Bug #72179 [Asn]: Segfault in gc_possible_root on CLI

Edit report at https://bugs.php.net/bug.php?id=72179&edit=1 ID: 72179 User updated by: webmaster at tom-geiger dot de Reported by: webmaster at tom-geiger dot de Summary: Segfault in gc_possible_root on CLI Status: Assigned Type: Bug Package: Reproducible crash -Operating System: Ubuntu 16.04 +Operating System: Ubuntu 16.10 -PHP Version: 7.0.6 +PHP Version: 7.0.12 Assigned To: laruence Block user comment: N Private report: N New Comment: Issue still occurs with PHP 7.0.12. I managed to work around the issue a bit more. The following pseudo code describes the issue further: --- Segfaulting code --- whie (true) { fetchEventFromDatabase(); handleEvent(); // Somewhere here the GC starts and segfaults } --- End Code --- Disabling GC: --- NOT- Segfaulting code --- gc_disable(); whie (true) { fetchEventFromDatabase(); handleEvent(); // GC never starts, so no segfault --- End Code --- Optimized workaround: --- SOMETIMES- Segfaulting code --- define(DO_GC, 50); gc_disable(); whie (true) { fetchEventFromDatabase(); handleEvent(); if(rand(1, DO_GC) == DO_GC) { gc_collect_cycles(); // This segfaults depending on DO_GC } --- End Code --- In my environment, having DO_GC < 20 will keep the script from segfaulting. Above 20 I will have segfaults when executing gc_collect_cycles(). Ths leads me to assume that gc_collect_cycles() will segfault depending on the amount of cycles it has to collect. I hope this helps to further isolate the issue. Previous Comments: ------------------------------------------------------------------------ [2016-07-20 20:05:28] ccovey14 at gmail dot com I am still seeing this in 7.0.8. We see it in our functional test suite, always in the same test, although running just the test it fails on passes as expected. I can also confirm calling gc_disable does in fact allow the test suite to pass. gdb backtrace and php modules below. #gdb Backtrace #0 gc_possible_root (ref=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_gc.c:262 #1 0x0000000000575d14 in var_destroy (var_hashx=<value optimized out>) at /usr/src/debug/php-7.0.8/ext/standard/var_unserializer.c:160 #2 0x0000000000564848 in zif_unserialize (execute_data=<value optimized out>, return_value=0x7f7524e1a530) at /usr/src/debug/php-7.0.8/ext/standard/var.c:1087 #3 0x00000000005d5029 in dtrace_execute_internal (execute_data=<value optimized out>, return_value=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:107 #4 0x000000000065b522 in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e1a4d0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:844 #5 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #6 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e1a4d0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #7 0x000000000066867d in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER (execute_data=0x7f7524e1a0a0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:29337 #8 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #9 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e1a0a0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #10 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e193a0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #11 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #12 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e193a0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #13 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e19220) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #14 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #15 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e19220) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #16 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e18d50) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #17 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #18 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e18d50) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #19 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e18a50) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #20 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #21 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e18a50) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #22 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e18610) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #23 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #24 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e18610) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #25 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e18390) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #26 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #27 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e18390) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #28 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e181d0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #29 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #30 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e181d0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #31 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e176e0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #32 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #33 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e176e0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #34 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e17650) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #35 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #36 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e17650) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #37 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e16ea0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #38 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #39 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e16ea0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #40 