Bug #71930 [Opn->Csd]: _zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed

Edit report at https://bugs.php.net/bug.php?id=71930&edit=1 ID: 71930 Updated by: laruence@php.net Reported by: mbeccati@php.net Summary: _zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed -Status: Open +Status: Closed Type: Bug Package: Reproducible crash PHP Version: 7.0Git-2016-03-31 (Git) Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=5b1bb41c0b125fe9964abaa1d523ce2ba1823cf6 Log: Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)-&gt;gc.refcount &lt;= 1' failed) Previous Comments: ------------------------------------------------------------------------ [2016-03-31 10:07:17] mbeccati@php.net #0 0x00007ffff59b3cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 resultvar = 0 pid = 15991 selftid = 15991 #1 0x00007ffff59b70d8 in __GI_abort () at abort.c:89 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0x15b2450, sa_sigaction = 0x15b2450}, sa_mask = {__val = {291552, 1, 140737314276717, 4294967295, 140737313957091, 4294967296, 140737488341696, 4192, 140737240891392, 140737488341808, 0, 0, 0, 21474836480, 140737354100736, 140737315330096}}, sa_flags = 17364814, sa_restorer = 0x108f830 <__PRETTY_FUNCTION__.8742>} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007ffff59acb86 in __assert_fail_base (fmt=0x7ffff5afd830 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x108f74e "(arr)->gc.refcount <= 1", file=file@entry=0x108f700 "/home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c", line=line@entry=43, function=function@entry=0x108f830 <__PRETTY_FUNCTION__.8742> "_zval_dtor_func") at assert.c:92 str = 0x15b23c0 "php: /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c:43: _zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed.\n" total = 4096 #3 0x00007ffff59acc32 in __GI___assert_fail (assertion=0x108f74e "(arr)->gc.refcount <= 1", file=0x108f700 "/home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c", line=43, function=0x108f830 <__PRETTY_FUNCTION__.8742> "_zval_dtor_func") at assert.c:101 No locals. #4 0x0000000000a1dd77 in _zval_dtor_func (p=0x7ffff0adc360, __zend_filename=0x108f700 "/home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c", __zend_lineno=246) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c:43 arr = 0x7ffff0adc360 __PRETTY_FUNCTION__ = "_zval_dtor_func" #5 0x0000000000a1dbe8 in _zval_dtor (zvalue=0x7fffeeb63000, __zend_filename=0x108f700 "/home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c", __zend_lineno=246) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.h:44 No locals. #6 0x0000000000a1e4d8 in _zval_dtor_wrapper (zvalue=0x7fffeeb63000) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c:246 No locals. #7 0x0000000000a1d74e in zend_stack_clean (stack=0x1425c68 <executor_globals+712>, func=0xa1e4b4 <_zval_dtor_wrapper>, free_elements=1 '\001') at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_stack.c:156 i = 0 #8 0x0000000000a0832a in shutdown_executor () at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_execute_API.c:298 zeh = 0x1425c30 <executor_globals+656> __orig_bailout = 0x7fffffffe4d0 __bailout = {{__jmpbuf = {0, 8163182216280542960, 4398192, 140737488348800, 0, 0, 8163182216196656880, -8163183037063491856}, __mask_was_saved = 0, __saved_mask = {__val = {140737196851200, 140737488342576, 10412513, 10252836, 21125248, 12198296, 18446744073420021696, 140737488342640, 10605271, 0, 139646277132224, 10252836, 21125248, 140737488342656, 21125248, 140737488342656}}}} func = 0x7ffff1400000 ce = 0x0 #9 0x0000000000a2064b in zend_deactivate () at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend.c:967 No locals. #10 0x000000000098d741 in php_request_shutdown (dummy=0x0) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/main/main.c:1833 