From: nish dot aravamudan at canonical dot com
Operating system: Ubuntu 16.04
PHP version: 7.0.3
Package: Reproducible crash
Bug Type: Bug
Bug description:segmentation fault in pcre running twig tests
Description:
------------
Ubuntu 16.04 is moving to PHP7.0 only, and we are hitting the following
failures with the twig test-suite:
1) Twig_Tests_IntegrationTest::testIntegration with data set #214
('filters/last.test', '"last" filter', '', array('\n{{
[1, 2, 3, 4]|last
}}\n{{ {...ast }}'), false, array(array('--DATA--\nreturn array('arr'
+=...4\n4\né', '\nreturn array('arr' => new Ar... 4)))\n',
'',
'\n4\n4\n4\n4\né')))
"last" filter (in filters/last.test)
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
'4
4
4
4
-é'
+�'
/build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:219
/build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:62
2) Twig_Tests_IntegrationTest::testIntegration with data set #240
('filters/first.test', '"first" filter', '',
array('\n{{ [1, 2, 3,
4]|first }}\n{{ ...rst }}'), false, array(array('--DATA--\nreturn
array('arr'
+=...1\n1\nÃ', '\nreturn array('arr' => new Ar... 4)))\n',
'',
'\n1\n1\n1\n1\nÃ')))
"first" filter (in filters/first.test)
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
'1
1
1
1
-Ã'
+�'
/build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:219
/build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:62
I *believe* the differing character is the result of SUBSTITUTE on the
string. That is neither here nor there for this bug report, necessarily,
but just context. OndÅej Surý recommended we try and install
php-mbstring, but that led to segmentation faults:
#0 __memcpy_avx_unaligned ()
at ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S:273
#1 0x00005555556798d8 in memcpy (__len=18446744073709551614,
__src=0x7fffed43e1fc, __dest=0x7fffed49e390)
at /usr/include/x86_64-linux-gnu/bits/string3.h:53
#2 zend_string_init (persistent=0, len=18446744073709551614,
str=0x7fffed43e1fc "\303\237\343\201\224a")
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_string.h:159
#3 php_pcre_split_impl (pce=pce@entry=0x555555d4aea0,
subject=0x7fffed43e1f8 "\303\251\303\204\303\237\343\201\224a",
subject_len=10, return_value=return_value@entry=0x7ffff381b240,
limit_val=-1, flags=<optimized out>)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/ext/pcre/php_pcre.c:1808
#4 0x000055555567a1eb in zif_preg_split (execute_data=<optimized out>,
return_value=0x7ffff381b240)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/ext/pcre/php_pcre.c:1721
#5 0x000055555579b58a in dtrace_execute_internal (
execute_data=<optimized out>, return_value=<optimized out>)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:107
#6 0x000055555582f5f0 in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:844
#7 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff381b070)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#8 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff381b070)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#9 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#10 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819ff0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#11 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3819ff0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#12 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#13 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819e80)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#14 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3819e80)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#15 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#16 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819db0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#17 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3819db0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#18 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#19 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819ca0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#20 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3819ca0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#21 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#22 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff38192e0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#23 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff38192e0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#24 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#25 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819210)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#26 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3819210)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#27 0x000055555579d03c in zend_call_function
(fci=fci@entry=0x7fffffff9ae0,
fci_cache=fci_cache@entry=0x7fffffff9ab0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_execute_API.c:860
#28 0x000055555569e042 in zim_reflection_method_invokeArgs (
execute_data=<optimized out>, return_value=0x7ffff3818e60)
at
/build/php7.0-Y7XHJx/php7.0-7.0.3/ext/reflection/php_reflection.c:3348
#29 0x000055555579b58a in dtrace_execute_internal (
execute_data=<optimized out>, return_value=<optimized out>)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:107
#30 0x000055555582f5f0 in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:844
#31 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3818c60)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#32 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3818c60)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#33 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#34 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3818470)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#35 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3818470)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#36 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#37 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3817880)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#38 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3817880)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#39 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#40 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3816e20)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#41 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3816e20)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#42 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#43 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3816840)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#44 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3816840)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#45 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#46 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3816260)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#47 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3816260)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#48 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#49 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3815c80)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#50 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3815c80)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#51 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#52 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814640)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#53 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3814640)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#54 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#55 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814220)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#56 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3814220)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#57 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#58 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814130)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#59 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3814130)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#60 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#61 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814030)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#62 0x000055555579b421 in dtrace_execute_ex
(execute_data=0x7ffff3814030)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#63 0x000055555583e2b7 in zend_execute (
op_array=op_array@entry=0x7ffff3883000,
return_value=return_value@entry=0x0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:458
#64 0x00005555557ab6b3 in zend_execute_scripts (type=type@entry=8,
retval=retval@entry=0x0, file_count=file_count@entry=3)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend.c:1427
#65 0x000055555574c0c0 in php_execute_script
(primary_file=0x7fffffffcb10)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/main/main.c:2484
#66 0x000055555583ff84 in do_cli (argc=4, argv=0x555555bab130)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/sapi/cli/php_cli.c:974
#67 0x00005555556364e4 in main (argc=4, argv=0x555555bab130)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/sapi/cli/php_cli.c:1345
From a live gdb session:
(gdb) print subject
$3 = 0x7fffed43e1f8 "\303\251\303\204\303\237\343\201\224a"
(gdb) print offsets
$4 = (int *) 0x7fffffff9150
(gdb) print offsets[0]
$5 = 2
(gdb) print last_match
$6 = 0x7fffed43e1fc "\303\237\343\201\224a"
(gdb) print &subject[offsets[0]]-last_match
$7 = -2
This line (ext/pcre/php_pcre.c:1808):
ZVAL_STRINGL(&tmp, last_match, &subject[offsets[0]]-last_match);
is the culprit, but I don't know why. The last value is -2, as indicated
above?
This code seems relatively unchanged compared to the PHP5 version I have
handy, so I'm unsure of what's happening.
--
Edit bug report at https://bugs.php.net/bug.php?id=71659&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71659&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71659&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71659&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=71659&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=71659&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=71659&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=71659&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=71659&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=71659&r=support
Expected behavior: https://bugs.php.net/fix.php?id=71659&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=71659&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=71659&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=71659&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71659&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=71659&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=71659&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=71659&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71659&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=71659&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=71659&r=mysqlcfg