Edit report at https://bugs.php.net/bug.php?id=71135&edit=1
ID: 71135
Comment by: matej21 at matej21 dot cz
Reported by: iquito at gmx dot net
Summary: Random memory corruption with strings
Status: Assigned
Type: Bug
Package: opcache
Operating System: Debian Jessie
PHP Version: 7.0.0
Assigned To: laruence
Block user comment: N
Private report: N
New Comment:
Hi, I'm experiencing similar issue. It sometimes happens to me after opcache_reset (not only
manual but also automatic cache reset when opcache is out of a memory). I was able to reproduce it
on my dev machine using "ab" requesting the site and running opcache_reset few times (it
happens in about 10% of opcache_reset calls)
I tried it with both enabled and disabled protected_memory. And here are some errors and traces:
with opcache.protected_memory=1
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000000000a5e9dd in zend_string_release (s=0x7f5937855d80) at
/home/matej21/tmp/php-7.0.3/Zend/zend_string.h:270
270 if (--GC_REFCOUNT(s) == 0) {
(gdb) bt
#0 0x0000000000a5e9dd in zend_string_release (s=0x7f5937855d80) at
/home/matej21/tmp/php-7.0.3/Zend/zend_string.h:270
#1 0x0000000000a629f1 in zend_hash_destroy (ht=0x7f593599ef60) at
/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1265
#2 0x0000000000a81e45 in zend_gc_collect_cycles () at
/home/matej21/tmp/php-7.0.3/Zend/zend_gc.c:1117
#3 0x0000000000a3517f in shutdown_executor () at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:352
#4 0x0000000000a4cf98 in zend_deactivate () at /home/matej21/tmp/php-7.0.3/Zend/zend.c:967
#5 0x00000000009ba30d in php_request_shutdown (dummy=0x0) at
/home/matej21/tmp/php-7.0.3/main/main.c:1823
#6 0x0000000000b1d4ae in main (argc=4, argv=0x7ffe1f4434a8) at
/home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1972
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000000000a5e9dd in zend_string_release (s=0x7f593779d6b0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_string.h:270
270 if (--GC_REFCOUNT(s) == 0) {
(gdb) bt
#0 0x0000000000a5e9dd in zend_string_release (s=0x7f593779d6b0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_string.h:270
#1 0x0000000000a629f1 in zend_hash_destroy (ht=0x7f59360751c0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1265
#2 0x0000000000a3b042 in destroy_zend_class (zv=0x7ffe1f442c40) at
/home/matej21/tmp/php-7.0.3/Zend/zend_opcode.c:289
#3 0x0000000000a6203f in _zend_hash_del_el_ex (ht=0x30df4a0, idx=700, p=0x34138c0, prev=0x0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1013
#4 0x0000000000a6210a in _zend_hash_del_el (ht=0x30df4a0, idx=700, p=0x34138c0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1037
#5 0x0000000000a639a6 in zend_hash_reverse_apply (ht=0x30df4a0, apply_func=0xa3454a
<clean_non_persistent_class>) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1615
#6 0x0000000000a35269 in shutdown_executor () at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:367
#7 0x0000000000a4cf98 in zend_deactivate () at /home/matej21/tmp/php-7.0.3/Zend/zend.c:967
#8 0x00000000009ba30d in php_request_shutdown (dummy=0x0) at
/home/matej21/tmp/php-7.0.3/main/main.c:1823
#9 0x0000000000b1d4ae in main (argc=4, argv=0x7ffe1f4434a8) at
/home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1972
---------------------------------------
with opcache.protected_memory=0
first some error messages showing corrupted memory:
require(): Failed opening required
'/var/www/foo-project/vendor/composer/autoload_namespaces.phpï¿Åï¿Åï¿Åï¿Å'
require_once(): Failed opening required
'/var/www-foo-project/vendor/composer/autoload_real.pfp'
require_once(): Failed opening required
'/var/www/foo-project/vendor/composer/autoload_real.pgpï¿Åï¿Å'
include(): Failed opening
'/var/www/foo-project/vendor/nette/utils/src/Utils/DateTime.phpï¿Å/Cube`'
Fatal Error: Class 'Solarium\Core\Configurableÿÿ' not found-obleceni/
Error: Class 'Nette\Http\SessionSectionÿÿÿ' not found
Error: Class 'Nette\Caching\Storages\FileStorageÿÿ' not found
Uncaught Error: Call to undefined method
ComposerAutoloaderInit41,89608998d7c84bcc13a727394dca1::getLoader()
Error: Class 'App\Security\UserStorageÿÿÿÿ' not found in
/var/www/foo-project/temp/cache/Nette.Configurator/Container_1efc2a7985.php:7427
sometimes "only" segfault has happened, but opcache was not corrupted (IIRC), therefore
other requests didn't fail:
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f47ada7dfb7 in kill () at ../sysdeps/unix/syscall-template.S:81
81 ../sysdeps/unix/syscall-template.S: AdresáŠnebo soubor neexistuje.
