Bug #70428 [Opn->Fbk]: Opcache crashes with SIGSEGV

Edit report at https://bugs.php.net/bug.php?id=70428&edit=1 ID: 70428 Updated by: laruence@php.net Reported by: christian at rishoj dot net Summary: Opcache crashes with SIGSEGV -Status: Open +Status: Feedback Type: Bug Package: opcache Operating System: Ubuntu 14.04 PHP Version: 5.6.12 Block user comment: N Private report: N New Comment: Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. Previous Comments: ------------------------------------------------------------------------ [2015-10-01 22:26:12] steven dot hadfield at business dot com I also encountered this issue (5.6.13 and 5.6.14, CentOS 6, x86_64) I have a non-sharable repeatable test case, but it seems to be related to when there's a large number of strings (e.g. an array 10k strings is where it would die sometimes along with other values). I tried increasing the opcache.interned_strings_buffer value to > 1000, but still encountered the issue. PHP-FPM seemed to only segfault the first time it encountered the situation. Following requests would not trigger the fault until fpm was restarted. The trace was not always the same, but here's an example: #0 _zend_mm_alloc_int (heap=0x171c2d0, size=23) at /usr/src/debug/php-5.6.14/Zend/zend_alloc.c:1910 #1 0x00000000005b864a in _estrndup (s=0x1f11f84 "crawl/0.4 libcrawl/0.3", length=22) at /usr/src/debug/php-5.6.14/Zend/zend_alloc.c:2650 #2 0x00007f5ab94a5e10 in fetch_value (stmt=0x1c3a5e0, dest=0x225bdf0, colno=<value optimized out>, type_override=<value optimized out>) at /usr/src/debug/php-5.6.14/ext/pdo/pdo_stmt.c:641 #3 0x00007f5ab94a92a2 in do_fetch (stmt=0x1c3a5e0, return_value=0x225bbf0, how=<value optimized out>, ori=<value optimized out>, offset=<value optimized out>, return_all=0x0, do_bind=1) at /usr/src/debug/php-5.6.14/ext/pdo/pdo_stmt.c:1034 #4 0x00007f5ab94aa8e0 in zim_PDOStatement_fetchAll (ht=<value optimized out>, return_value=0x21e09e0, return_value_ptr=<value optimized out>, this_ptr=<value optimized out>, return_value_used=<value optimized out>) at /usr/src/debug/php-5.6.14/ext/pdo/pdo_stmt.c:1536 #5 0x00000000005cf4d9 in dtrace_execute_internal (execute_data_ptr=<value optimized out>, fci=<value optimized out>, return_value_used=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:97 #6 0x000000000065e375 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:560 #7 0x000000000064de48 in execute_ex (execute_data=0x7f5acb70a080) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #8 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb70a080) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #9 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #10 0x000000000064de48 in execute_ex (execute_data=0x7f5acb709f18) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #11 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb709f18) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #12 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #13 0x000000000064de48 in execute_ex (execute_data=0x7f5acb709da8) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #14 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb709da8) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #15 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #16 0x000000000064de48 in execute_ex (execute_data=0x7f5acb709c78) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #17 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb709c78) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #18 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #19 0x000000000064de48 in execute_ex (execute_data=0x7f5acb709b58) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #20 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb709b58) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #21 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #22 0x000000000064de48 in execute_ex (execute_data=0x7f5acb7099e8) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #23 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb7099e8) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #24 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #25 0x000000000064de48 in execute_ex (execute_data=0x7f5acb7098a8) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #26 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb7098a8) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #27 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #28 0x000000000064de48 in execute_ex (execute_data=0x7f5acb709718) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #29 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb709718) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #30 0x00000000005d2073 in zend_call_function (fci=0x7fff2bfa5730, fci_cache=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_execute_API.c:829 #31 0x00000000005f7f07 in zend_call_method (object_pp=0x7fff2bfa5868, obj_ce=<value optimized out>, fn_proxy=0x1ba8e50, function_name=0x6f68c6 "__get", function_name_len=<value optimized out>, retval_ptr_ptr=0x7fff2bfa5878, param_count=1, arg1=0x1b8b2c0, arg2=0x0) at /usr/src/debug/php-5.6.14/Zend/zend_interfaces.c:97 #32 0x000000000060725c in zend_std_call_getter (object=0x1d4b9c0, member=0x1b8b2c0) at /usr/src/debug/php-5.6.14/Zend/zend_object_handlers.c:190 #33 0x00000000006087ed in zend_std_read_property (object=0x1d4b9c0, member=0x7f5aa9546570, type=0, key=0x7f5aa9546570) at /usr/src/debug/php-5.6.14/Zend/zend_object_handlers.c:502 #34 0x000000000060ee9d in zend_fetch_property_address_read_helper_SPEC_VAR_CONST (execute_data=0x7f5acb7095d0) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:15322 #35 0x000000000064de48 in execute_ex (execute_data=0x7f5acb7095d0) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #36 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb7095d0) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #37 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #38 0x000000000064de48 in execute_ex (execute_data=0x7f5acb7093c0) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #39 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb7093c0) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #40 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #41 0x000000000064de48 in execute_ex (execute_data=0x7f5acb709268) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #42 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb709268) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #43 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #44 0x000000000064de48 in execute_ex (execute_data=0x7f5acb709108) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #45 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb709108) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #46 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #47 0x000000000064de48 in execute_ex (execute_data=0x7f5acb708fa0) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #48 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb708fa0) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #49 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #50 0x000000000064de48 in execute_ex (execute_data=0x7f5acb708e38) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #51 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb708e38) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #52 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #53 0x000000000064de48 in execute_ex (execute_data=0x7f5acb708cd8) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 #54 0x00000000005cf60e in dtrace_execute_ex (execute_data=0x7f5acb708cd8) at /usr/src/debug/php-5.6.14/Zend/zend_dtrace.c:73 #55 0x000000000065e9e4 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:592 #56 0x000000000064de48 in execute_ex (execute_data=0x7f5acb708b60) at /usr/src/debug/php-5.6.14/Zend/zend_vm_execute.h:363 ------------------------------------------------------------------------ [2015-09-04 12:19:26] christian at rishoj dot net Description: ------------ With the opcache enabled, a certain CLI-invoked operation in a large web application crashes with SIGSEGV. Crash happens with * opcache.interned_strings_buffer=16 and * opcache.interned_strings_buffer=8, but *not* with * opcache.interned_strings_buffer=0. Test script: --------------- I haven't isolated a minimal test case. Actual result: -------------- #0 0x00000000006b3016 in ?? () #1 0x00000000006b31ac in ?? () #2 0x00007ffff50ba905 in ?? () from /usr/lib/php5/20131226/opcache.so #3 0x00007ffff50c24b2 in ?? () from /usr/lib/php5/20131226/opcache.so #4 0x00007ffff50c3ed6 in ?? () from /usr/lib/php5/20131226/opcache.so #5 0x00007ffff50c415e in zend_accel_script_optimize () from /usr/lib/php5/20131226/opcache.so #6 0x00007ffff50aee35 in ?? () from /usr/lib/php5/20131226/opcache.so #7 0x00007ffff50af9e9 in persistent_compile_file () from /usr/lib/php5/20131226/opcache.so #8 0x000000000077f2bd in ?? () #9 0x0000000000715b98 in execute_ex () #10 0x00000000006cab39 in dtrace_execute_ex () #11 0x000000000077e79c in ?? () #12 0x0000000000715b98 in execute_ex () #13 0x00000000006cab39 in dtrace_execute_ex () #14 0x0000000000780567 in ?? () #15 0x0000000000715b98 in execute_ex () #16 0x00000000006cab39 in dtrace_execute_ex () #17 0x00000000006cc863 in zend_call_function () #18 0x00000000006f26f5 in zend_call_method () #19 0x00000000005c7396 in zif_spl_autoload_call () #20 0x00000000006cac3b in dtrace_execute_internal () #21 0x00000000006cc945 in zend_call_function () #22 0x00000000006cd122 in zend_lookup_class_ex () #23 0x00000000006cd812 in zend_fetch_class_by_name () #24 0x0000000000724024 in ?? () #25 0x0000000000715b98 in execute_ex () #26 0x00000000006cab39 in dtrace_execute_ex () #27 0x0000000000780567 in ?? () #28 0x0000000000715b98 in execute_ex () #29 0x00000000006cab39 in dtrace_execute_ex () #30 0x0000000000780567 in ?? () #31 0x0000000000715b98 in execute_ex () #32 0x00000000006cab39 in dtrace_execute_ex () #33 0x00000000006cc863 in zend_call_function () #34 0x00000000005fd302 in zif_call_user_func_array () #35 0x00000000006cac3b in dtrace_execute_internal () #36 0x0000000000780044 in ?? () #37 0x0000000000715b98 in execute_ex () #38 0x00000000006cab39 in dtrace_execute_ex () #39 0x00000000006dcee0 in zend_execute_scripts () #40 0x000000000067b142 in php_execute_script () #41 0x0000000000781ebe in ?? () #42 0x0000000000462a20 in main () ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70428&edit=1