Bug #73521 [NEW]: date('O') cause coredump

From: 804368954 at qq dot com Operating system: CentOS Linux release 6.2 (Final) PHP version: 7.0Git-2016-11-15 (Git) Package: Date/time related Bug Type: Bug Bug description:date('O') cause coredump Description: ------------ service environment： PHP: PHP 7.0.6 (fpm-fcgi) (built: Aug 19 2016 19:19:41) System: CentOS Linux release 6.2 (Final) sometimes coredump like "/core.php-fpm.2114.1475062344",but not offten. Because in production env, so the gdb result not debug: Core was generated by `php-fpm: pool www '. Program terminated with signal 11, Segmentation fault. #0 zend_mm_alloc_small (size=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_alloc.c:1295 1295 /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_alloc.c: No such file or directory. in /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_alloc.c Missing separate debuginfos, use: debuginfo-install php7-7.0.6-20160819192101.x86_64 (gdb) bt #0 zend_mm_alloc_small (size=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_alloc.c:1295 #1 zend_mm_alloc_heap (size=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_alloc.c:1366 #2 _emalloc (size=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_alloc.c:2450 #3 0x00000000008415d1 in zend_string_alloc (str=0x7fff99d6fd20, len=<value optimized out>) at Zend/zend_string.h:121 #4 smart_str_erealloc (str=0x7fff99d6fd20, len=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_smart_str.c:41 #5 0x000000000043ed89 in smart_str_alloc (format=0x7f4eba8e7968 "O", format_len=1, t=0x7f4eca459afe, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_smart_str.h:61 #6 smart_str_appendl_ex (format=0x7f4eba8e7968 "O", format_len=1, t=0x7f4eca459afe, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_smart_str.h:89 #7 date_format (format=0x7f4eba8e7968 "O", format_len=1, t=0x7f4eca459afe, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/date/php_date.c:1218 #8 0x0000000000442032 in php_format_date (format=0x7f4eba8e7968 "O", format_len=1, ts=1479163515, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/date/php_date.c:1265 #9 0x000000000044276e in php_date (execute_data=0x7f4eca4155a0, return_value=0x7f4eca4154b0, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/date/php_date.c:1243 #10 0x00000000008675f3 in ZEND_DO_ICALL_SPEC_HANDLER (execute_data=0x7f4eca415320) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:586 #11 0x0000000000841ae0 in execute_ex (ex=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:417 #12 0x000000000087961a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f4eca415290) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:800 #13 0x0000000000841ae0 in execute_ex (ex=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:417 #14 0x000000000087961a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f4eca415130) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:800 #15 0x0000000000841ae0 in execute_ex (ex=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:417 #16 0x000000000087961a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f4eca415030) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:800 #17 0x0000000000841ae0 in execute_ex (ex=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:417 #18 0x00000000007f5348 in zend_call_function (fci=0x7fff99d700d0, fci_cache=0x7fff99d70050) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_execute_API.c:866 #19 0x00000000007f58da in call_user_function_ex (function_table=<value optimized out>, object=<value optimized out>, function_name=<value optimized out>, retval_ptr=<value optimized out>, param_count=<value optimized out>, params=<value optimized out>, no_separation=1, symbol_table=0x0) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_execute_API.c:685 #20 0x00000000007f58f9 in call_user_function (function_table=<value optimized out>, object=<value optimized out>, function_name=<value optimized out>, retval_ptr=<value optimized out>, param_count=<value optimized