Bug #70601 [NEW]: Segfault in gc_remove_from_buffer()

From: p at wspnr dot com Operating system: Debian x86_64 PHP version: 5.6Git-2015-09-29 (Git) Package: Reproducible crash Bug Type: Bug Bug description:Segfault in gc_remove_from_buffer() Description: ------------ There is a reliable segfault observed in one of our applications. After the first segfault, each additional request also results in a segfault. The only solution is to restart PHP-FPM. This has been tested and reproduced on several machines, all running Debian Jessie. This bug has been observed on 5.6.12 and 5.6.15-dev (latest Git). It HAS NOT been observed on 7.0.0RC3 or 7.1.0-dev (latest Git). Test script: --------------- I have tried to create a short test script to reproduce the bug, but have been unsuccessful. It happens reliably in one high-load use case where 100+ requests are sent to the server almost concurrently. Each request creates many objects, so it is possible that GC is triggered. After ~30 requests are processed, the first crash happens. Expected result: ---------------- No crash, or at least a sensible error message. Actual result: -------------- Core was generated by `php-fpm: pool www '. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00000000009fdc2e in gc_remove_from_buffer (root=0x596d7c <zm_startup_dom+20924>) at Zend/zend_gc.h:189 189 root->next->prev = root->prev; (gdb) bt #0 0x00000000009fdc2e in gc_remove_from_buffer (root=0x596d7c <zm_startup_dom+20924>) at Zend/zend_gc.h:189 #1 0x00000000009fdbf4 in gc_remove_zval_from_buffer (zv=0x7f3652bddda0) at Zend/zend_gc.c:260 #2 0x00000000009ad125 in i_zval_ptr_dtor (zval_ptr=0x7f3652bddda0, __zend_filename=0xf8eadb "/.../php-src/Zend/zend_variables.c", __zend_lineno=188) at Zend/zend_execute.h:78 #3 0x00000000009acc56 in _zval_ptr_dtor (zval_ptr=0x2840318, __zend_filename=0xf8eadb "/.../php-src/Zend/zend_variables.c", __zend_lineno=188) at Zend/zend_execute_API.c:424 #4 0x00000000009c4ba1 in _zval_ptr_dtor_wrapper (zval_ptr=0x2840318) at Zend/zend_variables.c:188 #5 0x00000000009dee9e in zend_hash_destroy (ht=0x283e678) at Zend/zend_hash.c:548 #6 0x00000000009c46f9 in _zval_dtor_func (zvalue=0x25fef38, __zend_filename=0xf8db06 "Zend/zend_execute.h", __zend_lineno=79) at Zend/zend_variables.c:45 #7 0x0000000000a7085c in _zval_dtor (zvalue=0x25fef38, __zend_filename=0xf8db06 "Zend/zend_execute.h", __zend_lineno=79) at Zend/zend_variables.h:35 #8 0x0000000000a7062a in i_zval_ptr_dtor (zval_ptr=0x25fef38, __zend_filename=0xf8db06 "Zend/zend_execute.h", __zend_lineno=308) at Zend/zend_execute.h:79 #9 0x0000000000a70727 in zend_vm_stack_clear_multiple (nested=0) at Zend/zend_execute.h:308 #10 0x0000000000a6f561 in zend_do_fcall_common_helper_SPEC (execute_data=0x2723740) at Zend/zend_vm_execute.h:650 #11 0x0000000000a2a873 in ZEND_DO_FCALL_SPEC_CONST_HANDLER (execute_data=0x2723740) at Zend/zend_vm_execute.h:2602 #12 0x0000000000a14138 in execute_ex (execute_data=0x2723740) at Zend/zend_vm_execute.h:363 #13 0x0000000000a1421e in zend_execute (op_array=0x275cf38) at Zend/zend_vm_execute.h:388 #14 0x00000000009c8e87 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at Zend/zend.c:1341 #15 0x00000000009139f8 in php_execute_script (primary_file=0x7ffe0a895820) at main/main.c:2597 #16 0x0000000000aa891b in main (argc=4, argv=0x7ffe0a8959a8) at /.../php-src/sapi/fpm/fpm/fpm_main.c:1964 -- Edit bug report at https://bugs.php.net/bug.php?id=70601&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70601&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70601&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70601&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70601&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70601&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70601&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70601&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70601&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70601&r=support Expected behavior: https://bugs.php.net/fix.php?id=70601&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70601&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70601&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70601&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70601&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70601&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70601&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70601&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70601&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70601&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70601&r=mysqlcfg