Bug #74877 [NEW]: Segmentation fault in zend_mm_alloc_small

From: Date: Fri, 07 Jul 2017 17:59:16 +0000
Subject: Bug #74877 [NEW]: Segmentation fault in zend_mm_alloc_small
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-209906@lists.php.net to get a copy of this message
From:             mcfedr at gmail dot com
Operating system: linux/macos
PHP version:      7.1.7
Package:          Reproducible crash
Bug Type:         Bug
Bug description:Segmentation fault in zend_mm_alloc_small

Description:
------------
This crash happens in exactly the same place each time i run this
script. Its actually my entire phpunit suite for a big project, so its
not easy to pin down a short reproducible test script.

If I run the individual test where the crash happens only there is no
crash.

I have tried running, calling gc_disable() at the start and this crash
doesnt happen.

Its a Symfony project, and the crash only happens with Symfony 3.3, no
crashes for Symfony 3.2, but the size of a Symfony update makes it hard
to put a finger on the change that causes the issue.

Only crashes on php >7.1 - its fine on <=7.0.

I'm very willing to provide more information, I just dont know what to
add at this point.

Actual result:
--------------
Core was generated by `php ./vendor/bin/phpunit'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000557af77e66ae in zend_mm_alloc_small (heap=0x7f604dc00040,
size=216, bin_num=14, __zend_filename=0x557af7e7b100
"/usr/src/php/Zend/zend_string.h", __zend_lineno=122,
    __zend_orig_filename=0x0, __zend_orig_lineno=0) at
/usr/src/php/Zend/zend_alloc.c:1261
1261			heap->free_slot[bin_num] = p->next_free_slot;
(gdb) bt
#0  0x0000557af77e66ae in zend_mm_alloc_small (heap=0x7f604dc00040,
size=216, bin_num=14, __zend_filename=0x557af7e7b100
"/usr/src/php/Zend/zend_string.h", __zend_lineno=122,
    __zend_orig_filename=0x0, __zend_orig_lineno=0) at
/usr/src/php/Zend/zend_alloc.c:1261
#1  0x0000557af77e6950 in zend_mm_alloc_heap (heap=0x7f604dc00040,
size=216, __zend_filename=0x557af7e7b100
"/usr/src/php/Zend/zend_string.h", __zend_lineno=122,
    __zend_orig_filename=0x0, __zend_orig_lineno=0) at
/usr/src/php/Zend/zend_alloc.c:1332
#2  0x0000557af77e9397 in _emalloc (size=184,
__zend_filename=0x557af7e7b100 "/usr/src/php/Zend/zend_string.h",
__zend_lineno=122, __zend_orig_filename=0x0,
    __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:2417
#3  0x0000557af787bb18 in zend_string_alloc (len=158, persistent=0) at
/usr/src/php/Zend/zend_string.h:122
#4  0x0000557af78ffa50 in ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER () at
/usr/src/php/Zend/zend_vm_execute.h:54658
#5  0x0000557af7884fd2 in execute_ex (ex=0x7f604dc1a190) at
/usr/src/php/Zend/zend_vm_execute.h:429
#6  0x0000557af780880c in zend_call_function (fci=0x7ffec2dd1cb0,
fci_cache=0x7ffec2dd1c80) at /usr/src/php/Zend/zend_execute_API.c:855
#7  0x0000557af784b62e in zend_call_method (object=0x7f604dc1a160,
obj_ce=0x7f6043809c68, fn_proxy=0x7f6043809dc0,
function_name=0x557af7e771af "getiterator",
    function_name_len=11, retval_ptr=0x7ffec2dd1d80, param_count=0,
arg1=0x0, arg2=0x0) at /usr/src/php/Zend/zend_interfaces.c:99
#8  0x0000557af784b89d in zend_user_it_new_iterator (ce=0x7f6043809c68,
object=0x7f604dc1a160, retval=0x7ffec2dd1d80) at
/usr/src/php/Zend/zend_interfaces.c:130
#9  0x0000557af784bea9 in zend_user_it_get_new_iterator
(ce=0x7f6043809c68, object=0x7f604dc1a160, by_ref=0) at
/usr/src/php/Zend/zend_interfaces.c:282
#10 0x0000557af78a958c in ZEND_FE_RESET_R_SPEC_VAR_HANDLER () at
/usr/src/php/Zend/zend_vm_execute.h:16508
#11 0x0000557af7884fd2 in execute_ex (ex=0x7f604dc18c60) at
/usr/src/php/Zend/zend_vm_execute.h:429
#12 0x0000557af780880c in zend_call_function (fci=0x7ffec2dd20d0,
fci_cache=0x7ffec2dd20a0) at /usr/src/php/Zend/zend_execute_API.c:855
#13 0x0000557af75fa599 in reflection_method_invoke
(execute_data=0x7f604dc18bf0, return_value=0x7f604dc18880, variadic=0)
at /usr/src/php/ext/reflection/php_reflection.c:3331
#14 0x0000557af75fa762 in zim_reflection_method_invokeArgs
(execute_data=0x7f604dc18bf0, return_value=0x7f604dc18880) at
/usr/src/php/ext/reflection/php_reflection.c:3367
#15 0x0000557af7886c2e in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at
/usr/src/php/Zend/zend_vm_execute.h:1097
#16 0x0000557af7884fd2 in execute_ex (ex=0x7f604dc14030) at
/usr/src/php/Zend/zend_vm_execute.h:429
#17 0x0000557af78850e7 in zend_execute (op_array=0x7f604dc7f000,
return_value=0x0) at /usr/src/php/Zend/zend_vm_execute.h:474
#18 0x0000557af7822368 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /usr/src/php/Zend/zend.c:1476
#19 0x0000557af7786fbb in php_execute_script
(primary_file=0x7ffec2dd4820) at /usr/src/php/main/main.c:2537
#20 0x0000557af790bc03 in do_cli (argc=2, argv=0x557af9ff4090) at
/usr/src/php/sapi/cli/php_cli.c:993
#21 0x0000557af790cdb8 in main (argc=2, argv=0x557af9ff4090) at
/usr/src/php/sapi/cli/php_cli.c:1381


