Bug #52752 [Ver]: Crash when lexing

Edit report at https://bugs.php.net/bug.php?id=52752&edit=1 ID: 52752 Updated by: pollita@php.net Reported by: paulgao at yeah dot net Summary: Crash when lexing Status: Verified Type: Bug Package: Scripting Engine problem Operating System: Centos 5 32bit PHP Version: 5.3SVN-2010-08-31 (SVN) Block user comment: N Private report: N New Comment: It seems to be over-allocating on the stack. Let's see if we can narrow the problem down to finding the file that's causing the problem. In gbd, jump to frame 5 and print file_handle as well as file_handle as well as file_handle->filename and file_handle->opened_path (gdb) f 5 (gdb) p file_handle (gdb) p file_handle->filename (gdb) p file_handle->opened_path Previous Comments: ------------------------------------------------------------------------ [2017-06-09 19:17:47] zac at sprackett dot com Hi Pollita, We're running the IUS package of 5.6.30 (https://github.com/iuscommunity-pkg/php56u/blob/master/SPECS/php56u.spec) and are seeing the following backtrace: (gdb) bt #0 lex_scan (zendlval=0x7ffcfe165598) at Zend/zend_language_scanner.c:1082 #1 0x00000000005c57e0 in zendlex (zendlval=0x7ffcfe165590) at /usr/src/debug/php-5.6.30/Zend/zend_compile.c:6919 #2 0x00000000005ac9a3 in zendparse () at /usr/src/debug/php-5.6.30/Zend/zend_language_parser.c:3732 #3 0x00000000005b95f5 in compile_file (file_handle=0x7ffcfe165920, type=<value optimized out>) at Zend/zend_language_scanner.l:586 #4 0x00000000005d96ea in dtrace_compile_file (file_handle=0x7ffcfe165920, type=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:40 #5 0x00007f9dcff71b02 in phar_compile_file (file_handle=0x7ffcfe165920, type=2) at /usr/src/debug/php-5.6.30/ext/phar/phar.c:3370 #6 0x00000000005b8c6e in compile_filename (type=2, filename=0x83bdd78) at Zend/zend_language_scanner.l:629 #7 0x0000000000657683 in ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER ( execute_data=0x7f9de0a7abf0) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:13753 #8 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a7abf0) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #9 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a7abf0) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #10 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #11 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a7a640) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #12 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a7a640) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #13 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #14 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a79de0) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #15 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a79de0) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #16 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #17 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a77ab0) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #18 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a77ab0) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #19 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #20 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a779c0) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #21 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a779c0) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #22 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #23 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a778d0) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #24 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a778d0) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #25 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #26 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a777d0) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #27 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a777d0) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #28 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #29 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a775e8) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #30 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a775e8) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #31 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #32 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a76800) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #33 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a76800) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #34 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #35 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a76220) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #36 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a76220) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #37 0x00000000006583c9 in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER ( execute_data=0x7f9de0a745e8) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:3026 #38 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a745e8) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #39 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a745e8) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #40 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #41 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a74278) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #42 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a74278) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #43 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #44 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a73418) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #45 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a73418) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #46 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #47 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a72bf8) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #48 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a72bf8) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #49 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #50 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a725a0) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #51 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a725a0) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #52 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #53 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a71250) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #54 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a71250) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #55 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #56 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a70f78) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #57 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a70f78) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #58 