From: ryan dot brothers at gmail dot com
Operating system: Linux
PHP version: 7.1.0RC2
Package: opcache
Bug Type: Bug
Bug description:segfault on undefined function
Description:
------------
I am running into a few segmentation faults in PHP 7.0 and 7.1 when
using Opcache. They seem to be very dependent on the code structure as
minor updates to the code fix it - even just renaming a variable in some
cases. It's tricky to generate small reproduce scripts, but I've been
able to do one so far.
I am running on CentOS 7.
Create the below 3 files and run the script as:
php -n -d zend_extension=opcache.so -d opcache.enable_cli=1 file1.php
Test script:
---------------
file1.php:
-------
<?php
class a1
{
public function __call($name, $arguments)
{
require('file2.php');
}
}
$a1 = new a1;
$a1->file2();
-------
file2.php:
-------
<?php
$arguments = array();
require('file3.php');
class a2
{
public function __call($method_name, $arguments)
{
try
{
throw new \Exception('abc');
}
catch (\Exception $e)
{
try
{
test();
}
catch (\Error $e)
{
echo 'caught';
exit;
}
}
}
}
$a2 = new a2;
$a2->function2();
-------
file3.php:
-------
<?php
namespace test_aaaa;
function abc($row)
{
if (array_key_exists('a', $row) == true)
{
$a = ABC_ERROR_AAA__123_ERROR;
$a = ABC_ERROR_AAA__123_ERROR;
}
else
{
$a = ABC_ERROR_AAA__123_ERROR;
}
}
-------
Expected result:
----------------
caught
Actual result:
--------------
Segmentation fault
backtrace is:
Program received signal SIGSEGV, Segmentation fault.
zend_mm_alloc_small (size=56, bin_num=6, heap=0x7fffee200040) at
/usr/local/src/php-7.1.0RC2/Zend/zend_alloc.c:1250
1250 heap->free_slot[bin_num] = p->next_free_slot;
(gdb) bt
#0 zend_mm_alloc_small (size=56, bin_num=6, heap=0x7fffee200040) at
/usr/local/src/php-7.1.0RC2/Zend/zend_alloc.c:1250
#1 _emalloc_56 () at
/usr/local/src/php-7.1.0RC2/Zend/zend_alloc.c:2325
#2 0x0000000000857300 in _array_init (arg=arg@entry=0x7fffffffab20,
size=size@entry=2) at /usr/local/src/php-7.1.0RC2/Zend/zend_API.c:1060
#3 0x0000000000869baf in debug_backtrace_get_args
(call=call@entry=0x7fffee2131a0,
arg_array=arg_array@entry=0x7fffffffab20)
at /usr/local/src/php-7.1.0RC2/Zend/zend_builtin_functions.c:2271
#4 0x000000000086e446 in zend_fetch_debug_backtrace
(return_value=return_value@entry=0x7fffffffaba0,
skip_last=skip_last@entry=0, options=options@entry=0,
limit=limit@entry=0) at
/usr/local/src/php-7.1.0RC2/Zend/zend_builtin_functions.c:2671
#5 0x0000000000874d9f in zend_default_exception_new_ex
(class_type=0x1282820, skip_top_traces=0) at
/usr/local/src/php-7.1.0RC2/Zend/zend_exceptions.c:214
#6 0x0000000000857abb in _object_and_properties_init
(arg=arg@entry=0x7fffffffac10, class_type=class_type@entry=0x1282820,
properties=properties@entry=0x0)
at /usr/local/src/php-7.1.0RC2/Zend/zend_API.c:1302
#7 0x0000000000857ba7 in _object_init_ex (arg=arg@entry=0x7fffffffac10,
class_type=class_type@entry=0x1282820) at
/usr/local/src/php-7.1.0RC2/Zend/zend_API.c:1310
#8 0x000000000044a403 in zend_throw_exception
(exception_ce=exception_ce@entry=0x1282820, message=0x7fffee284000 "Call
to undefined function test()",
code=code@entry=0) at
/usr/local/src/php-7.1.0RC2/Zend/zend_exceptions.c:903
#9 0x0000000000449494 in zend_throw_error (exception_ce=0x1282820,
exception_ce@entry=0x0, format=format@entry=0xe48ad8 "Call to undefined
function %s()")
at /usr/local/src/php-7.1.0RC2/Zend/zend.c:1336
#10 0x00000000008e2589 in ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER ()
at /usr/local/src/php-7.1.0RC2/Zend/zend_vm_execute.h:2130
#11 0x0000000000899b8b in execute_ex (ex=<optimized out>) at
/usr/local/src/php-7.1.0RC2/Zend/zend_vm_execute.h:429
#12 0x00000000008ec7c4 in zend_execute (op_array=0x7fffee27f0e0,
op_array@entry=0x7fffe432a720,
return_value=return_value@entry=0x7fffee2131a0)
at /usr/local/src/php-7.1.0RC2/Zend/zend_vm_execute.h:474
#13 0x0000000000855444 in zend_execute_scripts (type=type@entry=8,
retval=0x7fffee2131a0, retval@entry=0x0, file_count=file_count@entry=3)
at /usr/local/src/php-7.1.0RC2/Zend/zend.c:1464
#14 0x00000000007f7140 in php_execute_script
(primary_file=primary_file@entry=0x7fffffffd150) at
/usr/local/src/php-7.1.0RC2/main/main.c:2533
#15 0x00000000008ee95f in do_cli (argc=7, argv=0x1202bd0) at
/usr/local/src/php-7.1.0RC2/sapi/cli/php_cli.c:990
#16 0x000000000044dd50 in main (argc=7, argv=0x1202bd0) at
/usr/local/src/php-7.1.0RC2/sapi/cli/php_cli.c:1378
--
Edit bug report at https://bugs.php.net/bug.php?id=73156&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73156&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73156&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73156&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=73156&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=73156&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=73156&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=73156&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=73156&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=73156&r=support
Expected behavior: https://bugs.php.net/fix.php?id=73156&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=73156&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=73156&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=73156&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73156&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=73156&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=73156&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=73156&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=73156&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=73156&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=73156&r=mysqlcfg