Edit report at https://bugs.php.net/bug.php?id=72257&edit=1
ID: 72257
User updated by: jccgls001 at 126 dot com
Reported by: jccgls001 at 126 dot com
Summary: "get_defined_constants(true)" core dump
-Status: Feedback
+Status: Open
Type: Bug
Package: Scripting Engine problem
Operating System: linux 2.6
PHP Version: 7.0.6
Block user comment: N
Private report: N
New Comment:
I try my best to debug code with:
gdb ./php -n -r "get_defined_constants(true);"
and set breakpoint to see why module_names[1]=0x0
-----------------------------------------------------------
(gdb) b zend_builtin_functions.c :2198
Breakpoint 1, zif_get_defined_constants (execute_data=0x7ffff495a0b0, return_value=0x7ffff495a0a0)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_builtin_functions.c:2198
2198 int i = 1;
(gdb) n
2203 module_names[0] = "internal"; <------ Important
(gdb) p module_names[0]
$1 = 0x134dc1e "internal"
in this place, module_names[0] has assigned to "internal", and then:
(gdb) n
0x0000000000a6511c in zif_get_defined_constants (execute_data=0x7ffff495a0b0,
return_value=0x7ffff495a0a0)
(gdb) n
2205 module_names[module->module_number] = (char *)module->name;
(gdb) p module->name
$2 = 0x134d795 "Core"
(gdb) p module->module_number <------ Important, number is 0, but 0 is "internal"
$3 = 0
I find "Core" module's number is 0, this means it will rewrite "internal",
and then the next module "date":
2204 ZEND_HASH_FOREACH_PTR(&module_registry, module) {
(gdb)
0x0000000000a6511c in zif_get_defined_constants (execute_data=0x7ffff495a0b0,
return_value=0x7ffff495a0a0)
(gdb)
2205 module_names[module->module_number] = (char *)module->name;
(gdb) p module->name
$5 = 0xde2964 "date"
(gdb) p module->module_number
$6 = 2
module "data" number is 2! This make me trouble, why "Core" is 0 but
"data" is 2. To make this problem clearly, i continue debug code ...
------------------------------------------------
At last, I find the place to assign "Core" module_number. in zend_startup functions, zend
engine will load builtin module "Core", these code are:
Breakpoint 1, zend_startup_builtin_functions () at
/home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_builtin_functions.c:362
362 zend_builtin_module.module_number = 0;
(gdb) l
357 };
358 /* }}} */
359
360 int zend_startup_builtin_functions(void) /* {{{ */
361 {
362 zend_builtin_module.module_number = 0;
363 zend_builtin_module.type = MODULE_PERSISTENT;
364 return (EG(current_module) = zend_register_module_ex(&zend_builtin_module)) == NULL ?
FAILURE : SUCCESS;
365 }
366 /* }}} */
as we can see, "Core" module_number assign to 0. Then i debug other module load process
and find:
(gdb) b zend_API.c:2050
Breakpoint 2 at 0xa3c5ed: file
/home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_API.c, line 2050.
(gdb) c
Continuing.
Breakpoint 2, zend_register_internal_module (module=0x165ac20 <date_module_entry>) at
/home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_API.c:2050
2050 module->module_number = zend_next_free_module();
(gdb) p module->name
$1 = 0xde2964 "date"
in these codes, other module get number by "zend_next_free_module()", and i step the code:
(gdb) step
zend_next_free_module () at
/home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_API.c:2643
2643 return zend_hash_num_elements(&module_registry) + 1;
(gdb) p module_registry.nNumOfElements
$2 = 1
the result is, this will return 2 but not 1. Because module_registry contains "Core".
I think the problem is come from here, which "Core" module_number don't use
"zend_next_free_module()" but direct assign 0. This will lead other module_name calculate
error.