0x0000000000669054 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:592 #59 0x00000000006584b8 in execute_ex (execute_data=0x7f9de0a70898) at /usr/src/debug/php-5.6.30/Zend/zend_vm_execute.h:363 #60 0x00000000005d95be in dtrace_execute_ex (execute_data=0x7f9de0a70898) at /usr/src/debug/php-5.6.30/Zend/zend_dtrace.c:73 #61 0x00000000005e8d6c in zend_execute_scripts (type=8, retval=0x0, file_count=2) at /usr/src/debug/php-5.6.30/Zend/zend.c:1341 #62 0x0000000000586965 in php_execute_script (primary_file=0x7ffcfe169ea0) at /usr/src/debug/php-5.6.30/main/main.c:2610 #63 0x0000000000690b86 in do_cli (argc=11, argv=0x2335510) at /usr/src/debug/php-5.6.30/sapi/cli/php_cli.c:998 #64 0x0000000000691318 in main (argc=11, argv=0x2335510) at /usr/src/debug/php-5.6.30/sapi/cli/php_cli.c:1382 ------------------------------------------------------------------------ [2017-06-02 14:12:28] blazej dot adamczyk at gmail dot com +1 for the flock. Alternatively another way would be to handle the SIGBUS and recover from such situation. ------------------------------------------------------------------------ [2017-05-14 17:16:21] pollita@php.net Wouldn't acquiring a shared lock work here? We only lex when including an uncached file, so the extra flock() hit would be negligible over time (except for scripts like this which void assumptions about file permanence, obviously). ------------------------------------------------------------------------ [2017-02-22 13:44:46] ironsmile at gmail dot com You can actually hit this bug when you are not in a position to do anything about it. For example, my organisation is using Codeception and Paracept for running our tests. Every now and then a testing process would fail because of this bug. Save for abandoning the whole testing framework one cannot do anything about it and have to accept false negatives. And this because PHP is indeterministic and its processes fail from time to time. Surely, this can be easily fixed! For what is worth, here is a back trace from a failure in our environment, which is 64bit CentOS 7.3.1611: #0 0x00007f2097dd86ed in lex_scan () #1 0x00007f2097df7062 in zendlex () #2 0x00007f2097dd1956 in zendparse () #3 0x00007f2097dd6f5b in compile_file () #4 0x00007f2097dfd12a in dtrace_compile_file () #5 0x00007f2085d7bc9a in phar_compile_file () from /usr/lib64/php/modules/phar.so #6 0x00007f2097ec08b3 in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER () #7 0x00007f2097e39e68 in execute_ex () #8 0x00007f2097dfd1a9 in dtrace_execute_ex () #9 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #10 0x00007f2097e39e68 in execute_ex () #11 0x00007f2097dfd1a9 in dtrace_execute_ex () #12 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #13 0x00007f2097e39e68 in execute_ex () #14 0x00007f2097dfd1a9 in dtrace_execute_ex () #15 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #16 0x00007f2097e39e68 in execute_ex () #17 0x00007f2097dfd1a9 in dtrace_execute_ex () #18 0x00007f2097dff571 in zend_call_function () #19 0x00007f2097e261a8 in zend_call_method () #20 0x00007f2097d0e3aa in zif_spl_autoload_call () #21 0x00007f2097dfd2cb in dtrace_execute_internal () #22 0x00007f2097dff710 in zend_call_function () #23 0x00007f2097dffe92 in zend_lookup_class_ex () #24 0x00007f2097e005f0 in zend_fetch_class_by_name () #25 0x00007f2097e48362 in ZEND_ADD_TRAIT_SPEC_HANDLER () #26 0x00007f2097e39e68 in execute_ex () #27 0x00007f2097dfd1a9 in dtrace_execute_ex () #28 0x00007f2097ec0980 in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER () #29 0x00007f2097e39e68 in execute_ex () #30 0x00007f2097dfd1a9 in dtrace_execute_ex () #31 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #32 0x00007f2097e39e68 in execute_ex () #33 0x00007f2097dfd1a9 in dtrace_execute_ex () #34 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #35 0x00007f2097e39e68 in execute_ex () #36 0x00007f2097dfd1a9 in dtrace_execute_ex () #37 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #38 0x00007f2097e39e68 in execute_ex () #39 0x00007f2097dfd1a9 in dtrace_execute_ex () #40 0x00007f2097dff571 in zend_call_function () #41 0x00007f2097e261a8 in zend_call_method () #42 0x00007f2097d0e3aa in zif_spl_autoload_call () #43 0x00007f2097dfd2cb in dtrace_execute_internal () #44 0x00007f2097dff710 in zend_call_function () #45 0x00007f2097dffe92 in zend_lookup_class_ex () #46 0x00007f2097e20c48 in zif_get_class_methods () #47 0x00007f2097dfd2cb in dtrace_execute_internal () #48 0x00007f2097ec2160 in zend_do_fcall_common_helper_SPEC () #49 0x00007f2097e39e68 in execute_ex () #50 0x00007f2097dfd1a9 in dtrace_execute_ex () #51 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #52 0x00007f2097e39e68 in execute_ex () #53 0x00007f2097dfd1a9 in dtrace_execute_ex () #54 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #55 0x00007f2097e39e68 in execute_ex () #56 0x00007f2097dfd1a9 in dtrace_execute_ex () ---Type <return> to continue, or q <return> to quit--- #57 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #58 0x00007f2097e39e68 in execute_ex () #59 0x00007f2097dfd1a9 in dtrace_execute_ex () #60 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #61 0x00007f2097e39e68 in execute_ex () #62 0x00007f2097dfd1a9 in dtrace_execute_ex () #63 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #64 0x00007f2097e39e68 in execute_ex () #65 0x00007f2097dfd1a9 in dtrace_execute_ex () #66 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #67 0x00007f2097e39e68 in execute_ex () #68 0x00007f2097dfd1a9 in dtrace_execute_ex () #69 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #70 0x00007f2097e39e68 in execute_ex () #71 0x00007f2097dfd1a9 in dtrace_execute_ex () #72 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #73 0x00007f2097e39e68 in execute_ex () #74 0x00007f2097dfd1a9 in dtrace_execute_ex () #75 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #76 0x00007f2097e39e68 in execute_ex () #77 0x00007f2097dfd1a9 in dtrace_execute_ex () #78 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #79 0x00007f2097e39e68 in execute_ex () #80 0x00007f2097dfd1a9 in dtrace_execute_ex () #81 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #82 0x00007f2097e39e68 in execute_ex () #83 0x00007f2097dfd1a9 in dtrace_execute_ex () #84 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #85 0x00007f2097e39e68 in execute_ex () #86 0x00007f2097dfd1a9 in dtrace_execute_ex () #87 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #88 0x00007f2097e39e68 in execute_ex () #89 0x00007f2097dfd1a9 in dtrace_execute_ex () #90 0x00007f2097ec27cb in zend_do_fcall_common_helper_SPEC () #91 0x00007f2097e39e68 in execute_ex () #92 0x00007f2097dfd1a9 in dtrace_execute_ex () #93 0x00007f2097e0f45b in zend_execute_scripts () #94 0x00007f2097dacb02 in php_execute_script () #95 0x00007f2097ec4198 in do_cli () #96 0x00007f2097c437ea in main () ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=52752 -- Edit this bug report at https://bugs.php.net/bug.php?id=52752&edit=1