out>, params=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_execute_API.c:667 #21 0x0000000000709bb7 in user_shutdown_function_call (zv=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/standard/basic_functions.c:4923 #22 0x000000000080f573 in zend_hash_apply (ht=0x7f4eca466498, apply_func=0x709af0 <user_shutdown_function_call>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_hash.c:1534 #23 0x0000000000709ae6 in php_call_shutdown_functions () at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/standard/basic_functions.c:5007 #24 0x00000000007a57b5 in php_request_shutdown (dummy=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/main/main.c:1775 #25 0x00000000008a290b in main (argc=<value optimized out>, argv=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/sapi/fpm/fpm/fpm_main.c:1996 (gdb) bt full #0 zend_mm_alloc_small (size=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_alloc.c:1295 p = 0x7f4eca459c00003d #1 zend_mm_alloc_heap (size=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_alloc.c:1366 ptr = <value optimized out> #2 _emalloc (size=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_alloc.c:2450 No locals. #3 0x00000000008415d1 in zend_string_alloc (str=0x7fff99d6fd20, len=<value optimized out>) at Zend/zend_string.h:121 ret = <value optimized out> #4 smart_str_erealloc (str=0x7fff99d6fd20, len=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_smart_str.c:41 No locals. #5 0x000000000043ed89 in smart_str_alloc (format=0x7f4eba8e7968 "O", format_len=1, t=0x7f4eca459afe, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_smart_str.h:61 No locals. #6 smart_str_appendl_ex (format=0x7f4eba8e7968 "O", format_len=1, t=0x7f4eca459afe, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_smart_str.h:89 new_len = <value optimized out> #7 date_format (format=0x7f4eba8e7968 "O", format_len=1, t=0x7f4eca459afe, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/date/php_date.c:1218 string = {s = 0x0, a = 231} i = 0 length = 5 buffer = "+0800\000\000\000@\223\025\001\000\000\000\000\060PA\312N\177\000\000z?\000\000\000\000\000 \000\000\000\060\000\000\000\260\375?\377\177\000\000\360\374?\377\177\000\000\376\232E\312N\177\000\000p\020@\312N\177\000\000\323\024~\000\000\000\000\000\376\232E\312N\177\000\000p\020@\312N\177\000\000\003" offset = <value optimized out> rfc_colon = <value optimized out> weekYearSet = 0 #8 0x0000000000442032 in php_format_date (format=0x7f4eba8e7968 "O", format_len=1, ts=1479163515, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/date/php_date.c:1265 t = 0x7f4eca459afe tzi = <value optimized out> string = <value optimized out> #9 0x000000000044276e in php_date (execute_data=0x7f4eca4155a0, return_value=0x7f4eca4154b0, localtime=1) at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/date/php_date.c:1243 __z = 0x7f4eca4154b0 __s = <value optimized out> format = 0x7f4eba8e7968 "O" format_len = 1 ts = 1479163515 #10 0x00000000008675f3 in ZEND_DO_ICALL_SPEC_HANDLER (execute_data=0x7f4eca415320) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:586 opline = 0x7f4ebb228be8 call = 0x7f4eca4155a0 fbc = <value optimized out> ret = <value optimized out> #11 0x0000000000841ae0 in execute_ex (ex=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:417 ---Type <return> to continue, or q <return> to quit--- ret = <value optimized out> execute_data = 0x7f4eca415320 #12 0x000000000087961a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f4eca415290) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:800 opline = 0x7f4ebb22a128 call = 0x7f4eca415320 fbc = 0x7f4eca40d308 object = <value optimized out> ret = <value optimized out> #13 0x0000000000841ae0 in execute_ex (ex=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:417 ret = <value optimized out> execute_data = 0x7f4eca415290 #14 0x000000000087961a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f4eca415130) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:800 opline = 0x7f4ebb2111a8 call = 0x7f4eca415290 fbc = 0x7f4eca40d648 object = <value optimized out> ret = <value