---------------------------------------------------------------------
Finally, "Core" module_number = 0, but "data" module_number = 2, so
module_names[1]=0x0, this will lead core dump:
#1 0x0000000000a652b6 in zif_get_defined_constants (execute_data=0x7ffff76120a0,
return_value=0x7ffff7612090)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_builtin_functions.c:2227
2227 add_assoc_zval(return_value, module_names[module_number], &modules[module_number]);
(gdb) p module_names[module_number]
$1 = 0x0
(gdb) p module_number
$2 = 1
add_assoc_zval expand to add_assoc_zval_ex(__arg, __key, strlen(__key), __value), which strlen(0x0)
will make core dump.
-----------------------------------------------------------------------
by the way, i add USE_ZEND_ALLOC=0 to see why it can run:
Breakpoint 1, zif_get_defined_constants (execute_data=0x7ffff495a0b0, return_value=0x7ffff495a0a0)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_builtin_functions.c:2227
2227 add_assoc_zval(return_value, module_names[module_number], &modules[module_number]);
(gdb) p module_number
$2 = 1
(gdb) p module_names[module_number]
$3 = 0x302b130b38 "(\v\023+0" <-------- may be USE_ZEND_ALLOC=0 make this value not
0x0
Previous Comments:
------------------------------------------------------------------------
[2016-05-30 13:47:13] bwoebi@php.net
I have no idea how this can happen. PHP_VERSION is defined at main.c:2107 (in current 7.0 tree)
REGISTER_MAIN_STRINGL_CONSTANT() is specifying module_number 0.
In case you have enough gdb experience, may you please set a breakpoint there, step a bit forward
until allocation of the zend_constant and set a watchpoint on its module number.
In case you don't, may you please provide someone of us ssh access able to execute gdb with
your php build (a direct email with credentials) so that we can investigate?
Else I don't see much we can do here...
------------------------------------------------------------------------
[2016-05-30 13:05:56] jccgls001 at 126 dot com
by the way, f 1 locate code :
#1 0x0000000000a652b6 in zif_get_defined_constants (execute_data=0x7ffff7612120,
return_value=0x7ffff7612090)
at
/home/users/lvshun_iwm/php7_odp/trunk/php/.tmp/build/php-7.0.6/Zend/zend_builtin_functions.c:2227
2227 add_assoc_zval(return_value, module_names[module_number], &modules[module_number]);
(gdb) list
2222 module_number = val->module_number;
2223 }
2224
2225 if (Z_TYPE(modules[module_number]) == IS_UNDEF) {
2226 array_init(&modules[module_number]);
2227 add_assoc_zval(return_value, module_names[module_number], &modules[module_number]);
2228 }
2229
2230 ZVAL_DUP(&const_val, &val->value);
2231 zend_hash_add_new(Z_ARRVAL(modules[module_number]), val->name, &const_val);
------------------------------------------------------------------------
[2016-05-30 13:02:57] jccgls001 at 126 dot com
ok and i find module_names[1] is uninitailized value...
(gdb) p (char*)module_names[0] <------- this may âinternalâ ?
$1 = 0x134d795 "Core"
(gdb) p (char*)module_names[1] <------- problem module, may 'Core' but null
$2 = 0x0
(gdb) p (char*)module_names[2]
$3 = 0xde2964 "date"
(gdb) p (char*)module_number
$4 = 0x1 <error: Cannot access memory at address 0x1>
(gdb) p (char*)val->name->val
$5 = 0x17ecc08 "PHP_VERSION"
------------------------------------------------------------------------
[2016-05-30 12:46:52] bwoebi@php.net
Well, module_number 1 should be unused.
Can you please give us the faulty constant name with the bad module number?
f 1
p (char*)val->name->val
------------------------------------------------------------------------
[2016-05-30 05:56:47] jccgls001 at 126 dot com
I find when i add USE_ZEND_ALLOC=0 the function run successful
--------------------------------------------
these info are created by command without USE_ZEND_ALLOC=0:
gdb --args ./php -n -r "var_dump(get_defined_constants(true));"
(gdb) bt full
#0 0x000000302af6ff40 in ?? ()
No symbol table info available.
