Bug #74008 [NEW]: Segmentation fault using Drupal 7

From: pierre at brin-de-toile dot fr Operating system: Debian Jessie 64 bits PHP version: 7.0.15 Package: Reproducible crash Bug Type: Bug Bug description:Segmentation fault using Drupal 7 Description: ------------ Hello, I can't provide a script to reproduce the problem, since it's part of Drupal. The problem starts to occur when I add multiple products to the cart, using discounts. Then it occurs on different pages, often when I show the cart. If there is a way to find what PHP code in Drupal creates the error, I could test it, but I don't know how. Software used: * Debian 8.7, kernel 3.18.43 * Nginx 1.10.2 * PHP 7.0.15 (php-fpm) - php -m output : bz2,calendar,Core,ctype,curl,date,dom,exif,fileinfo,filter,ftp,gd,gettext,hash,iconv,imap,json,libxml,mbstring,mysqli,mysqlnd,openssl,pcntl,pcre,PDO,pdo_mysql,Phar,posix,readline,Reflection,session,shmop,SimpleXML,soap,sockets,SPL,standard,sysvm,g,sysvsem,sysvshm,tokenizer,wddx,xml,xmlreader,xmlrpc,xmlwriter,xsl,zip,zlib * Drupal 7.53, Drupal Commerce 1.13, Commerce Discount 1.x-dev php.ini modifications: max_execution_time = 300 post_max_size = 32M upload_max_filesize = 32M date.timezone = Europe/Paris Actual result: -------------- % sudo gdb /usr/sbin/php-fpm7.0 /tmp/core-php-fpm7.0.23489 GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1 [...] Core was generated by `php-fpm: pool www '. Program terminated with signal SIGSEGV, Segmentation fault. #0 zend_mm_alloc_small (size=56, bin_num=6, heap=0x7f9322200040) at /usr/src/builddir/Zend/zend_alloc.c:1306 [...] (gdb) bt #0 zend_mm_alloc_small (size=56, bin_num=6, heap=0x7f9322200040) at /usr/src/builddir/Zend/zend_alloc.c:1306 #1 _emalloc_56 () at /usr/src/builddir/Zend/zend_alloc.c:2380 #2 0x00007f932520a3fe in zend_array_dup (source=0x7f9314f65cb0) at /usr/src/builddir/Zend/zend_hash.c:1793 #3 0x00007f93251f5f1d in _zval_copy_ctor_func (zvalue=zvalue@entry=0x7f931468bd60) at /usr/src/builddir/Zend/zend_variables.c:221 #4 0x00007f93252683c1 in zend_binary_assign_op_dim_helper_SPEC_VAR_CONST (binary_op=0x7f93251f0f30 <add_function>) at /usr/src/builddir/Zend/zend_vm_execute.h:16769 #5 0x00007f932523798b in execute_ex (ex=<optimized out>) at /usr/src/builddir/Zend/zend_vm_execute.h:414 #6 0x00007f93251e8915 in zend_call_function (fci=fci@entry=0x7ffc56a3c710, fci_cache=0x7f9314e35580, fci_cache@entry=0x7ffc56a3c6e0) at /usr/src/builddir/Zend/zend_execute_API.c:858 #7 0x00007f9325215e0e in zend_call_method (object=object@entry=0x7ffc56a3c810, obj_ce=<optimized out>, fn_proxy=<optimized out>, function_name=function_name@entry=0x7f9325397597 "__get", function_name_len=function_name_len@entry=5, retval_ptr=retval_ptr@entry=0x7ffc56a3c800, param_count=1, arg1=0x7f9315ca9dc0, arg2=0x0) at /usr/src/builddir/Zend/zend_interfaces.c:104 #8 0x00007f932522f2df in zend_std_call_getter (object=object@entry=0x7ffc56a3c810, member=member@entry=0x7f9315ca9dc0, retval=retval@entry=0x7ffc56a3c800) at /usr/src/builddir/Zend/zend_object_handlers.c:200 #9 0x00007f9325230b55 in zend_std_has_property (object=<optimized out>, member=0x7f9315ca9dc0, has_set_exists=1, cache_slot=<optimized out>) at /usr/src/builddir/Zend/zend_object_handlers.c:1519 #10 0x00007f9325237aaa in ZEND_ISSET_ISEMPTY_PROP_OBJ_SPEC_CV_CONST_HANDLER () at /usr/src/builddir/Zend/zend_vm_execute.h:33061 #11 0x00007f932523798b in execute_ex (ex=<optimized out>) at /usr/src/builddir/Zend/zend_vm_execute.h:414 #12 0x00007f932528c7e7 in zend_execute (op_array=0x7f9322275000, op_array@entry=0x7f9315c7bee0, return_value=return_value@entry=0x7f93222152d0) at /usr/src/builddir/Zend/zend_vm_execute.h:458 #13 0x00007f93251f7963 in zend_execute_scripts (type=type@entry=8, retval=0x7f93222152d0, retval@entry=0x0, file_count=file_count@entry=3) at /usr/src/builddir/Zend/zend.c:1437 #14 0x00007f93251976c0 in php_execute_script (primary_file=0x7ffc56a3ee80) at /usr/src/builddir/main/main.c:2492 #15 0x00007f932507d6e5 in main (argc=658790613, argv=0x7f9327445847) at /usr/src/builddir/sapi/fpm/fpm/fpm_main.c:1968 (gdb) f 0 #0 zend_mm_alloc_small (size=56, bin_num=6, heap=0x7f9322200040) at /usr/src/builddir/Zend/zend_alloc.c:1306 1306 heap->free_slot[bin_num] = p->next_free_slot; (gdb) list 1301 } while (0); 1302 #endif 1303 1304 if (EXPECTED(heap->free_slot[bin_num] != NULL)) { 1305 zend_mm_free_slot *p = heap->free_slot[bin_num]; 1306 heap->free_slot[bin_num] = p->next_free_slot; 1307 return (void*)p; 1308 } else { 1309 return zend_mm_alloc_small_slow(heap, bin_num ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); 1310 } -- Edit bug report at https://bugs.php.net/bug.php?id=74008&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=74008&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=74008&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=74008&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=74008&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=74008&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=74008&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=74008&r=needscript Try newer version: https://bugs.php.net/fix.php?id=74008&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=74008&r=support Expected behavior: https://bugs.php.net/fix.php?id=74008&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=74008&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=74008&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=74008&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74008&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=74008&r=dst IIS Stability: https://bugs.php.net/fix.php?id=74008&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=74008&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=74008&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=74008&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=74008&r=mysqlcfg