(gdb) bt
#0 0x00007f47ada7dfb7 in kill () at ../sysdeps/unix/syscall-template.S:81
#1 0x0000000000a1663f in zend_mm_panic (message=0x1135a1d "zend_mm_heap corrupted") at
/home/matej21/tmp/php-7.0.3/Zend/zend_alloc.c:364
#2 0x0000000000a18346 in zend_mm_free_heap (heap=0x7f47a7800040, ptr=0x7f47a35988b0,
__zend_filename=0x113ce20 "/home/matej21/tmp/php-7.0.3/Zend/zend_string.h",
__zend_lineno=271, __zend_orig_filename=0x0, __zend_orig_lineno=0)
at /home/matej21/tmp/php-7.0.3/Zend/zend_alloc.c:1400
#3 0x0000000000a1ac7e in _efree (ptr=0x7f47a35988b0, __zend_filename=0x113ce20
"/home/matej21/tmp/php-7.0.3/Zend/zend_string.h", __zend_lineno=271,
__zend_orig_filename=0x0, __zend_orig_lineno=0)
at /home/matej21/tmp/php-7.0.3/Zend/zend_alloc.c:2458
#4 0x0000000000a5ea2c in zend_string_release (s=0x7f47a35988b0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_string.h:271
#5 0x0000000000a629f1 in zend_hash_destroy (ht=0x7f47a2920fc0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1265
#6 0x0000000000a3b042 in destroy_zend_class (zv=0x7fffbfa67e60) at
/home/matej21/tmp/php-7.0.3/Zend/zend_opcode.c:289
#7 0x0000000000a6203f in _zend_hash_del_el_ex (ht=0x20884a0, idx=535, p=0x23b3360, prev=0x0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1013
#8 0x0000000000a6210a in _zend_hash_del_el (ht=0x20884a0, idx=535, p=0x23b3360) at
/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1037
#9 0x0000000000a639a6 in zend_hash_reverse_apply (ht=0x20884a0, apply_func=0xa3454a
<clean_non_persistent_class>) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:1615
#10 0x0000000000a35269 in shutdown_executor () at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:367
#11 0x0000000000a4cf98 in zend_deactivate () at /home/matej21/tmp/php-7.0.3/Zend/zend.c:967
#12 0x00000000009ba30d in php_request_shutdown (dummy=0x0) at
/home/matej21/tmp/php-7.0.3/main/main.c:1823
#13 0x0000000000b1d4ae in main (argc=4, argv=0x7fffbfa686c8) at
/home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1972
Program terminated with signal SIGABRT, Aborted.
#0 0x00007f47ada7dcc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: AdresáŠnebo soubor neexistuje.
(gdb) bt
#0 0x00007f47ada7dcc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007f47ada810d8 in __GI_abort () at abort.c:89
#2 0x00007f47ada76b86 in __assert_fail_base (fmt=0x7f47b1835029 <error: Cannot access memory at
address 0x7f47b1835029>, assertion=assertion@entry=0x113d04d "*end == '\\0'",
file=file@entry=0x113cf08 "/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c",
line=line@entry=2432, function=function@entry=0x113d200 <__PRETTY_FUNCTION__.8927>
"_zend_handle_numeric_str_ex") at assert.c:92
#3 0x00007f47ada76c32 in __GI___assert_fail (assertion=0x113d04d "*end ==
'\\0'", file=0x113cf08 "/home/matej21/tmp/php-7.0.3/Zend/zend_hash.c",
line=2432,
function=0x113d200 <__PRETTY_FUNCTION__.8927> "_zend_handle_numeric_str_ex") at
assert.c:101
#4 0x0000000000a65c03 in _zend_handle_numeric_str_ex (key=0x7f47a36645c8 "234\377",
length=3, idx=0x7fffbfa65c18) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.c:2432
#5 0x0000000000aa0236 in _zend_handle_numeric_str (key=0x7f47a36645c8 "234\377",
length=3, idx=0x7fffbfa65c18) at /home/matej21/tmp/php-7.0.3/Zend/zend_hash.h:264
#6 0x0000000000b07c30 in ZEND_ISSET_ISEMPTY_DIM_OBJ_SPEC_TMPVAR_CV_HANDLER () at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:44069
#7 0x0000000000aa93ff in execute_ex (ex=0x7f47a7815060) at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414
#8 0x0000000000a36ce7 in zend_call_function (fci=0x7fffbfa65e90, fci_cache=0x7fffbfa65e60) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:860
#9 0x00000000008943f8 in zif_call_user_func_array (execute_data=0x7f47a7814fe0,
return_value=0x7f47a7814fa0) at /home/matej21/tmp/php-7.0.3/ext/standard/basic_functions.c:4811
#10 0x0000000000aa9f6a in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER () at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:714
#11 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814030) at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414
#12 0x0000000000aa9511 in zend_execute (op_array=0x7f47a7865000, return_value=0x0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:458
#13 0x0000000000a4e394 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/matej21/tmp/php-7.0.3/Zend/zend.c:1427
#14 0x00000000009bb7a1 in php_execute_script (primary_file=0x7fffbfa683d0) at
/home/matej21/tmp/php-7.0.3/main/main.c:2484
#15 0x0000000000b1d368 in main (argc=4, argv=0x7fffbfa686c8) at
/home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1944
Program terminated with signal SIGSEGV, Segmentation fault.