optimized out> #15 0x0000000000841ae0 in execute_ex (ex=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:417 ret = <value optimized out> execute_data = 0x7f4eca415130 #16 0x000000000087961a in ZEND_DO_FCALL_SPEC_HANDLER (execute_data=0x7f4eca415030) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:800 opline = 0x7f4ebb20e3e0 call = 0x7f4eca415130 fbc = 0x7f4eca49e600 object = <value optimized out> ret = <value optimized out> #17 0x0000000000841ae0 in execute_ex (ex=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_vm_execute.h:417 ret = <value optimized out> execute_data = 0x7f4eca415030 #18 0x00000000007f5348 in zend_call_function (fci=0x7fff99d700d0, fci_cache=0x7fff99d70050) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_execute_API.c:866 call_via_handler = 0 i = <value optimized out> calling_scope = <value optimized out> call = 0x7f4eca415030 dummy_execute_data = {opline = 0x0, call = 0x0, return_value = 0x0, func = 0x0, This = {value = {lval = 0, dval = 0, counted = 0x0, str = 0x0, arr = 0x0, obj = 0x0, res = 0x0, ref = 0x0, ast = 0x0, zv = 0x0, ptr = 0x0, ce = 0x0, func = 0x0, ww = {w1 = 0, w2 = 0}}, u1 = {v = {type = 0 '\000', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 0}, u2 = {var_flags = 0, next = 0, cache_slot = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0}}, called_scope = 0x0, prev_execute_data = 0x0, symbol_table = 0x0, run_time_cache = 0x0, literals = 0x0} fci_cache_local = {initialized = 1 '\001', function_handler = 0x7f4eca49ea10, calling_scope = 0x0, called_scope = 0x0, object = 0x0} func = 0x7f4eca49ea10 orig_scope = 0x0 ---Type <return> to continue, or q <return> to quit--- #19 0x00000000007f58da in call_user_function_ex (function_table=<value optimized out>, object=<value optimized out>, function_name=<value optimized out>, retval_ptr=<value optimized out>, param_count=<value optimized out>, params=<value optimized out>, no_separation=1, symbol_table=0x0) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_execute_API.c:685 fci = {size = 72, function_table = 0x245b4e0, function_name = {value = {lval = 139976114599224, dval = 6.9157389461813945e-310, counted = 0x7f4eba967538, str = 0x7f4eba967538, arr = 0x7f4eba967538, obj = 0x7f4eba967538, res = 0x7f4eba967538, ref = 0x7f4eba967538, ast = 0x7f4eba967538, zv = 0x7f4eba967538, ptr = 0x7f4eba967538, ce = 0x7f4eba967538, func = 0x7f4eba967538, ww = {w1 = 3130422584, w2 = 32590}}, u1 = {v = {type = 6 '\006', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 6}, u2 = {var_flags = 32590, next = 32590, cache_slot = 32590, lineno = 32590, num_args = 32590, fe_pos = 32590, fe_iter_idx = 32590}}, symbol_table = 0x0, retval = 0x7fff99d70150, params = 0x7f4eca46c120, object = 0x0, no_separation = 1 '\001', param_count = 0} #20 0x00000000007f58f9 in call_user_function (function_table=<value optimized out>, object=<value optimized out>, function_name=<value optimized out>, retval_ptr=<value optimized out>, param_count=<value optimized out>, params=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_execute_API.c:667 No locals. #21 0x0000000000709bb7 in user_shutdown_function_call (zv=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/standard/basic_functions.c:4923 shutdown_function_entry = 0x7f4eca46c120 retval = {value = {lval = 18192736, dval = 8.9884058614592963e-317, counted = 0x1159960, str = 0x1159960, arr = 0x1159960, obj = 0x1159960, res = 0x1159960, ref = 0x1159960, ast = 0x1159960, zv = 0x1159960, ptr = 0x1159960, ce = 0x1159960, func = 0x1159960, ww = {w1 = 18192736, w2 = 0}}, u1 = {v = {type = 0 '\000', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 0}, u2 = {var_flags = 0, next = 0, cache_slot = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0}} function_name = 0x7f4eba967538 #22 0x000000000080f573 in zend_hash_apply (ht=0x7f4eca466498, apply_func=0x709af0 <user_shutdown_function_call>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/Zend/zend_hash.c:1534 idx = <value optimized out> p = 0x7f4eca45c928 result = <value optimized