Bug #71973 [NEW]: Segfault in garbage collector

From: peters at yandex dot ru Operating system: Linux PHP version: 7.0.5 Package: Scripting Engine problem Bug Type: Bug Bug description:Segfault in garbage collector Description: ------------ Segmentation fault happens when grabage collector tries to clean up doubly linked list like structure of objects. Initially we've caught this bug when tried to run a test from lrucache/lrucache package using php 7. Then I've managed to create a minimal reproducible example, which leads to segfault in php 5.6, php 7.0.5 on different linux systems (ubuntu, fedora, centos) Test script: --------------- <?php // Whether segfault will happen depends on number of cycles, 1M should be enough for all systems class Node { public $next; public $previous; } $head = new Node(); $tail = new Node(); $head->next = $tail; $tail->previous = $head; for ($i = 0; $i < 1000000; $i++) { $node = new Node(); $node->previous = $head; $node->next = $head->next; $node->next->previous = $node; $head->next = $node; } Expected result: ---------------- Script should exit silently whithout errors Actual result: -------------- Segmentation fault Backtrace ---- #0 0x0000000000a85809 in gc_mark_grey (ref=<error reading variable: Cannot access memory at address 0x7fffff7fefe8>) at /home/petr/build/php-7.0.5/Zend/zend_gc.c:410 #1 0x0000000000a859a0 in gc_mark_grey (ref=0x7ffff030c310) at /home/petr/build/php-7.0.5/Zend/zend_gc.c:444 #2 0x0000000000a859a0 in gc_mark_grey (ref=0x7ffff030c380) at /home/petr/build/php-7.0.5/Zend/zend_gc.c:444 #3 0x0000000000a859a0 in gc_mark_grey (ref=0x7ffff030c3f0) at /home/petr/build/php-7.0.5/Zend/zend_gc.c:444 #4 0x0000000000a859a0 in gc_mark_grey (ref=0x7ffff030c460) at /home/petr/build/php-7.0.5/Zend/zend_gc.c:444 #5 0x0000000000a859a0 in gc_mark_grey (ref=0x7ffff030c4d0) at /home/petr/build/php-7.0.5/Zend/zend_gc.c:444 ........ ........ #65451 0x0000000000a859a0 in gc_mark_grey (ref=0x7fffebaca3f0) at /home/petr/build/php-7.0.5/Zend/zend_gc.c:444 #65452 0x0000000000a859a0 in gc_mark_grey (ref=0x7fffebaca460) at /home/petr/build/php-7.0.5/Zend/zend_gc.c:444 #65453 0x0000000000a85cb3 in gc_mark_roots () at /home/petr/build/php-7.0.5/Zend/zend_gc.c:531 #65454 0x0000000000a86d8e in zend_gc_collect_cycles () at /home/petr/build/php-7.0.5/Zend/zend_gc.c:1003 #65455 0x0000000000a85221 in gc_possible_root (ref=0x7fffebaca540) at /home/petr/build/php-7.0.5/Zend/zend_gc.c:243 #65456 0x0000000000aa6887 in zend_assign_to_variable (variable_ptr=0x7ffff02130c0, value=0x7ffff0213170, value_type=4 '\004') at /home/petr/build/php-7.0.5/Zend/zend_execute.h:109 #65457 0x0000000000af9ad7 in ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (execute_data=0x7ffff0213030) at /home/petr/build/php-7.0.5/Zend/zend_vm_execute.h:33475 #65458 0x0000000000aaec50 in execute_ex (ex=0x7ffff0213030) at /home/petr/build/php-7.0.5/Zend/zend_vm_execute.h:417 #65459 0x0000000000aaed7a in zend_execute (op_array=0x7ffff0285000, return_value=0x7fffffffc980) at /home/petr/build/php-7.0.5/Zend/zend_vm_execute.h:458 #65460 0x0000000000a3c986 in zend_eval_stringl (str=0x146d180 "class Node {\n public $next;\n public $previous;\n}\n$head = new Node();\n$tail = new Node();\n$head->next = $tail;\n$tail->previous = $head;\nfor ($i = 0; $i < 1000000; $i++) {\n $node = "..., str_len=349, retval_ptr=0x0, string_name=0x10d1744 "Command line code") at /home/petr/build/php-7.0.5/Zend/zend_execute_API.c:1132 #65461 0x0000000000a3cb66 in zend_eval_stringl_ex (str=0x146d180 "class Node {\n public $next;\n public $previous;\n}\n$head = new Node();\n$tail = new Node();\n$head->next = $tail;\n$tail->previous = $head;\nfor ($i = 0; $i < 1000000; $i++) {\n $node = "..., str_len=349, retval_ptr=0x0, string_name=0x10d1744 "Command line code", handle_exceptions=1) at /home/petr/build/php-7.0.5/Zend/zend_execute_API.c:1173 #65462 0x0000000000a3cc01 in zend_eval_string_ex (str=0x146d180 "class Node {\n public $next;\n public $previous;\n}\n$head = new Node();\n$tail = new Node();\n$head->next = $tail;\n$tail->previous = $head;\nfor ($i = 0; $i < 1000000; $i++) {\n $node = "..., retval_ptr=0x0, string_name=0x10d1744 "Command line code", handle_exceptions=1) at /home/petr/build/php-7.0.5/Zend/zend_execute_API.c:1184 #65463 0x0000000000b1a32d in do_cli (argc=3, argv=0x146d110) at /home/petr/build/php-7.0.5/sapi/cli/php_cli.c:1005 #65464 0x0000000000b1b373 in main (argc=3, argv=0x146d110) at /home/petr/build/php-7.0.5/sapi/cli/php_cli.c:1344 ----- -- Edit bug report at https://bugs.php.net/bug.php?id=71973&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71973&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71973&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71973&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71973&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71973&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71973&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71973&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71973&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71973&r=support Expected behavior: https://bugs.php.net/fix.php?id=71973&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71973&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71973&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71973&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71973&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71973&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71973&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71973&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71973&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71973&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71973&r=mysqlcfg