#0 memset () at ../sysdeps/x86_64/memset.S:93
93 ../sysdeps/x86_64/memset.S: AdresáŠnebo soubor neexistuje.
(gdb) bt
#0 memset () at ../sysdeps/x86_64/memset.S:93
#1 0x0000000000aa83e6 in i_init_code_execute_data (execute_data=0x7f47a7814a50,
op_array=0x7f47a7873700, return_value=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute.c:2200
#2 0x0000000000ae5790 in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER () at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:29164
#3 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814930) at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414
#4 0x0000000000a36ce7 in zend_call_function (fci=0x7fffbfa64ad0, fci_cache=0x7fffbfa64aa0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:860
#5 0x0000000000a73f76 in zend_call_method (object=0x7f47a7802d28, obj_ce=0x7f47a7805380,
fn_proxy=0x7f47a7802d20, function_name=0x7f47a792fbe8
"composer\\autoload\\classloader::loadclass\001", function_name_len=44,
retval_ptr=0x0, param_count=1, arg1=0x7f47a7814920, arg2=0x0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_interfaces.c:104
#6 0x000000000083e7fc in zif_spl_autoload_call (execute_data=0x7f47a78148c0,
return_value=0x7fffbfa64da0) at /home/matej21/tmp/php-7.0.3/ext/spl/php_spl.c:429
#7 0x0000000000a36e0e in zend_call_function (fci=0x7fffbfa64de0, fci_cache=0x7fffbfa64db0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:879
#8 0x0000000000a3758c in zend_lookup_class_ex (name=0x7f47a359b1d8, key=0x7f47a398ef20,
use_autoload=1) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1041
#9 0x0000000000a380d5 in zend_fetch_class_by_name (class_name=0x7f47a359b1d8, key=0x7f47a398ef20,
fetch_type=6) at /home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1387
#10 0x0000000000aac681 in ZEND_ADD_TRAIT_SPEC_HANDLER () at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:1449
#11 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814730) at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414
#12 0x0000000000a36ce7 in zend_call_function (fci=0x7fffbfa65140, fci_cache=0x7fffbfa65110) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:860
#13 0x0000000000a73f76 in zend_call_method (object=0x7f47a7802d28, obj_ce=0x7f47a7805380,
fn_proxy=0x7f47a7802d20, function_name=0x7f47a792fbe8
"composer\\autoload\\classloader::loadclass\001", function_name_len=44,
retval_ptr=0x0, param_count=1, arg1=0x7f47a7814720, arg2=0x0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_interfaces.c:104
#14 0x000000000083e7fc in zif_spl_autoload_call (execute_data=0x7f47a78146c0,
return_value=0x7fffbfa65410) at /home/matej21/tmp/php-7.0.3/ext/spl/php_spl.c:429
#15 0x0000000000a36e0e in zend_call_function (fci=0x7fffbfa65450, fci_cache=0x7fffbfa65420) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:879
#16 0x0000000000a3758c in zend_lookup_class_ex (name=0x7f47a359b5d8, key=0x0, use_autoload=1) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1041
#17 0x0000000000a6c0e3 in zif_class_alias (execute_data=0x7f47a7814640, return_value=0x7f47a7814620)
at /home/matej21/tmp/php-7.0.3/Zend/zend_builtin_functions.c:1585
#18 0x0000000000aa99d0 in ZEND_DO_ICALL_SPEC_HANDLER () at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:586
#19 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814590) at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414
#20 0x0000000000a36ce7 in zend_call_function (fci=0x7fffbfa657e0, fci_cache=0x7fffbfa657b0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:860
#21 0x0000000000a73f76 in zend_call_method (object=0x0, obj_ce=0x0, fn_proxy=0x7f47a78fe190,
function_name=0x7f47a7901bf8 "closure::__invoke\003", function_name_len=21,
retval_ptr=0x0, param_count=1, arg1=0x7f47a7814580,
arg2=0x0) at /home/matej21/tmp/php-7.0.3/Zend/zend_interfaces.c:104
#22 0x000000000083e7fc in zif_spl_autoload_call (execute_data=0x7f47a7814520,
return_value=0x7fffbfa65ab0) at /home/matej21/tmp/php-7.0.3/ext/spl/php_spl.c:429
#23 0x0000000000a36e0e in zend_call_function (fci=0x7fffbfa65af0, fci_cache=0x7fffbfa65ac0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:879