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e16300) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #41 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #42 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e16300) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #43 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e158a0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #44 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #45 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e158a0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #46 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e152c0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 ---Type <return> to continue, or q <return> to quit--- #47 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #48 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e152c0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #49 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e14ce0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #50 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #51 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e14ce0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #52 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e136b0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #53 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #54 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e136b0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #55 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e13290) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #56 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #57 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e13290) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #58 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e131a0) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #59 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #60 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e131a0) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #61 0x000000000065b39a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f7524e13030) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:800 #62 0x00000000006231d0 in execute_ex (ex=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:417 #63 0x00000000005d516e in dtrace_execute_ex (execute_data=0x7f7524e13030) at /usr/src/debug/php-7.0.8/Zend/zend_dtrace.c:83 #64 0x000000000067689b in zend_execute (op_array=0x7f7524e85000, return_value=<value optimized out>) at /usr/src/debug/php-7.0.8/Zend/zend_vm_execute.h:458 #65 0x00000000005e3b03 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-7.0.8/Zend/zend.c:1427 #66 0x0000000000585180 in php_execute_script (primary_file=0x7ffdbd74a970) at /usr/src/debug/php-7.0.8/main/main.c:2494 #67 0x000000000067ab9a in do_cli (argc=9, argv=0x1e1bd50) at /usr/src/debug/php-7.0.8/sapi/cli/php_cli.c:974 #68 0x000000000067b39a in main (argc=9, argv=0x1e1bd50) at /usr/src/debug/php-7.0.8/sapi/cli/php_cli.c:1344 # PHP modules installed [PHP Modules] apc apcu bcmath bz2 calendar Core ctype curl date dom exif fileinfo filter ftp gd gettext hash iconv igbinary imagick imap intl json ldap libxml mbstring mongodb mysqli mysqlnd openssl pcntl pcre PDO pdo_mysql pdo_sqlite Phar posix readline redis Reflection session shmop SimpleXML soap sockets solr SPL sqlite3 standard sysvmsg sysvsem sysvshm tokenizer wddx xml xmlreader xmlwriter xsl Zend OPcache zip zlib [Zend Modules] Zend OPcache ------------------------------------------------------------------------ [2016-05-19 13:40:41] webmaster at tom-geiger dot de Also, another valgrind with the manually built version: ==14634== Invalid read of size 8 ==14634== at 0x85CF75: gc_possible_root (zend_gc.c:234) ==14634== by 0x82429E: gc_check_possible_root (zend_gc.h:136) ==14634== by 0x82434E: i_zval_ptr_dtor (zend_variables.h:50) ==14634== by 0x824A29: _zval_ptr_dtor_wrapper (zend_variables.c:203) ==14634== by 0x83CC1D: _zend_hash_del_el_ex (zend_hash.c:1026) ==14634== by 0x83D411: zend_hash_index_del (zend_hash.c:1228) ==14634== by 0x667ABD: zif_array_shift (array.c:2706) ==14634== by 0x889F65: ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:785) ==14634== by 0x8891C4: execute_ex (zend_vm_execute.h:426) ==14634== by 0x8892D5: zend_execute (zend_vm_execute.h:471) ==14634== by 0x827C90: zend_execute_scripts (zend.c:1427) ==14634== by 0x78EB25: php_execute_script (main.c:2492) ==14634== Address 0x6364376232363742 is not stack'd, malloc'd or (recently) free'd ==14634== ==14634== ==14634== Process terminating with default action of signal 11 (SIGSEGV) ==14634== General Protection Fault ==14634== at 0x85CF75: gc_possible_root (zend_gc.c:234) ==14634== by 0x82429E: gc_check_possible_root (zend_gc.h:136) ==14634== by 0x82434E: i_zval_ptr_dtor (zend_variables.h:50) ==14634== by 0x824A29: _zval_ptr_dtor_wrapper (zend_variables.c:203) ==14634== by 0x83CC1D: _zend_hash_del_el_ex (zend_hash.c:1026) ==14634== by 0x83D411: zend_hash_index_del (zend_hash.c:1228) ==14634== by 0x667ABD: zif_array_shift (array.c:2706) ==14634== by 0x889F65: ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:785) ==14634== by 0x8891C4: execute_ex (zend_vm_execute.h:426) ==14634== by 0x8892D5: zend_execute (zend_vm_execute.h:471) ==14634== by 0x827C90: zend_execute_scripts (zend.c:1427) ==14634== by 0x78EB25: php_execute_script (main.c:2492) ==14634== ==14634== HEAP SUMMARY: ==14634== in use at exit: 99,412,531 bytes in 488,147 blocks ==14634== total heap usage: 17,687,831 allocs, 17,199,684 frees, 3,341,087,194 bytes allocated ==14634== ==14634== LEAK SUMMARY: ==14634== definitely lost: 3,472 bytes in 62 blocks ==14634== indirectly lost: 17,856 bytes in 62 blocks ==14634== possibly lost: 88,267,081 bytes in 390,950 blocks ==14634== still reachable: 11,124,122 bytes in 97,073 blocks ==14634== suppressed: 0 bytes in 0 blocks ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=72179 -- Edit this bug report at https://bugs.php.net/bug.php?id=72179&edit=1