Bug #74497 [Opn->Fbk]: Segfault occurs when releasing memory

From: Date: Mon, 08 May 2017 09:50:52 +0000
Subject: Bug #74497 [Opn->Fbk]: Segfault occurs when releasing memory
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-208994@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=74497&edit=1

 ID:                 74497
 Updated by:         laruence@php.net
 Reported by:        mdeallas at gmail dot com
 Summary:            Segfault occurs when releasing memory
-Status:             Open
+Status:             Feedback
 Type:               Bug
 Package:            Reproducible crash
 PHP Version:        7.0.18
 Block user comment: N
 Private report:     N

 New Comment:

Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.




Previous Comments:
------------------------------------------------------------------------
[2017-04-25 13:03:03] mdeallas at gmail dot com

Description:
------------
Hello,

I have a problem with the garbage collector which I cannot reproduce with a simple code. In brief,
my script creates multiple objects (for 256M it is ~10k) based on a piece of data, binds them
together and removes them (unset & null) if there is not enough memory available. Once the
memory is cleaned up, it takes another portion of the data and does so until it reaches the data
limit. The following stack trace is from the old version (7.0.11) but the problem also appears on
the current version:

#0  0x0000555555cb1795 in zend_gc_collect_cycles () at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_gc.c:1078
#1  0x0000555555caf799 in gc_possible_root (ref=0x7fffe2c54180) at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_gc.c:243
#2  0x0000555555c54b63 in gc_check_possible_root (z=0x7fffeb306430) at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_gc.h:136
#3  0x0000555555c54c6b in i_zval_ptr_dtor (zval_ptr=0x7fffeb306430, __zend_filename=0x555556279000
"/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/ext/standard/var_unserializer.c",
__zend_lineno=160)
    at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_variables.h:60
#4  0x0000555555c56c5b in _zval_ptr_dtor (zval_ptr=0x7fffeb306430, __zend_filename=0x555556279000
"/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/ext/standard/var_unserializer.c",
__zend_lineno=160)
    at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_execute_API.c:533
#5  0x0000555555af47f9 in var_destroy (var_hashx=0x7fffffffa700) at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/ext/standard/var_unserializer.c:160
#6  0x0000555555ae2d5c in zif_unserialize (execute_data=0x7fffef817f00, return_value=0x7fffef817ef0)
at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/ext/standard/var.c:1087
#7  0x0000555555ce083a in ZEND_DO_ICALL_SPEC_HANDLER () at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_vm_execute.h:586
#8  0x0000555555ce0191 in execute_ex (ex=0x7fffef814030) at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_vm_execute.h:414
#9  0x0000555555ce02db in zend_execute (op_array=0x7fffef864100, return_value=0x0) at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_vm_execute.h:458
#10 0x0000555555c73a2e in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend.c:1427
#11 0x0000555555bcce1d in php_execute_script (primary_file=0x7fffffffce60) at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/main/main.c:2494
#12 0x0000555555d5472d in do_cli (argc=3, argv=0x555556664fd0) at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/sapi/cli/php_cli.c:974
#13 0x0000555555d558fb in main (argc=3, argv=0x555556664fd0) at
/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/sapi/cli/php_cli.c:1344


And gdc output:

[0x7fffe947de00] rc=1 addr=6643 grey object(AAA)#13571 ->black
[0x7fffe947c0c0] rc=1 addr=6802 grey array(0) ->black
[0x7fffe947ac00] rc=2 addr=6845 grey object(BBB)#13572 ->black
[0x7fffe8e54200] rc=1 addr=9854 white object(AAA)#15515 ->black
[0x7fffe8e38ea0] rc=1 addr=9839 white array(32) ->black
[0x7fffe8e56400] rc=1 addr=0 white string ->black



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=74497&edit=1

Thread (3 messages)

« previous php.bugs (#208994) next »