x00007fc7bbe79aea in strlen () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007fc7b8595651 in format_converter (odp=0x7ffff4d9ef00, fmt=0x7fc7b8b6b111 "s(%d) : Freeing 0x%.8lX (%zu bytes), script=%s\n", ap=0x7ffff4d9ef48) at /home/fedorenko/php7/php-src/main/snprintf.c:993 #2 0x00007fc7b85960d8 in strx_printv (ccp=0x7ffff4d9ef44, buf=0x7ffff4d9f2b0 "[Thu Jul 16 09:51:47 2015] Script: '/home/fedorenko/baza/www/index.php'\n", len=512, format=0x7fc7b8b6b110 "%s(%d) : Freeing 0x%.8lX (%zu bytes), script=%s\n", ap=0x7ffff4d9ef48) at /home/fedorenko/php7/php-src/main/snprintf.c:1248 #3 0x00007fc7b8596310 in ap_php_snprintf (buf=0x7ffff4d9f2b0 "[Thu Jul 16 09:51:47 2015] Script: '/home/fedorenko/baza/www/index.php'\n", len=512, format=0x7fc7b8b6b110 "%s(%d) : Freeing 0x%.8lX (%zu bytes), script=%s\n") at /home/fedorenko/php7/php-src/main/snprintf.c:1293 #4 0x00007fc7b8590b8f in php_message_handler_for_zend (message=4, data=0x7ffff4da0360) at /home/fedorenko/php7/php-src/main/main.c:1435 #5 0x00007fc7b8625b55 in zend_message_dispatcher (message=4, data=0x7ffff4da0360) at /home/fedorenko/php7/php-src/Zend/zend.c:996 #6 0x00007fc7b85f2742 in zend_mm_check_leaks (heap=0x7fc7ae600040) at /home/fedorenko/php7/php-src/Zend/zend_alloc.c:1905 #7 0x00007fc7b85f2a40 in zend_mm_shutdown (heap=0x7fc7ae600040, full=0, silent=0) at /home/fedorenko/php7/php-src/Zend/zend_alloc.c:1973 #8 0x00007fc7b85f3886 in shutdown_memory_manager (silent=0, full_shutdown=0) at /home/fedorenko/php7/php-src/Zend/zend_alloc.c:2392 #9 0x00007fc7b8591a66 in php_request_shutdown (dummy=0x0) at /home/fedorenko/php7/php-src/main/main.c:1837 #10 0x00007fc7b86e3816 in php_apache_request_dtor (r=0x7fc7ae8530a0) at /home/fedorenko/php7/php-src/sapi/apache2handler/sapi_apache2.c:513 #11 0x00007fc7b86e4141 in php_handler (r=0x7fc7ae8530a0) at /home/fedorenko/php7/php-src/sapi/apache2handler/sapi_apache2.c:685 #12 0x00007fc7bcce6880 in ap_run_handler () #13 0x00007fc7bcce6dc9 in ap_invoke_handler () #14 0x00007fc7bccfc89a in ap_process_async_request () #15 0x00007fc7bccfcb74 in ap_process_request () #16 0x00007fc7bccf9622 in ?? () #17 0x00007fc7bccf0370 in ap_run_process_connection () #18 0x00007fc7b911b767 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #19 0x00007fc7b911b9a6 in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #20 0x00007fc7b911c60e in ?? () from /usr/lib/apache2/modules/mod_mpm_prefork.so #21 0x00007fc7bccccc0e in ap_run_mpm () #22 0x00007fc7bccc63c6 in main () --- New minimal backtrace still useless? ------------------------------------------------------------------------ [2015-07-15 09:50:28] laruence@php.net hmm, this kind of backtrace(segfault in zend_mm) implies that the memory is corrupt by some codes before, which make the backtrace kind of useless. we need find who corrupt it.. so.. if no reproduceable scripts ,, no much things we can do. :< thanks ------------------------------------------------------------------------ [2015-07-15 06:59:55] dmifedorenko at gmail dot com Sorry but server is not public, it works in locale network only. I cant share full source code of client due to copyrights. Minimal code example useless without public soap server. Or not? I got full binary core file, can it help? ------------------------------------------------------------------------ [2015-07-15 06:40:26] laruence@php.net give us a script(client and server) which can reproduce that ... ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=70079 -- Edit this bug report at https://bugs.php.net/bug.php?id=70079&edit=1