Bug #72029 [Fbk->NoF]: zend_hash_destroy crashing apache service

Edit report at https://bugs.php.net/bug.php?id=72029&edit=1 ID: 72029 Updated by: php-bugs@lists.php.net Reported by: diprajkuwar at gmail dot com Summary: zend_hash_destroy crashing apache service -Status: Feedback +Status: No Feedback Type: Bug Package: Reproducible crash Operating System: Windows Server 2012 PHP Version: Irrelevant Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2016-05-03 11:14:36] ab@php.net Thanks for the report. Were it possible to extract some short reproduce code? From the backtrace you've posted, it is related to the iconv extension. Possibyly some iconv stream filter, etc.? Thanks. ------------------------------------------------------------------------ [2016-04-15 10:02:31] diprajkuwar at gmail dot com Description: ------------ I am using Apache 2.4.17 and PHP 7.0.0 ( thread safe ) all 64 bit on windows server 2012 and php is being confiugred as the apache module. Recently I noticed that my apache process crashes frequently, so i monitored the logs and using windbg tool and crash dump we found below details ----------------------- ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* DUMP_CLASS: 2 DUMP_QUALIFIER: 400 CONTEXT: (.ecxr) rax=0000000a3cf3d698 rbx=00000000c0000374 rcx=00007ffe3397a000 rdx=0000000000000000 rsi=0000000000000000 rdi=00007ffe35e7ed40 rip=00007ffe35e41b70 rsp=0000000a3cf3db30 rbp=0000000000000000 r8=0000000000000003 r9=00007ffe35e7eda8 r10=00007ffe35da3dc7 r11=0000000000000000 r12=0000000000000000 r13=0000000000000000 r14=0000000000000008 r15=0000000000000001 iopl=0 nv up ei pl nz na pe nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202 ntdll!RtlReportCriticalFailure+0x8c: 00007ffe35e41b70 eb00 jmp ntdll!RtlReportCriticalFailure+0x8e (00007ffe35e41b72) Resetting default scope FAULTING_IP: ntdll!RtlReportCriticalFailure+8c 00007ffe35e41b70 eb00 jmp ntdll!RtlReportCriticalFailure+0x8e (00007ffe35e41b72) EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 00007ffe35e41b70 (ntdll!RtlReportCriticalFailure+0x000000000000008c) ExceptionCode: c0000374 ExceptionFlags: 00000001 NumberParameters: 1 Parameter[0]: 00007ffe35e7ed40 PROCESS_NAME: httpd.exe ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted. EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted. EXCEPTION_CODE_STR: c0000374 EXCEPTION_PARAMETER1: 00007ffe35e7ed40 WATSON_BKT_PROCSTAMP: 57039cd6 WATSON_BKT_PROCVER: 2.4.20.0 PROCESS_VER_PRODUCT: Apache HTTP Server WATSON_BKT_MODULE: ntdll.dll WATSON_BKT_MODSTAMP: 56951674 WATSON_BKT_MODOFFSET: f1b70 WATSON_BKT_MODVER: 6.3.9600.18194 MODULE_VER_PRODUCT: Microsoft® Windows® Operating System BUILD_VERSION_STRING: 6.3.9600.17415 (winblue_r4.141028-1500) MODLIST_WITH_TSCHKSUM_HASH: 79305b621530bc5936373f698644f46e8a6553eb MODLIST_SHA1_HASH: b9551ed0f2752f1cb445a13d3f9d6c6b3fbcaa21 NTGLOBALFLAG: 0 APPLICATION_VERIFIER_FLAGS: 0 PRODUCT_TYPE: 3 SUITE_MASK: 272 DUMP_FLAGS: 8000c07 DUMP_TYPE: 0 APP: httpd.exe ANALYSIS_SESSION_HOST: GRC7-UAT-KBOX1 ANALYSIS_SESSION_TIME: 04-15-2016 02:30:30.0309 ANALYSIS_VERSION: 10.0.10586.567 amd64fre THREAD_ATTRIBUTES: LAST_CONTROL_TRANSFER: from 00007ffe35e44db2 to 00007ffe35e41b70 FAULTING_THREAD: ffffffff THREAD_SHA1_HASH_MOD_FUNC: 64e2788a1e73f7e49b0b0fd2452b91f86267cd91 THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 30f877e44f24ff3ed9b2116d8543c2340c2c0b05 OS_LOCALE: ENU PROBLEM_CLASSES: ACTIONABLE_HEAP_CORRUPTION Tid [0x890] Frame [0x02]: ntdll!RtlpLogHeapFailure String [heap_failure_block_not_busy] Failure Bucketing DOUBLE_FREE Tid [0x890] Frame [0x02]: ntdll!RtlpLogHeapFailure BUGCHECK_STR: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy_DOUBLE_FREE DEFAULT_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy STACK_TEXT: 00007ffe35e7eda8 