(gdb) zbacktrace
[0x7f604dc1f8f0]
Symfony\Component\Cache\Adapter\FilesystemAdapter->getFile("%5B%5BC%5DKidslox%5CDevice%5CProfileBundle%5CEntity%5CDisabledAppPayload%24forceProxy%40%5BAnnot%5D%5D%5B1%5D")
/Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Traits/FilesystemCommonTrait.php:101
[0x7f604dc1f630]
Symfony\Component\Cache\Adapter\FilesystemAdapter->doFetch(array(1)[0x7f604dc1f680])
/Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Traits/FilesystemTrait.php:34
[0x7f604dc1f480]
Symfony\Component\Cache\Adapter\AbstractAdapter->getItem("%5B%5BC%5DKidslox%5CDevice%5CProfileBundle%5CEntity%5CDisabledAppPayload%24forceProxy%40%5BAnnot%5D%5D%5B1%5D")
/Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Adapter/AbstractAdapter.php:144
[0x7f604dc1f300]
Symfony\Component\Cache\Adapter\ChainAdapter->getItem("%5B%5BC%5DKidslox%5CDevice%5CProfileBundle%5CEntity%5CDisabledAppPayload%24forceProxy%40%5BAnnot%5D%5D%5B1%5D")
/Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Adapter/ChainAdapter.php:80
[0x7f604dc1f1b0]
Symfony\Component\Cache\Adapter\TraceableAdapter->getItem("%5B%5BC%5DKidslox%5CDevice%5CProfileBundle%5CEntity%5CDisabledAppPayload%24forceProxy%40%5BAnnot%5D%5D%5B1%5D")
/Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Adapter/TraceableAdapter.php:40
[0x7f604dc1f0d0]
Symfony\Component\Cache\DoctrineProvider->doFetch("[[C]Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload$forceProxy@[Annot]][1]")
/Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/DoctrineProvider.php:34
[0x7f604dc1f050]
Doctrine\Common\Cache\CacheProvider->fetch("[C]Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload$forceProxy@[Annot]")
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/cache/lib/Doctrine/Common/Cache/CacheProvider.php:78
[0x7f604dc1ef50]
Doctrine\Common\Annotations\CachedReader->isCacheFresh("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload$forceProxy@[Annot]",
object[0x7f604dc1efb0])
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/CachedReader.php:233
[0x7f604dc1ee20]
Doctrine\Common\Annotations\CachedReader->fetchFromCache("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload$forceProxy",
object[0x7f604dc1ee80])
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/CachedReader.php:194
[0x7f604dc1ec50]
Doctrine\Common\Annotations\CachedReader->getPropertyAnnotations(object[0x7f604dc1eca0])
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/CachedReader.php:116
[0x7f604dc1eb90]
Doctrine\Common\Annotations\CachedReader->getPropertyAnnotation(object[0x7f604dc1ebe0],
"Doctrine\ORM\Mapping\JoinColumn")
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/CachedReader.php:129
[0x7f604dc1ca50]
Doctrine\ORM\Mapping\Driver\AnnotationDriver->loadMetadataForClass("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload",
object[0x7f604dc1cab0])
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Mapping/Driver/AnnotationDriver.php:280
[0x7f604dc1c8e0]
Doctrine\Common\Persistence\Mapping\Driver\MappingDriverChain->loadMetadataForClass("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload",
object[0x7f604dc1c940])
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/common/lib/Doctrine/Common/Persistence/Mapping/Driver/MappingDriverChain.php:102
[0x7f604dc1c0c0]
Doctrine\ORM\Mapping\ClassMetadataFactory->doLoadMetadata(object[0x7f604dc1c110],
object[0x7f604dc1c120], true, array(1)[0x7f604dc1c140])
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Mapping/ClassMetadataFactory.php:151
[0x7f604dc1bdd0]
Doctrine\Common\Persistence\Mapping\AbstractClassMetadataFactory->loadMetadata("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload")
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/common/lib/Doctrine/Common/Persistence/Mapping/AbstractClassMetadataFactory.php:332
