Bug #73696 [NEW]: zend_mm_heap corrupted when enable opcache

From: tianfenghan Operating system: Ubuntu 16.04 PHP version: 7.0.14 Package: opcache Bug Type: Bug Bug description:zend_mm_heap corrupted when enable opcache Description: ------------ php.ini ---- zend_extension=opcache.so opcache.enable_cli=on No issues with opcache.enable_cli=0. extension ---- opcache + swoole-1.9.1 php myprog.php zend_mm_heap corrupted disable zend mm ---- export USE_ZEND_ALLOC=0 php myprog.php *** Error in `php': free(): invalid pointer: 0x00007fef61a98fb8 *** ======= Backtrace: ========= /lib/x86_64-linux-gnu/libc.so.6(+0x777e5)[0x7fef6d4fb7e5] /lib/x86_64-linux-gnu/libc.so.6(+0x7fe0a)[0x7fef6d503e0a] /lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7fef6d50798c] php[0x7bcac5] php(_zend_hash_str_update+0x1f0)[0x7bddb0] php(add_assoc_bool_ex+0x4f)[0x7b2eef] /opt/php/php-7/lib/php/extensions/no-debug-non-zts-20151012/swoole.so(+0x2f682)[0x7fef6581e682] php[0x8355d2] php(execute_ex+0x1b)[0x7f068b] php(zend_execute+0x1a7)[0x844797] php(zend_execute_scripts+0xc3)[0x7b0243] php(php_execute_script+0x2d0)[0x74ff20] php[0x846476] php[0x441714] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7fef6d4a4830] php(_start+0x29)[0x441859] ======= Memory map: ======== gdb php core (gdb) bt #0 0x00007fef6d4b9428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 #1 0x00007fef6d4bb02a in __GI_abort () at abort.c:89 #2 0x00007fef6d4fb7ea in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fef6d6142e0 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007fef6d503e0a in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7fef6d6110b2 "free(): invalid pointer", action=3) at malloc.c:5004 #4 _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3865 #5 0x00007fef6d50798c in __GI___libc_free (mem=<optimized out>) at malloc.c:2966 #6 0x00000000007bcac5 in zend_hash_do_resize (ht=ht@entry=0x7fef61a98f80) at /home/htf/workspace/php-7.0.14/Zend/zend_hash.c:893 #7 0x00000000007bddb0 in _zend_hash_add_or_update_i (flag=1, pData=0x7ffc12895a30, key=<optimized out>, ht=0x7fef61a98f80) at /home/htf/workspace/php-7.0.14/Zend/zend_hash.c:604 #8 _zend_hash_str_update (ht=ht@entry=0x7fef61a98f80, str=str@entry=0x7fef65858347 "open_mqtt_protocol", len=len@entry=18, pData=pData@entry=0x7ffc12895a30) at /home/htf/workspace/php-7.0.14/Zend/zend_hash.c:667 #9 0x00000000007b2eef in zend_symtable_str_update (pData=0x7ffc12895a30, len=18, str=0x7fef65858347 "open_mqtt_protocol", ht=0x7fef61a98f80) at /home/htf/workspace/php-7.0.14/Zend/zend_hash.h:407 #10 add_assoc_bool_ex (arg=arg@entry=0x13e2f80, key=key@entry=0x7fef65858347 "open_mqtt_protocol", key_len=key_len@entry=18, b=b@entry=0) at /home/htf/workspace/php-7.0.14/Zend/zend_API.c:1349 #11 0x00007fef6581e682 in zim_swoole_http_server_start (execute_data=0x7fef6f13d0e0, return_value=0x7fef6f13d0c0) at /home/htf/workspace/swoole/swoole_http_server.c:1368 #12 0x00000000008355d2 in ZEND_DO_FCALL_SPEC_HANDLER () at /home/htf/workspace/php-7.0.14/Zend/zend_vm_execute.h:842 #13 0x00000000007f068b in execute_ex (ex=<optimized out>) at /home/htf/workspace/php-7.0.14/Zend/zend_vm_execute.h:414 #14 0x0000000000844797 in zend_execute (op_array=0x142cb60, op_array@entry=0x7fef61a992b8, return_value=return_value@entry=0x7fef6f13d040) at /home/htf/workspace/php-7.0.14/Zend/zend_vm_execute.h:458 #15 0x00000000007b0243 in zend_execute_scripts (type=type@entry=8, retval=0x7fef6f13d040, retval@entry=0x0, file_count=file_count@entry=3) at /home/htf/workspace/php-7.0.14/Zend/zend.c:1437 #16 0x000000000074ff20 in php_execute_script (primary_file=primary_file@entry=0x7ffc12898100) at /home/htf/workspace/php-7.0.14/main/main.c:2494 #17 0x0000000000846476 in do_cli (argc=2, argv=0x11f20c0) at /home/htf/workspace/php-7.0.14/sapi/cli/php_cli.c:974 #18 0x0000000000441714 in main (argc=2, argv=0x11f20c0) at /home/htf/workspace/php-7.0.14/sapi/cli/php_cli.c:1344 Test script: --------------- <?php $swConfig = array( 'task_worker_num' => 0, 'worker_num' => 1, 'max_request' => 1000, 'dispatch_mode' => 2, 'debug_mode' => 1, 'log_file' =>'swoole.log', //'daemonize' => 1 ,//是否作为守护进程 'open_tcp_keepalive' => true, ); $http = new swoole_http_server( '0.0.0.0', 9502, SWOOLE_BASE ); $http->set( $swConfig ); $http->on( 'request', function( swoole_http_request $request, swoole_http_response $response ) use ( $http ) { //请求过滤 if( $request->server[ 'path_info' ] == '/favicon.ico' || $request->server[ 'request_uri' ] == '/favicon.ico' ) { $response->end(); return; } }); $http->start(); -- Edit bug report at https://bugs.php.net/bug.php?id=73696&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73696&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73696&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73696&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73696&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73696&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73696&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73696&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73696&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73696&r=support Expected behavior: https://bugs.php.net/fix.php?id=73696&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73696&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73696&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73696&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73696&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73696&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73696&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73696&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73696&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73696&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73696&r=mysqlcfg