00007ffe35dfa56f ntdll!RtlFreeHeap+0x74eff 00007ffe35e7edb0 00007ffe2d74419b ucrtbase!free+0x1b 00007ffe35e7edb8 00007ffe16eb565f php7ts!zend_hash_destroy+0x5f 00007ffe35e7edc0 00007ffe172330d8 php7ts!libiconv_set_relocation_prefix+0x10b38 00007ffe35e7edc8 00007ffe16ebdedc php7ts!destroy_op_array+0x3ec 00007ffe35e7edd0 00007ffe16eb9934 php7ts!execute_ex+0x44 00007ffe35e7edd8 00007ffe16ee48b8 php7ts!zend_execute+0x1e8 00007ffe35e7ede0 00007ffe16ee458b php7ts!zend_execute_scripts+0x13b 00007ffe35e7ede8 00007ffe16ee43b6 php7ts!php_execute_script+0x4c6 00007ffe35e7edf0 00007ffe2f943c19 php7apache2_4+0x3c19 00007ffe35e7edf8 0000000068bbe415 libhttpd!ap_run_handler+0x35 00007ffe35e7ee00 0000000068bbd270 libhttpd!ap_invoke_handler+0x110 00007ffe35e7ee08 0000000068bb9a86 libhttpd!ap_internal_redirect+0x36 00007ffe35e7ee10 0000000068975258 mod_rewrite+0x5258 00007ffe35e7ee18 0000000068bbe415 libhttpd!ap_run_handler+0x35 00007ffe35e7ee20 0000000068bbd270 libhttpd!ap_invoke_handler+0x110 00007ffe35e7ee28 0000000068bb9a86 libhttpd!ap_internal_redirect+0x36 00007ffe35e7ee30 0000000068975258 mod_rewrite+0x5258 00007ffe35e7ee38 0000000068bbe415 libhttpd!ap_run_handler+0x35 00007ffe35e7ee40 0000000068bbd270 libhttpd!ap_invoke_handler+0x110 00007ffe35e7ee48 0000000068bb9d3a libhttpd!ap_internal_redirect_handler+0x29a 00007ffe35e7ee50 0000000068bb9dc7 libhttpd!ap_process_request+0x17 00007ffe35e7ee58 0000000068bb3b2f libhttpd!ap_byterange_filter+0x152f 00007ffe35e7ee60 0000000068bc11d5 libhttpd!ap_run_process_connection+0x35 00007ffe35e7ee68 0000000068bd0f14 libhttpd!ap_run_generate_log_id+0x3f24 00007ffe35e7ee70 00007ffe338613d2 kernel32!BaseThreadInitThunk+0x22 00007ffe35e7ee78 00007ffe35d654e4 ntdll!RtlUserThreadStart+0x34 STACK_COMMAND: dps 7ffe35e7eda8 ; kb THREAD_SHA1_HASH_MOD: 551070382f5ec06819b0d0fe3ecbf1630b278e84 FOLLOWUP_IP: php7ts!zend_hash_destroy+5f 00007ffe`16eb565f 488b4f18 mov rcx,qword ptr [rdi+18h] FAULT_INSTR_CODE: 184f8b48 SYMBOL_STACK_INDEX: 2 SYMBOL_NAME: php7ts!zend_hash_destroy+5f FOLLOWUP_NAME: MachineOwner MODULE_NAME: php7ts IMAGE_NAME: php7ts.dll DEBUG_FLR_IMAGE_TIMESTAMP: 5660848c FAILURE_BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy_c0000374_php7ts.dll!zend_hash_destroy BUCKET_ID: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy_DOUBLE_FREE_php7ts!zend_hash_destroy+5f PRIMARY_PROBLEM_CLASS: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy_DOUBLE_FREE_php7ts!zend_hash_destroy+5f BUCKET_ID_OFFSET: 5f BUCKET_ID_MODULE_STR: php7ts BUCKET_ID_MODTIMEDATESTAMP: 5660848c BUCKET_ID_MODCHECKSUM: 820932 BUCKET_ID_MODVER_STR: 7.0.0.0 BUCKET_ID_PREFIX_STR: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy_DOUBLE_FREE_ FAILURE_PROBLEM_CLASS: ACTIONABLE_HEAP_CORRUPTION_heap_failure_block_not_busy FAILURE_EXCEPTION_CODE: c0000374 FAILURE_IMAGE_NAME: php7ts.dll FAILURE_FUNCTION_NAME: zend_hash_destroy BUCKET_ID_FUNCTION_STR: zend_hash_destroy FAILURE_SYMBOL_NAME: php7ts.dll!zend_hash_destroy WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/httpd.exe/2.4.20.0/57039cd6/ntdll.dll/6.3.9600.18194/56951674/c0000374/000f1b70.htm?Retriage=1 TARGET_TIME: 2016-04-15T06:40:14.000Z OSBUILD: 9600 OSSERVICEPACK: 17415 SERVICEPACK_NUMBER: 0 OS_REVISION: 0 OSPLATFORM_TYPE: x64 OSNAME: Windows 8.1 OSEDITION: Windows 8.1 Server TerminalServer SingleUserTS USER_LCID: 0 OSBUILD_TIMESTAMP: 2014-10-28 19:45:30 BUILDDATESTAMP_STR: 141028-1500 BUILDLAB_STR: winblue_r4 BUILDOSVER_STR: 6.3.9600.17415 ANALYSIS_SESSION_ELAPSED_TIME: 1e65 ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:actionable_heap_corruption_heap_failure_block_not_busy_c0000374_php7ts.dll!zend_hash_destroy FAILURE_ID_HASH: {6a976e9d-35d4-5578-a07f-862eacf9ba57} Followup: MachineOwner --------- ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72029&edit=1