#1 0x0000000000a652b6 in zif_get_defined_constants (execute_data=0x7ffff7612120,
return_value=0x7ffff7612090)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_builtin_functions.c:2227
_z = 0x1901690
_p = 0x1901690
_end = 0x190f2b0
val = 0x17ec910
modules = 0x7ffff7676000
const_val = {value = {lval = 2, dval = 9.8813129168249309e-324, counted = 0x2, str = 0x2,
arr = 0x2, obj = 0x2, res = 0x2,
ref = 0x2, ast = 0x2, zv = 0x2, ptr = 0x2, ce = 0x2, func = 0x2, ww = {w1 = 2, w2 = 0}},
u1 = {v = {type = 1 '\001',
type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0
'\000'}, type_info = 1}, u2 = {var_flags = 0, next = 0,
cache_slot = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0}}
module = 0x17df330
i = 41
module_number = 1
module_names = 0x7ffff7679000
categorize = 1 '\001'
#2 0x0000000000ab1781 in ZEND_DO_ICALL_SPEC_HANDLER (execute_data=0x7ffff7612030)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_vm_execute.h:586
opline = 0x7ffff7662220
call = 0x7ffff7612120
fbc = 0x17e9700
ret = 0x7ffff7612090
#3 0x0000000000ab04bc in execute_ex (ex=0x7ffff7612030)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_vm_execute.h:417
ret = 0
execute_data = 0x7ffff7612030
#4 0x0000000000ab0c66 in zend_execute (op_array=0x7ffff76620e0, return_value=0x7fffffffcdf0)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_vm_execute.h:458
execute_data = 0x7ffff7612030
#5 0x0000000000a18f78 in zend_eval_stringl (str=0x17d4d90
"var_dump(get_defined_constants(true));", str_len=38, retval_ptr=0x0,
string_name=0x1353fcc "Command line code")
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_execute_API.c:1135
__orig_bailout = 0x7fffffffe050
__bailout = {{__jmpbuf = {0, 140737488342688, 14558992, 140737488348272, 0, 0,
140737488342256, 10587994},
__mask_was_saved = 0, __saved_mask = {__val = {140737488342432, 14558992, 10461214, 0,
26465744, 0, 140737488342608,
140737488342800, 11965133, 18446744073565204544, 1125281431552, 26465744, 26465744,
1129432048064, 26465696,
26465696}}}}
local_retval = {value = {lval = 26465648, dval = 1.3075767471727095e-316, counted =
0x193d570, str = 0x193d570,
arr = 0x193d570, obj = 0x193d570, res = 0x193d570, ref = 0x193d570, ast = 0x193d570, zv
= 0x193d570, ptr = 0x193d570,
ce = 0x193d570, func = 0x193d570, ww = {w1 = 26465648, w2 = 0}}, u1 = {v = {type = 0
'\000', type_flags = 0 '\000',
const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 0}, u2 =
{var_flags = 0, next = 0, cache_slot = 0,
lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0}}
pv = {value = {lval = 140737343656320, dval = 6.9533486587541203e-310, counted =
0x7ffff7601180, str = 0x7ffff7601180,
arr = 0x7ffff7601180, obj = 0x7ffff7601180, res = 0x7ffff7601180, ref = 0x7ffff7601180,
ast = 0x7ffff7601180,
zv = 0x7ffff7601180, ptr = 0x7ffff7601180, ce = 0x7ffff7601180, func = 0x7ffff7601180,
ww = {w1 = 4150268288,
w2 = 32767}}, u1 = {v = {type = 6 '\006', type_flags = 20 '\024',
const_flags = 0 '\000', reserved = 0 '\000'},
type_info = 5126}, u2 = {var_flags = 0, next = 0, cache_slot = 0, lineno = 0, num_args =
0, fe_pos = 0,
fe_iter_idx = 0}}
new_op_array = 0x7ffff76620e0
original_compiler_options = 2
retval = 26465744
#6 0x0000000000a19135 in zend_eval_stringl_ex (str=0x17d4d90
"var_dump(get_defined_constants(true));", str_len=38, retval_ptr=0x0,
string_name=0x1353fcc "Command line code", handle_exceptions=1)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_execute_API.c:1176
result = 0
#7 0x0000000000a191ad in zend_eval_string_ex (str=0x17d4d90
"var_dump(get_defined_constants(true));", retval_ptr=0x0,
string_name=0x1353fcc "Command line code", handle_exceptions=1)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/Zend/zend_execute_API.c:1187
No locals.