out> #23 0x0000000000709ae6 in php_call_shutdown_functions () at /data/jenkins/jobs/php7/workspace/php-7.0.6/ext/standard/basic_functions.c:5007 __orig_bailout = 0x7fff99d702f0 __bailout = {{__jmpbuf = {18191168, 4168535194149327155, 41067202, 0, 0, 139976377376768, -4168454012177477325, 4168537093102637363}, __mask_was_saved = 0, __saved_mask = { __val = {0, 0, 0, 0, 0, 0, 0, 65536, 150323855361, 0, 0, 0, 0, 18189464, 18189152, 41067202}}}} #24 0x00000000007a57b5 in php_request_shutdown (dummy=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/main/main.c:1775 __orig_bailout = 0x7fff99d70610 __bailout = {{__jmpbuf = {18191168, 4168535194149327155, 41067202, 0, 0, 139976377376768, -4168454012208934605, 4168537150679552307}, __mask_was_saved = 0, __saved_mask = { __val = {0, 140735774393168, 140735774976567, 140735774393216, 139976463416902, 140735774393280, 41068236, 41067202, 9023407, 2097152, 41068236, 41067202, 1479163515, 408, 18189824, 41068236}}}} report_memleaks = 1 '\001' #25 0x00000000008a290b in main (argc=<value optimized out>, argv=<value optimized out>) at /data/jenkins/jobs/php7/workspace/php-7.0.6/sapi/fpm/fpm/fpm_main.c:1996 primary_script = <value optimized out> __orig_bailout = 0x0 __bailout = {{__jmpbuf = {0, -4168454011912187597, 7, 70, 18166784, 0, -4168454012238294733, 4168538384012153139}, __mask_was_saved = 0, __saved_mask = {__val = {139976470078262, 139976471083240, 140735774394128, 139976439517314, 140735774394128, 39, 139976471086832, 4131212846, 139976470080642, 139976439519287, 64550200, 140733193388078, 139976425716308, 0, 140735774394512, 139976425716808}}}} exit_status = 0 c = <value optimized out> use_extended_info = 0 file_handle = {handle = {fd = -1713960736, fp = 0x7fff99d708e0, stream = {handle = 0x7fff99d708e0, isatty = -1713960696, mmap = {len = 139976472273288, pos = 139976471087216, map = 0xf63d4e2e, buf = 0x7f4ecfc6af0a "\205\300~\232H\213E\260H\205\300\017\204-\003", old_handle = 0x0, old_closer = 0x7f4ecfd60870}, reader = 0x1, fsizer = 0, ---Type <return> to continue, or q <return> to quit--- closer = 0x1}}, filename = 0x7f4eca404000 "\004", opened_path = 0x0, type = ZEND_HANDLE_FILENAME, free_filename = 0 '\000'} orig_optind = 1 orig_optarg = 0x0 ini_entries_len = <value optimized out> max_requests = 10000 requests = 293 fcgi_fd = 18189824 request = 0x272f170 fpm_config = 0x7fff99d72c2c "" fpm_prefix = 0x7fff99d72c52 "" fpm_pid = 0x0 test_conf = 0 force_daemon = -1 force_stderr = 0 php_information = 0 php_allow_to_run_as_root = 0 __func__ = "main" In the gdb bt full result we can see #7 date_format (format=0x7f4eba8e7968 "O", so we check our code find the "register_shutdown_function" include date("O"), so I think this is the reason。 thanks Test script: --------------- date("O") -- Edit bug report at https://bugs.php.net/bug.php?id=73521&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73521&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73521&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73521&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73521&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73521&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73521&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73521&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73521&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73521&r=support Expected behavior: https://bugs.php.net/fix.php?id=73521&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73521&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73521&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73521&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73521&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73521&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73521&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73521&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73521&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73521&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73521&r=mysqlcfg