#14136 [Ctl->Fbk]: Segfaults when forget xslt_free()

ID: 14136 Updated by: jmoore@php.net Reported By: lenar@vision.ee -Status: Critical +Status: Feedback Bug Type: Scripting Engine problem Operating System: Debian/Linux PHP Version: 4.0CVS-2001-11-2 Assigned To: sterling New Comment: I cant reproduce this on windows nor can rei (Ilia) on slackware. This bug is not really critical as it has a workaround of using xslt_free. Can you please provide us with a SHORT test script (Including the XSLT and XML required) which reproduces this behaviour so we can localize and fix this bug if it does exist. Status => User feedback. Many thanks, - James -- James Moore jmoore@php.net Previous Comments: ------------------------------------------------------------------------ [2002-03-26 03:31:24] derick@php.net Sterling, can you please check this? Derick ------------------------------------------------------------------------ [2002-02-27 07:40:26] derick@php.net Assinging this to you sterling, have fun with it! ------------------------------------------------------------------------ [2001-11-20 15:21:51] zeev@php.net Doesn't look like a Zend problem to me. Apparently the table ends up containing the wrong entries (i.e., the same entry more than once) or, if the analysis is accurate, then the dependencies aren't properly implemented, and a resource (the parser) is freed prematurely. ------------------------------------------------------------------------ [2001-11-20 07:34:40] sterling@php.net Seems a Zend problem... ------------------------------------------------------------------------ [2001-11-20 03:59:03] lenar@vision.ee Tested this with php compiled as cgi. Everything works ok when after doing transformation you use xslt_free() in your script. When you forget to do so php may segfault. This happens when there were a scheme/sax handler defined with object reference: xslt_set_sax_handlers($xslt, array("characters" => array(&$this, "func"))); Now when php shuts down it calls free_processor() which after some recursive *_ptr_dtor() and alike calls reaches again free_processor() with same zval handle. Since sablotron processor is already destroyed it eventually comes to segfault. This doesn't happen when ordinary function is used as callback handler. Backtrace: #0 0x00000000 in ?? () #1 0x400d8432 in Situation::generateMessage (this=0x81c4bb8, type=MT_WARN, code=W1_HLR_NOT_REGISTERED, arg1=@0xbfffee08, arg2=@0xbfffedfc, theMessage=@0xbfffed70) at situa.cpp:267 #2 0x400d8ae2 in Situation::message (this=0x81c4bb8, type=MT_WARN, code=W1_HLR_NOT_REGISTERED, arg1=@0xbfffee08, arg2=@0xbfffedfc) at situa.cpp:348 #3 0x400cfb63 in Processor::report (this=0x81c4c58, S=@0x81c4bb8, type=MT_WARN, code=W1_HLR_NOT_REGISTERED, arg1=@0xbfffee08, arg2=@0xbfffedfc) at proc.cpp:991 #4 0x400ce583 in Processor::setHandler (this=0x81c4c58, S=@0x81c4bb8, type=HLR_MESSAGE, handler=0x0, userData=0x0) at proc.cpp:741 #5 0x400d1a8c in SablotUnregHandler (processor_=0x81c4c58, type=HLR_MESSAGE, handler=0x0, userData=0x0) at sablot.cpp:728 #6 0x0811adc1 in free_processor (rsrc=0x81c0a8c) at sablot.c:613 #7 0x080c3a2a in list_entry_destructor (ptr=0x81c0a8c) at zend_list.c:177 #8 0x080c128e in zend_hash_del_key_or_index (ht=0x818dc44, arKey=0x0, nKeyLength=0, h=1, flag=1) at zend_hash.c:512 #9 0x080c378b in _zend_list_delete (id=1) at zend_list.c:56 #10 0x080d9581 in _zval_dtor (zvalue=0x81c4574, __zend_filename=0x813d01c "zend_execute_API.c", __zend_lineno=274) at zend_variables.c:64 #11 0x080c66ab in _zval_ptr_dtor (zval_ptr=0x81c0ad8, __zend_filename=0x8149313 "zend_variables.c", __zend_lineno=189) at zend_execute_API.c:274 #12 0x080d98b4 in _zval_ptr_dtor_wrapper (zval_ptr=0x81c0ad8) at zend_variables.c:189 #13 0x080c13ba in zend_hash_destroy (ht=0x81c101c) at zend_hash.c:541 #14 0x080d9551 in _zval_dtor (zvalue=0x81c4a34, __zend_filename=0x813d01c "zend_execute_API.c", __zend_lineno=274) at zend_variables.c:57 #15 0x080c66ab in _zval_ptr_dtor (zval_ptr=0x81c0b90, __zend_filename=0x8149313 "zend_variables.c", __zend_lineno=189) at zend_execute_API.c:274 #16 0x080d98b4 in _zval_ptr_dtor_wrapper (zval_ptr=0x81c0b90) at zend_variables.c:189 #17 0x080c13ba in zend_hash_destroy (ht=0x81c0b24) at zend_hash.c:541 #18 0x080d9521 in _zval_dtor (zvalue=0x81c0c5c, __zend_filename=0x813d01c "zend_execute_API.c", __zend_lineno=274) at zend_variables.c:51 #19 0x080c66ab in _zval_ptr_dtor (zval_ptr=0x81c4b9c, __zend_filename=0x81672fb "sablot.c", __zend_lineno=633) at zend_execute_API.c:274 #20 0x0811b00e in free_processor (rsrc=0x81c0a8c) at sablot.c:633 #21 0x080c3a2a in list_entry_destructor (ptr=0x81c0a8c) at zend_list.c:177 #22 0x080c3c15 in zend_destroy_rsrc_list (ht=0x818dc44) at zend_list.c:248 #23 0x080c64a7 in shutdown_executor () at zend_execute_API.c:196 #24 0x080c8e36 in zend_deactivate () at zend.c:600 #25 0x080637cf in php_request_shutdown (dummy=0x0) at main.c:736 #26 0x0805f023 in main (argc=2, argv=0xbffffb34) at cgi_main.c:785 #27 0x401e965f in __libc_start_main () from /lib/libc.so.6 ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=14136&edit=1