Edit report at https://bugs.php.net/bug.php?id=71659&edit=1
ID: 71659
Comment by: nish dot aravamudan at canonical dot com
Reported by: nish dot aravamudan at canonical dot com
Summary: segmentation fault in pcre running twig tests
Status: Feedback
Type: Bug
Package: Reproducible crash
Operating System: Ubuntu 16.04
PHP Version: 7.0.3
Block user comment: N
Private report: N
New Comment:
Adding pcre.jit=0 to the invocation of the tests (-d parameter to phpunit) allows the test to
succeed.
Previous Comments:
------------------------------------------------------------------------
[2016-02-26 02:41:08] nish dot aravamudan at canonical dot com
I apologize, but I'm not a PHP developer. The twig testsuite is publicly available from github.
------------------------------------------------------------------------
[2016-02-25 07:24:21] laruence@php.net
Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves.
A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external
resources such as databases, etc. If the script requires a
database to demonstrate the issue, please make sure it creates
all necessary tables, stored procedures etc.
Please avoid embedding huge scripts into the report.
------------------------------------------------------------------------
[2016-02-24 21:39:08] nish dot aravamudan at canonical dot com
FYI, also reproduced with 7.0.4~rc1.
------------------------------------------------------------------------
[2016-02-24 21:18:16] ngompa13 at gmail dot com
I've been able to reproduce the issue on CentOS 7.2 with Remi's php70 SCL with PHP package
version 7.0.3-1.el7.remi.
------------------------------------------------------------------------
[2016-02-24 20:57:30] nish dot aravamudan at canonical dot com
Description:
------------
Ubuntu 16.04 is moving to PHP7.0 only, and we are hitting the following failures with the twig
test-suite:
1) Twig_Tests_IntegrationTest::testIntegration with data set #214 ('filters/last.test',
'"last" filter', '', array('\n{{ [1, 2, 3, 4]|last }}\n{{ {...ast
}}'), false, array(array('--DATA--\nreturn array('arr'
+=...4\n4\né', '\nreturn array('arr' => new Ar... 4)))\n',
'', '\n4\n4\n4\n4\né')))
"last" filter (in filters/last.test)
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
'4
4
4
4
-é'
+�'
/build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:219
/build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:62
2) Twig_Tests_IntegrationTest::testIntegration with data set #240 ('filters/first.test',
'"first" filter', '', array('\n{{ [1, 2, 3, 4]|first }}\n{{
...rst }}'), false, array(array('--DATA--\nreturn array('arr'
+=...1\n1\nÃ', '\nreturn array('arr' => new Ar... 4)))\n',
'', '\n1\n1\n1\n1\nÃ')))
"first" filter (in filters/first.test)
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
'1
1
1
1
-Ã'
+�'
/build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:219
/build/twig-0SRlZk/twig-1.23.1/lib/Twig/Test/IntegrationTestCase.php:62
I *believe* the differing character is the result of SUBSTITUTE on the string. That is neither here
nor there for this bug report, necessarily, but just context. OndÅej Surý recommended we try
and install php-mbstring, but that led to segmentation faults:
#0 __memcpy_avx_unaligned ()
at ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S:273
#1 0x00005555556798d8 in memcpy (__len=18446744073709551614,
__src=0x7fffed43e1fc, __dest=0x7fffed49e390)
at /usr/include/x86_64-linux-gnu/bits/string3.h:53
#2 zend_string_init (persistent=0, len=18446744073709551614,
str=0x7fffed43e1fc "\303\237\343\201\224a")
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_string.h:159
#3 php_pcre_split_impl (pce=pce@entry=0x555555d4aea0,
subject=0x7fffed43e1f8 "\303\251\303\204\303\237\343\201\224a",
subject_len=10, return_value=return_value@entry=0x7ffff381b240,
limit_val=-1, flags=<optimized out>)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/ext/pcre/php_pcre.c:1808
#4 0x000055555567a1eb in zif_preg_split (execute_data=<optimized out>,
return_value=0x7ffff381b240)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/ext/pcre/php_pcre.c:1721
#5 0x000055555579b58a in dtrace_execute_internal (
execute_data=<optimized out>, return_value=<optimized out>)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:107
#6 0x000055555582f5f0 in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:844
#7 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff381b070)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#8 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff381b070)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#9 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#10 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819ff0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#11 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819ff0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#12 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#13 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819e80)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#14 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819e80)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#15 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#16 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819db0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#17 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819db0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#18 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#19 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819ca0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#20 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819ca0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#21 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#22 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff38192e0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#23 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff38192e0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#24 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#25 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3819210)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#26 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3819210)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#27 0x000055555579d03c in zend_call_function (fci=fci@entry=0x7fffffff9ae0,
fci_cache=fci_cache@entry=0x7fffffff9ab0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_execute_API.c:860
#28 0x000055555569e042 in zim_reflection_method_invokeArgs (
execute_data=<optimized out>, return_value=0x7ffff3818e60)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/ext/reflection/php_reflection.c:3348
#29 0x000055555579b58a in dtrace_execute_internal (
execute_data=<optimized out>, return_value=<optimized out>)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:107
#30 0x000055555582f5f0 in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:844
#31 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3818c60)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#32 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3818c60)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#33 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#34 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3818470)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#35 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3818470)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#36 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#37 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3817880)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#38 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3817880)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#39 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#40 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3816e20)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#41 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3816e20)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#42 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#43 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3816840)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#44 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3816840)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#45 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#46 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3816260)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#47 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3816260)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#48 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#49 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3815c80)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#50 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3815c80)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#51 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#52 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814640)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#53 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3814640)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#54 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#55 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814220)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#56 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3814220)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#57 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#58 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814130)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#59 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3814130)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#60 0x000055555582f72d in ZEND_DO_FCALL_SPEC_HANDLER ()
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:800
#61 0x00005555557eaedb in execute_ex (ex=ex@entry=0x7ffff3814030)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:414
#62 0x000055555579b421 in dtrace_execute_ex (execute_data=0x7ffff3814030)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_dtrace.c:83
#63 0x000055555583e2b7 in zend_execute (
op_array=op_array@entry=0x7ffff3883000,
return_value=return_value@entry=0x0)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend_vm_execute.h:458
#64 0x00005555557ab6b3 in zend_execute_scripts (type=type@entry=8,
retval=retval@entry=0x0, file_count=file_count@entry=3)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/Zend/zend.c:1427
#65 0x000055555574c0c0 in php_execute_script (primary_file=0x7fffffffcb10)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/main/main.c:2484
#66 0x000055555583ff84 in do_cli (argc=4, argv=0x555555bab130)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/sapi/cli/php_cli.c:974
#67 0x00005555556364e4 in main (argc=4, argv=0x555555bab130)
at /build/php7.0-Y7XHJx/php7.0-7.0.3/sapi/cli/php_cli.c:1345
From a live gdb session:
(gdb) print subject
$3 = 0x7fffed43e1f8 "\303\251\303\204\303\237\343\201\224a"
(gdb) print offsets
$4 = (int *) 0x7fffffff9150
(gdb) print offsets[0]
$5 = 2
(gdb) print last_match
$6 = 0x7fffed43e1fc "\303\237\343\201\224a"
(gdb) print &subject[offsets[0]]-last_match
$7 = -2
This line (ext/pcre/php_pcre.c:1808):
ZVAL_STRINGL(&tmp, last_match, &subject[offsets[0]]-last_match);
is the culprit, but I don't know why. The last value is -2, as indicated above?
This code seems relatively unchanged compared to the PHP5 version I have handy, so I'm unsure
of what's happening.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71659&edit=1