Edit report at https://bugs.php.net/bug.php?id=71342&edit=1
ID: 71342
Comment by: michael dot hartmann at refx dot com
Reported by: michael dot hartmann at refx dot com
Summary: Crash in "zend_mm_gc"
Status: Open
Type: Bug
Package: Reproducible crash
Operating System: Windows 10
PHP Version: 7.0.2
Block user comment: N
Private report: N
New Comment:
I will try to create a tiny script that creates a small array, modifies it via references in a
foreach loop and then calls usort()/uksort() to provoke the crash.
Please don't close this.
Previous Comments:
------------------------------------------------------------------------
[2016-01-21 21:29:54] michael dot hartmann at refx dot com
I've added USE_ZEND_ALLOC=0 as the environment variables for the FCGI process in IIS and now
it's much less table. It crashes 80% of the time.
Here is the new backtrace of that crash:
ntdll!NtWaitForMultipleObjects+14
ntdll!RtlReportExceptionEx+480
ntdll!RtlReportException+c3
ntdll!RtlReportCriticalFailure$filt$0+33
ntdll!_C_specific_handler+96
ntdll!_GSHandlerCheck_SEH+76
ntdll!RtlpExecuteHandlerForException+d
ntdll!RtlDispatchException+3a9
ntdll!RtlRaiseException+324
ntdll!RtlReportCriticalFailure+8c
ntdll!RtlpHeapHandleError+12
ntdll!RtlpLogHeapFailure+96
ntdll!RtlpReAllocateHeapInternal+8fda5
ntdll!RtlReAllocateHeap+31
AcLayers!NS_FaultTolerantHeap::APIHook_RtlReAllocateHeap+31f4
ucrtbase!realloc+3d
php7!_erealloc+347d58 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_alloc.c @ 2468 + 8]
php7!ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HANDLER+97
[c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 44487]
php7!execute_ex+62 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 417 + 5]
php7!zend_call_function+355dcd [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_execute_api.c @
861]
php7!php_array_user_key_compare+cc [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\ext\standard\array.c @
1122 + 26]
php7!zend_sort+11e [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_sort.c @ 334 + d]
php7!zend_hash_sort_ex+85 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_hash.c @ 2256]
php7!php_usort+179 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\ext\standard\array.c @ 1060 + 8]
php7!ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER+35609e
[c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 723]
php7!execute_ex+62 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 417 + 5]
php7!zend_execute+16c [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 459]
php7!zend_execute_scripts+119 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend.c @ 1428]
php7!php_execute_script+463 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\main\main.c @ 2471 + 1b]
php_cgi!main+117a [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\sapi\cgi\cgi_main.c @ 2492]
php_cgi!__scrt_common_main_seh+124 [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 264 +
22]
ntdll!RtlUserThreadStart+34
------------------------------------------------------------------------
[2016-01-20 10:46:06] ab@php.net
Thanks for the backtrace. The analyze shows, that it might be a GC bug while executing some
userspace sort functions (like usort, uksort, etc.). Could you please check the places in your code?
Also, please try to rerun PHP with environment variable USE_ZEND_ALLOC=0 set to the PHP environment
(fe can be added to the FCGI options in IIS).
Thanks.
------------------------------------------------------------------------
[2016-01-19 23:34:20] michael dot hartmann at refx dot com
I've used the DebugDiag Analysis tool to get the backtrace:
ntdll!NtWaitForMultipleObjects+14
KERNELBASE!WaitForMultipleObjectsEx+ef
KERNELBASE!WaitForMultipleObjects+e
kernel32!WerpReportFaultInternal+4ab
kernel32!WerpReportFault+52
KERNELBASE!UnhandledExceptionFilter+277
ntdll!RtlUserThreadStart$filt$0+3e
ntdll!_C_specific_handler+96
ntdll!RtlpExecuteHandlerForException+d
ntdll!RtlDispatchException+3a9
ntdll!KiUserExceptionDispatch+3a
php7!zend_mm_gc+6e [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_alloc.c @ 1891]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_alloc.c @ 1891
php7!zend_mm_alloc_huge+96 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_alloc.c @ 1761 + 8]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_alloc.c @ 1761 + 8
php7!_emalloc+32ffcd [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_alloc.c @ 2442 + 12]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_alloc.c @ 2442 + 12
php7!ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HANDLER+355021
[c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 44492]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 44492
php7!execute_ex+62 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 417 + 5]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 417 + 5
php7!zend_call_function+355dcd [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_execute_api.c @
861] c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_execute_api.c @ 861
php7!php_array_user_key_compare+cc [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\ext\standard\array.c @
1122 + 26] c:\php-sdk\php70dev\vc14\x64\php-7.0.2\ext\standard\array.c @ 1122 + 26
php7!zend_sort+1d8 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_sort.c @ 351 + f]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_sort.c @ 351 + f
php7!zend_sort+282 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_sort.c @ 371]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_sort.c @ 371
php7!zend_hash_sort_ex+85 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_hash.c @ 2256]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_hash.c @ 2256
php7!php_usort+179 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\ext\standard\array.c @ 1060 + 8]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\ext\standard\array.c @ 1060 + 8
php7!ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER+35609e
[c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 723]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 723
php7!execute_ex+62 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 417 + 5]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 417 + 5
php7!zend_execute+16c [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 459]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend_vm_execute.h @ 459
php7!zend_execute_scripts+119 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend.c @ 1428]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\zend\zend.c @ 1428
php7!php_execute_script+463 [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\main\main.c @ 2471 + 1b]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\main\main.c @ 2471 + 1b
php_cgi!main+117a [c:\php-sdk\php70dev\vc14\x64\php-7.0.2\sapi\cgi\cgi_main.c @ 2492]
c:\php-sdk\php70dev\vc14\x64\php-7.0.2\sapi\cgi\cgi_main.c @ 2492
php_cgi!__scrt_common_main_seh+124 [f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 264 +
22] f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl @ 264 + 22
kernel32!BaseThreadInitThunk+22
ntdll!RtlUserThreadStart+34
------------------------------------------------------------------------
[2016-01-19 23:28:15] michael dot hartmann at refx dot com
I've created a full crash-dump. It's 187 MB. Even with simple ZIP compression I get it
down to 18 MB. Or is a mini-crash dump enough?
How do you want me to submit that file?
------------------------------------------------------------------------
[2016-01-19 10:00:22] ab@php.net
On creating core dumps, an info is here https://bugs.php.net/bugs-generating-backtrace-win32.php
or here https://msdn.microsoft.com/en-us/library/windows/desktop/bb787181%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
.
I would see RDP to your machine as not very rational, as you most likely miss all the tools needed
to debug and develop the PHP core on Windows. So quite some time would be needed for setups, etc.
Please lets see what we have in the dumps (be sure there's no sensitive information in there
before posting).
Thanks.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=71342
--
Edit this bug report at https://bugs.php.net/bug.php?id=71342&edit=1