report_memleaks = 1 '\001' #11 0x0000000000ae2c55 in do_cli (argc=3, argv=0x14299f0) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/sapi/cli/php_cli.c:1141 c = -1 file_handle = {handle = {fd = -246976496, fp = 0x7ffff1477010, stream = {handle = 0x7ffff1477010, isatty = 0, mmap = {len = 735, pos = 0, map = 0x7ffff7ff4000, buf = 0x7ffff7ff4013 "-\224\064n-\224\064", old_handle = 0x15a6ee0, old_closer = 0xa462a3 <zend_stream_stdio_closer>}, reader = 0xa46274 <zend_stream_stdio_reader>, fsizer = 0xa462d4 <zend_stream_stdio_fsizer>, closer = 0xa463e6 <zend_stream_mmap_closer>}}, filename = 0x1429a50 "bin/phpspec", opened_path = 0x0, type = ZEND_HANDLE_MAPPED, free_filename = 0 '\000'} behavior = 1 reflection_what = 0x0 request_started = 1 exit_status = 0 php_optarg = 0x0 orig_optarg = 0x0 php_optind = 2 orig_optind = 1 exec_direct = 0x0 exec_run = 0x0 exec_begin = 0x0 exec_end = 0x0 arg_free = 0x1429a50 "bin/phpspec" arg_excp = 0x14299f8 script_file = 0x1429a50 "bin/phpspec" translated_path = 0x15a7480 "/home/atlassian/bamboo/xml-data/build-dir/PHP-PHPSPEC-PHP70/bin/phpspec" interactive = 0 lineno = 2 param_error = 0x0 hide_argv = 0 #12 0x0000000000ae34ca in main (argc=3, argv=0x14299f0) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/sapi/cli/php_cli.c:1344 __orig_bailout = 0x0 __bailout = {{__jmpbuf = {0, 8163182217526251248, 4398192, 140737488348800, 0, 0, 8163182217578680048, -8163182954876629264}, __mask_was_saved = 0, __saved_mask = {__val = {140737488348464, 4131212846, 4301179, 4294967295, 140737351947607, 140737313821096, 140737354025456, 140733193388033, 140737313801896, 1, 11457293, 140737488348808, 0, 11457216, 4398192, 140737488348800}}}} c = -1 exit_status = 0 module_started = 1 sapi_started = 1 php_optarg = 0x0 php_optind = 1 use_extended_info = 0 ini_path_override = 0x0 ini_entries = 0x1429cb0 "html_errors=0\nregister_argc_argv=1\nimplicit_flush=1\noutput_buffering=0\nmax_execution_time=0\nmax_input_time=-1\n" ini_entries_len = 110 ini_ignore = 0 sapi_module = 0x13ffb20 <cli_sapi_module> ------------------------------------------------------------------------ [2016-03-31 10:02:18] nikic@php.net Can you please provide the backtrace for this assertion failure? That would be "bt" in gdb. ------------------------------------------------------------------------ [2016-03-31 09:29:22] mbeccati@php.net Description: ------------ I've just re-enabled php7 and master daily builds of phpspec and I am getting an assertion failure. This was the first run in a long time, so I can't tell how recent is the commit that's responsible for the failure on both 7.0 and 7.1. Test script: --------------- git clone git@github.com:phpspec/phpspec.git cd phpspec composer update --prefer-dist php bin/phpspec run Expected result: ---------------- no assertion failure Actual result: -------------- php: /.../Zend/zend_variables.c:43: _zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed. Program received signal SIGABRT, Aborted. 0x00007ffff59b3cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) (gdb) frame 4 #4 0x0000000000a1dd77 in _zval_dtor_func (p=0x7ffff0adc360, __zend_filename=0x108f700 "/.../Zend/zend_variables.c", __zend_lineno=246) at /.../Zend/zend_variables.c:43 43 ZEND_ASSERT(GC_REFCOUNT(arr) <= 1); (gdb) print *arr $1 = {gc = {refcount = 783, u = {v = {type = 7 '\a', flags = 0 '\000', gc_info = 51251}, type_info = 3358785543}}, u = {v = {flags = 30 '\036', nApplyCount = 0 '\000', nIteratorsCount = 0 '\000', reserve = 0 '\000'}, flags = 30}, nTableMask = 4294967294, arData = 0x7ffff0cf4908, nNumUsed = 2, nNumOfElements = 2, nTableSize = 8, nInternalPointer = 0, nNextFreeElement = 2, pDestructor = 0xa1e500 <_zval_ptr_dtor_wrapper>} (gdb) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=71930&edit=1