[0x7f604dc1bce0]
Doctrine\ORM\Mapping\ClassMetadataFactory->loadMetadata("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload")
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Mapping/ClassMetadataFactory.php:78
[0x7f604dc1b8b0]
Doctrine\Common\Persistence\Mapping\AbstractClassMetadataFactory->getMetadataFor("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload")
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/common/lib/Doctrine/Common/Persistence/Mapping/AbstractClassMetadataFactory.php:216
[0x7f604dc1b830]
Doctrine\ORM\EntityManager->getClassMetadata("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload")
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/EntityManager.php:281
---Type <return> to continue, or q <return> to quit---
[0x7f604dc1b260]
Doctrine\ORM\Persisters\Entity\SingleTablePersister->getSelectColumnsSQL()
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Persisters/Entity/SingleTablePersister.php:71
[0x7f604dc1ac10]
Doctrine\ORM\Persisters\Entity\BasicEntityPersister->getSelectSQL(array(1)[0x7f604dc1ac60],
array(15)[0x7f604dc1ac70], NULL, NULL, NULL)
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Persisters/Entity/BasicEntityPersister.php:1070
[0x7f604dc1a650]
Doctrine\ORM\Persisters\Entity\BasicEntityPersister->getOneToManyStatement(array(15)[0x7f604dc1a6a0],
object[0x7f604dc1a6b0])
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Persisters/Entity/BasicEntityPersister.php:1805
[0x7f604dc1a590]
Doctrine\ORM\Persisters\Entity\BasicEntityPersister->loadOneToManyCollection(array(15)[0x7f604dc1a5e0],
object[0x7f604dc1a5f0], object[0x7f604dc1a600])
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Persisters/Entity/BasicEntityPersister.php:1747
[0x7f604dc1a430]
Doctrine\ORM\UnitOfWork->loadCollection(object[0x7f604dc1a480])
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/UnitOfWork.php:2835
[0x7f604dc1a2c0] Doctrine\ORM\PersistentCollection->doInitialize()
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/PersistentCollection.php:699
[0x7f604dc1a210] Doctrine\ORM\PersistentCollection->initialize()
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/PersistentCollection.php:214
[0x7f604dc1a190]
Doctrine\Common\Collections\AbstractLazyCollection->getIterator()
/Users/mcfedr/projects/kidslox/server2/vendor/doctrine/collections/lib/Doctrine/Common/Collections/AbstractLazyCollection.php:274
...

-- 
Edit bug report at https://bugs.php.net/bug.php?id=74877&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=74877&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=74877&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=74877&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=74877&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=74877&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=74877&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=74877&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=74877&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=74877&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=74877&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=74877&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=74877&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=74877&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=74877&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=74877&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=74877&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=74877&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=74877&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=74877&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=74877&r=mysqlcfg



Thread (14 messages)

« previous php.bugs (#209906) next »