#24 0x0000000000a3758c in zend_lookup_class_ex (name=0x7f47a359bbc0, key=0x0, use_autoload=1) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1041
#25 0x0000000000a37685 in zend_lookup_class (name=0x7f47a359bbc0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:1062
#26 0x0000000000a6b557 in zif_class_exists (execute_data=0x7f47a78144b0,
return_value=0x7fffbfa65e50) at /home/matej21/tmp/php-7.0.3/Zend/zend_builtin_functions.c:1437
#27 0x0000000000a36e0e in zend_call_function (fci=0x7fffbfa65ea0, fci_cache=0x7fffbfa65e70) at
/home/matej21/tmp/php-7.0.3/Zend/zend_execute_API.c:879
#28 0x000000000088de93 in zif_array_map (execute_data=0x7f47a7814430, return_value=0x7f47a7814420)
at /home/matej21/tmp/php-7.0.3/ext/standard/array.c:5290
#29 0x0000000000aa99d0 in ZEND_DO_ICALL_SPEC_HANDLER () at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:586
#30 0x0000000000aa93ff in execute_ex (ex=0x7f47a7814030) at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:414
#31 0x0000000000aa9511 in zend_execute (op_array=0x7f47a7873000, return_value=0x0) at
/home/matej21/tmp/php-7.0.3/Zend/zend_vm_execute.h:458
#32 0x0000000000a4e394 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/matej21/tmp/php-7.0.3/Zend/zend.c:1427
#33 0x00000000009bb7a1 in php_execute_script (primary_file=0x7fffbfa683d0) at
/home/matej21/tmp/php-7.0.3/main/main.c:2484
#34 0x0000000000b1d368 in main (argc=4, argv=0x7fffbfa686c8) at
/home/matej21/tmp/php-7.0.3/sapi/fpm/fpm/fpm_main.c:1944
Previous Comments:
------------------------------------------------------------------------
[2016-02-05 13:47:32] vojtech dot kurka at gmail dot com
I think we're running into something related: We have a static testcase, that calls an API,
that takes a result from a database and uses json_encode() to turn it into JSON and send it back.
The testcase is called every 10 minutes in production to check that API is working. Randomly, that
tescase starts failing on an error (json_encode reports recursion detected). The dataset is still
the same. When we restart php70-php-fpm, everything is working again.
Update to PHP 7.0.3 didn't resolve this issue.
Our environment:
Centos 6, 2.6.32-573.12.1.el6.x86_64
PHP 7.0.3 (remi) with opcache
php70-php-fpm
Opcache config contains only these settings:
zend_extension=opcache.so
opcache.enable=1
opcache.memory_consumption=128
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=4000
opcache.blacklist_filename=/etc/opt/remi/php70/php.d/opcache*.blacklist
I think some fuzzy-testing for this issue would be useful. We are still trying to find a
reproducible testcase, but without any success.
We are running PHP7 and PHP5.5.32 in parallel in production and PHP5 is completely OK, no such
problems observed.
------------------------------------------------------------------------
[2016-02-02 21:52:11] iquito at gmx dot net
fast_shutdown was always set to 0 in my configuration.
------------------------------------------------------------------------
[2016-02-02 19:34:06] sroussey at gmail dot com
Try with fast_shutdown set to 0. This cleared up issues we had with string memory corruption.
------------------------------------------------------------------------
[2016-01-18 08:49:22] w1zzard at techpowerup dot com
I can confirm this issue.
Seeing it on PHP 7.0.2 from remi. Just like OP it happens roughly once a day.
Running inside Docker container.
------------------------------------------------------------------------
[2015-12-27 23:12:18] iquito at gmx dot net
I cannot edit the bug report / change the status, the error message
"You aren't allowed to change a bug to that state."
always appears, although I provide the correct password, and therefore I cannot submit anything with
the "Edit" method or provide "official" feedback. I therefore provided feedback
via Add Comment, which does not seem to count.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=71135
--
Edit this bug report at https://bugs.php.net/bug.php?id=71135&edit=1