#8 0x0000000000b6a05c in do_cli (argc=4, argv=0x17d4cd0)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/sapi/cli/php_cli.c:1005
__orig_bailout = 0x7fffffffe270
__bailout = {{__jmpbuf = {0, 140737488347712, 14558992, 140737488348272, 0, 0,
140737488342816, 11965745},
__mask_was_saved = 0, __saved_mask = {__val = {16, 20146392, 20146440, 20146471,
20146480, 20146504, 20146517,
20146534, 20146555, 20146575, 20146592, 20146613, 20146623, 20146637, 20146659,
20146678}}}}
c = -1
file_handle = {handle = {fd = 722660096, fp = 0x302b12eb00, stream = {handle = 0x302b12eb00,
isatty = 10040959, mmap = {
len = 10135242, pos = 10041794, map = 0x993470 <php_stream_open_for_zend>,
buf = 0x99b7b9 <vspprintf>
"UH\211\345H\203\354PH\211}\370H\211u\360H\211U\350H\211M\340H\215}\300", <incomplete
sequence \374\272>, old_handle = 0x99b970 <vstrpprintf>, old_closer = 0x9a282f
<sapi_getenv>},
reader = 0x993657 <php_resolve_path_for_zend>, fsizer = 0x302b130620, closer =
0x70}}, filename = 0x1353f76 "-",
opened_path = 0x0, type = ZEND_HANDLE_FP, free_filename = 0 '\000'}
behavior = 6
reflection_what = 0x0
request_started = 1
exit_status = 0
php_optarg = 0x17d4d90 "var_dump(get_defined_constants(true));"
orig_optarg = 0x0
php_optind = 4
orig_optind = 1
exec_direct = 0x17d4d90 "var_dump(get_defined_constants(true));"
exec_run = 0x0
exec_begin = 0x0
exec_end = 0x0
arg_free = 0x17d4d90 "var_dump(get_defined_constants(true));"
arg_excp = 0x17d4ce8
script_file = 0x0
translated_path = 0x0
interactive = 0
param_error = 0x0
hide_argv = 0
#9 0x0000000000b6b0f5 in main (argc=4, argv=0x17d4cd0)
at /home/users/lvshun/php7/trunk/php/.tmp/build/php-7.0.6/sapi/cli/php_cli.c:1344
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {0, 140737488348064, 14558992, 140737488348272, 0, 0,
140737488347728, 11972824},
__mask_was_saved = 0, __saved_mask = {__val = {23437640, 22686360, 140737488348272, 0,
0, 270766525504, 270765434426,
206158430209, 0, 140737346091280, 206878818672, 0, 270765434114, 0, 32, 0}}}}
c = -1
exit_status = 0
module_started = 1
sapi_started = 1
php_optarg = 0x17d4d90 "var_dump(get_defined_constants(true));"
php_optind = 4
use_extended_info = 0
ini_path_override = 0x0
ini_entries = 0x17d4fe0
"html_errors=0\nregister_argc_argv=1\nimplicit_flush=1\noutput_buffering=0\nmax_execution_time=0\nmax_input_time=-1\n"
ini_entries_len = 110
ini_ignore = 1
sapi_module = 0x1672d60 <cli_sapi_module>
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=72257
--
Edit this bug report at https://bugs.php.net/bug.php?id=72257&edit=1