Bug #73989 [Asn]: PHP 7.1 Segfaults within Symfony test suite

Edit report at https://bugs.php.net/bug.php?id=73989&edit=1 ID: 73989 Updated by: laruence@php.net Reported by: maxime dot steinhausser at gmail dot com Summary: PHP 7.1 Segfaults within Symfony test suite Status: Assigned Type: Bug Package: *General Issues Operating System: OS X 10.12.2 PHP Version: 7.1Git-2017-01-24 (Git) Assigned To: laruence Block user comment: N Private report: N New Comment: yes, they are series problems, but all caused by the same root reason. Previous Comments: ------------------------------------------------------------------------ [2017-02-10 17:24:45] maxime dot steinhausser at gmail dot com Thanks for the update. Note that the reproduce script you wrote does reproduce the issue using PHP 7.1.1, but doesn't using PHP 7.1.0. So it might not be the only issue as the Symfony test suite actually fails for this version too. ------------------------------------------------------------------------ [2017-02-10 09:18:34] laruence@php.net a simple produce script is: class Cycle { private $thing; public function __construct() { $obj = $this; $this->thing = function() use($obj) {}; } public function __destruct() { ($this->thing)(); } } for ($i = 0; $i < 10000; ++$i) { $obj = new Cycle(); } echo "OK\n"; ------------------------------------------------------------------------ [2017-02-10 09:14:11] laruence@php.net this is a complicated bug, relates to gc addtional_buffers implementation limit.... I need more time to think... :< ------------------------------------------------------------------------ [2017-01-25 00:20:48] maxime dot steinhausser at gmail dot com Description: ------------ Hi, As reported in https://github.com/symfony/symfony/issues/21349, we encounter segfaults when trying to run the Symfony SecurityBundle test suite on master branch, after a particular commit (7497f1c), using php 7.1.0 or 7.1.1 (tested on several OS X hosts). Everything seems to be fine before this commit. See following output and backtrace I get from a freshly compiled 7.1.1 PHP version with the --enable-debug option. Actual result: -------------- PHPUnit 5.7.6 by Sebastian Bergmann and contributors. Testing src/Symfony/Bundle/SecurityBundle/ ............................................................... 63 / 139 ( 45%) ..................Assertion failed: (((zend_object*)func->op_array.prototype)->gc.u.v.type == 8), function zend_call_function, file zend_execute_API.c, line 818. --- Backtrace with lldb: Executable module set to "/usr/local/mac-dev-env/php-7.1.0/bin/php". Architecture set to: x86_64h-apple-macosx. (lldb) continue Process 25678 resuming Process 25678 stopped * thread #1: tid = 0xc72afd, 0x00007fffaa6e3dd6 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT frame #0: 0x00007fffaa6e3dd6 libsystem_kernel.dylib`__pthread_kill + 10 libsystem_kernel.dylib`__pthread_kill: -> 0x7fffaa6e3dd6 <+10>: jae 0x7fffaa6e3de0 ; <+20> 0x7fffaa6e3dd8 <+12>: movq %rax, %rdi 0x7fffaa6e3ddb <+15>: jmp 0x7fffaa6dccdf ; cerror_nocancel 0x7fffaa6e3de0 <+20>: retq (lldb) bt * thread #1: tid = 0xc72afd, 0x00007fffaa6e3dd6 libsystem_kernel.dylib`__pthread_kill + 10, queue = 'com.apple.main-thread', stop reason = signal SIGABRT * frame #0: 0x00007fffaa6e3dd6 libsystem_kernel.dylib`__pthread_kill + 10 frame #1: 0x00007fffaa7cf787 libsystem_pthread.dylib`pthread_kill + 90 frame #2: 0x00007fffaa649420 libsystem_c.dylib`abort + 129 frame #3: 0x00007fffaa610893 libsystem_c.dylib`__assert_rtn + 320 frame #4: 0x00000001053b730d php`zend_call_function(fci=0x00007fff5af146b8, fci_cache=0x00007fff5af145e0) + 2541 at zend_execute_API.c:818 frame #5: 0x00000001053b6917 php`_call_user_function_ex(object=0x0000000000000000, function_name=0x000000010601fdd0, retval_ptr=0x000000010601fd80, param_count=5, params=0x000000010601fe00, no_separation=1) + 215 at zend_execute_API.c:672 frame #6: 0x0000000105414647 php`zim_Closure___invoke(execute_data=0x000000010601fdb0, return_value=0x000000010601fd80) + 135 at zend_closures.c:57 frame #7: 0x0000000105468298 php`ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER(execute_data=0x000000010601fcd0) + 936 at zend_vm_execute.h:1097 frame #8: 0x000000010543bbb4 php`execute_ex(ex=0x000000010601fcd0) + 100 at zend_vm_execute.h:432 frame #9: 0x00000001053b73bb php`zend_call_function(fci=0x00007fff5af14b00, fci_cache=0x00007fff5af14a70) + 2715 at zend_execute_API.c:828 frame #10: 0x00000001054041c2 php`zend_call_method(object=0x00007fff5af14c48, obj_ce=0x0000000107c55678, fn_proxy=0x00007fff5af14c60, function_name="__destruct", function_name_len=10, retval_ptr=0x0000000000000000, param_count=0, arg1=0x0000000000000000, arg2=0x0000000000000000) + 1234 at zend_interfaces.c:101 frame #11: 0x0000000105429ea7 php`zend_objects_destroy_object(object=0x0000000106917600) + 839 at zend_objects.c:156 frame #12: 0x00000001054124c6 php`zend_gc_collect_cycles + 534 at zend_gc.c:1114 frame #13: 0x0000000105411ffc php`gc_possible_root(ref=0x0000000107991000) + 524 at zend_gc.c:293 frame #14: 0x00000001054d8112 php`zend_object_release(obj=0x0000000107991000) + 98 at zend_objects_API.h:80 frame #15: 0x00000001054e21a7 php`zend_leave_helper_SPEC(execute_data=0x000000010601fc40) + 231 at zend_vm_execute.h:497 frame #16: 0x0000000105468885 php`ZEND_RETURN_SPEC_CONST_HANDLER(execute_data=0x000000010601fc40) + 213 at zend_vm_execute.h:2909 frame #17: 0x000000010543bbb4 php`execute_ex(ex=0x000000010601d670) + 100 at zend_vm_execute.h:432 frame #18: 0x00000001053b73bb php`zend_call_function(fci=0x00007fff5af15108, fci_cache=0x00007fff5af150e0) + 2715 at zend_execute_API.c:828 frame #19: 0x000000010510b941 php`reflection_method_invoke(execute_data=0x000000010601d600, return_value=0x000000010601d2b0, variadic=0) + 1809 at php_reflection.c:3325 frame #20: 0x000000010510babf php`zim_reflection_method_invokeArgs(execute_data=0x000000010601d600, return_value=0x000000010601d2b0) + 31 at php_reflection.c:3361 frame #21: 0x0000000105468298 php`ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER(execute_data=0x000000010601d0b0) + 936 at zend_vm_execute.h:1097 --- frame #4: 0x00000001053b730d php`zend_call_function(fci=0x00007fff5af146b8, fci_cache=0x00007fff5af145e0) + 2541 at zend_execute_API.c:818 815 } 816 817 if (UNEXPECTED(func->op_array.fn_flags & ZEND_ACC_CLOSURE)) { -> 818 ZEND_ASSERT(GC_TYPE((zend_object*)func->op_array.prototype) == IS_OBJECT); 819 GC_REFCOUNT((zend_object*)func->op_array.prototype)++; 820 ZEND_ADD_CALL_FLAG(call, ZEND_CALL_CLOSURE); 821 } (lldb) down ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=73989&edit=1