Bug #72144 [NEW]: _emalloc_24 crash on recursive call

From: php at abiusx dot com Operating system: Mac OS X 10.11 PHP version: 7.0.6 Package: *Programming Data Structures Bug Type: Bug Bug description:_emalloc_24 crash on recursive call Description: ------------ This bug is very hard to reproduce simplistically. It is deterministic and always happens on my PHP 7 (tested on both 7.0.5 and 7.0.6), but does not happen on PHP 5.4. PHP 7.0.6 --with-debug does not crash either. A core-dump backtrace is available below. Basically a recursive function, which passes around a lot of arrays and references, is crashing, very deep in the recursive part. Adding some heavy-duty code (like serialization of the array causing the crash) makes PHP crash sooner in the recursion. $ lldb -c /cores/core.99967 (lldb) target create --core "/cores/core.99967" warning: (x86_64) /cores/core.99967 load command 121 LC_SEGMENT_64 has a fileoff + filesize (0x29e73000) that extends beyond the end of the file (0x29e72000), the segment will be truncated to match warning: (x86_64) /cores/core.99967 load command 122 LC_SEGMENT_64 has a fileoff (0x29e73000) that extends beyond the end of the file (0x29e72000), ignoring this section Core file '/cores/core.99967' (x86_64) was loaded. (lldb) bt * thread #1: tid = 0x0000, 0x000000010200c267 phpd`_emalloc_24 + 52, stop reason = signal SIGSTOP * frame #0: 0x000000010200c267 phpd`_emalloc_24 + 52 frame #1: 0x000000010207dfe8 phpd`ZEND_SEND_REF_SPEC_VAR_HANDLER + 125 frame #2: 0x000000010207de47 phpd`ZEND_SEND_VAR_EX_SPEC_VAR_HANDLER + 82 frame #3: 0x0000000102069f10 phpd`execute_ex + 25 frame #4: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #5: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #6: 0x0000000102069f10 phpd`execute_ex + 25 frame #7: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #8: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #9: 0x0000000102069f10 phpd`execute_ex + 25 frame #10: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #11: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #12: 0x0000000102069f10 phpd`execute_ex + 25 frame #13: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #14: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #15: 0x0000000102069f10 phpd`execute_ex + 25 frame #16: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #17: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #18: 0x0000000102069f10 phpd`execute_ex + 25 frame #19: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #20: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #21: 0x0000000102069f10 phpd`execute_ex + 25 frame #22: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #23: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #24: 0x0000000102069f10 phpd`execute_ex + 25 frame #25: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #26: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #27: 0x0000000102069f10 phpd`execute_ex + 25 frame #28: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #29: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #30: 0x0000000102069f10 phpd`execute_ex + 25 frame #31: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #32: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #33: 0x0000000102069f10 phpd`execute_ex + 25 frame #34: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #35: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #36: 0x0000000102069f10 phpd`execute_ex + 25 frame #37: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #38: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #39: 0x0000000102069f10 phpd`execute_ex + 25 frame #40: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #41: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #42: 0x0000000102069f10 phpd`execute_ex + 25 frame #43: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #44: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #45: 0x0000000102069f10 phpd`execute_ex + 25 frame #46: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #47: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #48: 0x0000000102069f10 phpd`execute_ex + 25 frame #49: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #50: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #51: 0x0000000102069f10 phpd`execute_ex + 25 frame #52: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #53: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #54: 0x0000000102069f10 phpd`execute_ex + 25 frame #55: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #56: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #57: 0x0000000102069f10 phpd`execute_ex + 25 frame #58: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #59: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #60: 0x0000000102069f10 phpd`execute_ex + 25 frame #61: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #62: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #63: 0x0000000102069f10 phpd`execute_ex + 25 frame #64: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #65: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #66: 0x0000000102069f10 phpd`execute_ex + 25 frame #67: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #68: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #69: 0x0000000102069f10 phpd`execute_ex + 25 frame #70: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #71: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #72: 0x0000000102069f10 phpd`execute_ex + 25 frame #73: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #74: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #75: 0x0000000102069f10 phpd`execute_ex + 25 frame #76: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #77: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #78: 0x0000000102069f10 phpd`execute_ex + 25 frame #79: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #80: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #81: 0x0000000102069f10 phpd`execute_ex + 25 frame #82: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #83: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #84: 0x0000000102069f10 phpd`execute_ex + 25 frame #85: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #86: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #87: 0x0000000102069f10 phpd`execute_ex + 25 frame #88: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #89: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #90: 0x0000000102069f10 phpd`execute_ex + 25 frame #91: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #92: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #93: 0x0000000102069f10 phpd`execute_ex + 25 frame #94: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #95: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #96: 0x0000000102069f10 phpd`execute_ex + 25 frame #97: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #98: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #99: 0x0000000102069f10 phpd`execute_ex + 25 frame #100: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #101: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #102: 0x0000000102069f10 phpd`execute_ex + 25 frame #103: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #104: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #105: 0x0000000102069f10 phpd`execute_ex + 25 frame #106: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #107: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #108: 0x0000000102069f10 phpd`execute_ex + 25 frame #109: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #110: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #111: 0x0000000102069f10 phpd`execute_ex + 25 frame #112: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #113: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #114: 0x0000000102069f10 phpd`execute_ex + 25 frame #115: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #116: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #117: 0x0000000102069f10 phpd`execute_ex + 25 frame #118: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #119: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #120: 0x0000000102069f10 phpd`execute_ex + 25 frame #121: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #122: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #123: 0x0000000102069f10 phpd`execute_ex + 25 frame #124: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #125: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #126: 0x0000000102069f10 phpd`execute_ex + 25 frame #127: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #128: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #129: 0x0000000102069f10 phpd`execute_ex + 25 frame #130: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #131: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #132: 0x0000000102069f10 phpd`execute_ex + 25 frame #133: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #134: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #135: 0x0000000102069f10 phpd`execute_ex + 25 frame #136: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #137: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #138: 0x0000000102069f10 phpd`execute_ex + 25 frame #139: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #140: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #141: 0x0000000102069f10 phpd`execute_ex + 25 frame #142: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #143: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #144: 0x0000000102069f10 phpd`execute_ex + 25 frame #145: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #146: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #147: 0x0000000102069f10 phpd`execute_ex + 25 frame #148: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #149: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #150: 0x0000000102069f10 phpd`execute_ex + 25 frame #151: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #152: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #153: 0x0000000102069f10 phpd`execute_ex + 25 frame #154: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #155: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #156: 0x0000000102069f10 phpd`execute_ex + 25 frame #157: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #158: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #159: 0x0000000102069f10 phpd`execute_ex + 25 frame #160: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #161: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #162: 0x0000000102069f10 phpd`execute_ex + 25 frame #163: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #164: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #165: 0x0000000102069f10 phpd`execute_ex + 25 frame #166: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #167: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #168: 0x0000000102069f10 phpd`execute_ex + 25 frame #169: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #170: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #171: 0x0000000102069f10 phpd`execute_ex + 25 frame #172: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #173: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #174: 0x0000000102069f10 phpd`execute_ex + 25 frame #175: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #176: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #177: 0x0000000102069f10 phpd`execute_ex + 25 frame #178: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #179: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #180: 0x0000000102069f10 phpd`execute_ex + 25 frame #181: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #182: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #183: 0x0000000102069f10 phpd`execute_ex + 25 frame #184: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #185: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #186: 0x0000000102069f10 phpd`execute_ex + 25 frame #187: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #188: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #189: 0x0000000102069f10 phpd`execute_ex + 25 frame #190: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #191: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #192: 0x0000000102069f10 phpd`execute_ex + 25 frame #193: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #194: 0x000000010207cc78 phpd`ZEND_DO_FCALL_SPEC_HANDLER + 986 frame #195: 0x0000000102069f10 phpd`execute_ex + 25 frame #196: 0x000000010201e73d phpd`dtrace_execute_ex + 238 frame #197: 0x000000010206a142 phpd`zend_execute + 544 frame #198: 0x000000010202d6c2 phpd`zend_execute_scripts + 299 frame #199: 0x0000000101fd7cc4 phpd`php_execute_script + 804 frame #200: 0x00000001020b7aaa phpd`do_cli + 3699 frame #201: 0x00000001020b6aaa phpd`main + 1206 frame #202: 0x00007fff86d215ad libdyld.dylib`start + 1 (lldb) Test script: --------------- The code is huge and I could not simplify it by any means. It is performing a deep_copy of a huge PHP array, with a lot of references. I can provide the code in Github if needed, it is a private repo at the moment. The recursive function calling itself is: function &deep_copy(&$variable,&$object_pool=[],&$zval_pool=[],$depth=0,&$id_zvals=[]) and it crashes at: $t=&deep_copy($variable[$k],$object_pool,$zval_pool,$depth+1,$id_zvals); $id_zvals and $variable[$k] both cause the crash. Replacing the rest of the arguments (in call) with an empty array ($a=[]) will not prevent the crash, but replacing both $id_zvals and $variable[$k] will. $id_zvals has 181 members, all of which are references parts of the original $variable. Memory is not exhausted, about 40 MB is used and the machine has 24 GB (PHP's memlimit is unlimited). Expected result: ---------------- No crash. Actual result: -------------- Segfault -- Edit bug report at https://bugs.php.net/bug.php?id=72144&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72144&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72144&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72144&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72144&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72144&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72144&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72144&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72144&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72144&r=support Expected behavior: https://bugs.php.net/fix.php?id=72144&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72144&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72144&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72144&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72144&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72144&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72144&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72144&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72144&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72144&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72144&r=mysqlcfg