Bug #74877 [Opn]: Segmentation fault in zend_mm_alloc_small

Edit report at https://bugs.php.net/bug.php?id=74877&edit=1 ID: 74877 Updated by: laruence@php.net Reported by: mcfedr at gmail dot com Summary: Segmentation fault in zend_mm_alloc_small Status: Open Type: Bug Package: Reproducible crash Operating System: linux/macos PHP Version: 7.1.7 Block user comment: N Private report: N New Comment: do you use any third-part extensions? to me, this backtrace seems like a write-after-free side-affect. thanks Previous Comments: ------------------------------------------------------------------------ [2017-07-07 20:22:49] mcfedr at gmail dot com Confirmed on 7.1.0, 7.1.7 and 7.2.0alhpa3 ------------------------------------------------------------------------ [2017-07-07 19:03:17] mcfedr at gmail dot com I can potentially give access to the code to someone privately, but it is commercial code. ------------------------------------------------------------------------ [2017-07-07 17:59:12] mcfedr at gmail dot com Description: ------------ This crash happens in exactly the same place each time i run this script. Its actually my entire phpunit suite for a big project, so its not easy to pin down a short reproducible test script. If I run the individual test where the crash happens only there is no crash. I have tried running, calling gc_disable() at the start and this crash doesnt happen. Its a Symfony project, and the crash only happens with Symfony 3.3, no crashes for Symfony 3.2, but the size of a Symfony update makes it hard to put a finger on the change that causes the issue. Only crashes on php >7.1 - its fine on <=7.0. I'm very willing to provide more information, I just dont know what to add at this point. Actual result: -------------- Core was generated by `php ./vendor/bin/phpunit'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000557af77e66ae in zend_mm_alloc_small (heap=0x7f604dc00040, size=216, bin_num=14, __zend_filename=0x557af7e7b100 "/usr/src/php/Zend/zend_string.h", __zend_lineno=122, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1261 1261 heap->free_slot[bin_num] = p->next_free_slot; (gdb) bt #0 0x0000557af77e66ae in zend_mm_alloc_small (heap=0x7f604dc00040, size=216, bin_num=14, __zend_filename=0x557af7e7b100 "/usr/src/php/Zend/zend_string.h", __zend_lineno=122, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1261 #1 0x0000557af77e6950 in zend_mm_alloc_heap (heap=0x7f604dc00040, size=216, __zend_filename=0x557af7e7b100 "/usr/src/php/Zend/zend_string.h", __zend_lineno=122, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1332 #2 0x0000557af77e9397 in _emalloc (size=184, __zend_filename=0x557af7e7b100 "/usr/src/php/Zend/zend_string.h", __zend_lineno=122, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:2417 #3 0x0000557af787bb18 in zend_string_alloc (len=158, persistent=0) at /usr/src/php/Zend/zend_string.h:122 #4 0x0000557af78ffa50 in ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER () at /usr/src/php/Zend/zend_vm_execute.h:54658 #5 0x0000557af7884fd2 in execute_ex (ex=0x7f604dc1a190) at /usr/src/php/Zend/zend_vm_execute.h:429 #6 0x0000557af780880c in zend_call_function (fci=0x7ffec2dd1cb0, fci_cache=0x7ffec2dd1c80) at /usr/src/php/Zend/zend_execute_API.c:855 #7 0x0000557af784b62e in zend_call_method (object=0x7f604dc1a160, obj_ce=0x7f6043809c68, fn_proxy=0x7f6043809dc0, function_name=0x557af7e771af "getiterator", function_name_len=11, retval_ptr=0x7ffec2dd1d80, param_count=0, arg1=0x0, arg2=0x0) at /usr/src/php/Zend/zend_interfaces.c:99 #8 0x0000557af784b89d in zend_user_it_new_iterator (ce=0x7f6043809c68, object=0x7f604dc1a160, retval=0x7ffec2dd1d80) at /usr/src/php/Zend/zend_interfaces.c:130 #9 0x0000557af784bea9 in zend_user_it_get_new_iterator (ce=0x7f6043809c68, object=0x7f604dc1a160, by_ref=0) at /usr/src/php/Zend/zend_interfaces.c:282 #10 0x0000557af78a958c in ZEND_FE_RESET_R_SPEC_VAR_HANDLER () at /usr/src/php/Zend/zend_vm_execute.h:16508 #11 0x0000557af7884fd2 in execute_ex (ex=0x7f604dc18c60) at /usr/src/php/Zend/zend_vm_execute.h:429 #12 0x0000557af780880c in zend_call_function (fci=0x7ffec2dd20d0, fci_cache=0x7ffec2dd20a0) at /usr/src/php/Zend/zend_execute_API.c:855 #13 0x0000557af75fa599 in reflection_method_invoke (execute_data=0x7f604dc18bf0, return_value=0x7f604dc18880, variadic=0) at /usr/src/php/ext/reflection/php_reflection.c:3331 #14 0x0000557af75fa762 in zim_reflection_method_invokeArgs (execute_data=0x7f604dc18bf0, return_value=0x7f604dc18880) at /usr/src/php/ext/reflection/php_reflection.c:3367 #15 0x0000557af7886c2e in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /usr/src/php/Zend/zend_vm_execute.h:1097 #16 0x0000557af7884fd2 in execute_ex (ex=0x7f604dc14030) at /usr/src/php/Zend/zend_vm_execute.h:429 #17 0x0000557af78850e7 in zend_execute (op_array=0x7f604dc7f000, return_value=0x0) at /usr/src/php/Zend/zend_vm_execute.h:474 #18 0x0000557af7822368 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php/Zend/zend.c:1476 #19 0x0000557af7786fbb in php_execute_script (primary_file=0x7ffec2dd4820) at /usr/src/php/main/main.c:2537 #20 0x0000557af790bc03 in do_cli (argc=2, argv=0x557af9ff4090) at /usr/src/php/sapi/cli/php_cli.c:993 #21 0x0000557af790cdb8 in main (argc=2, argv=0x557af9ff4090) at /usr/src/php/sapi/cli/php_cli.c:1381 (gdb) zbacktrace [0x7f604dc1f8f0] Symfony\Component\Cache\Adapter\FilesystemAdapter->getFile("%5B%5BC%5DKidslox%5CDevice%5CProfileBundle%5CEntity%5CDisabledAppPayload%24forceProxy%40%5BAnnot%5D%5D%5B1%5D") /Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Traits/FilesystemCommonTrait.php:101 [0x7f604dc1f630] Symfony\Component\Cache\Adapter\FilesystemAdapter->doFetch(array(1)[0x7f604dc1f680]) /Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Traits/FilesystemTrait.php:34 [0x7f604dc1f480] Symfony\Component\Cache\Adapter\AbstractAdapter->getItem("%5B%5BC%5DKidslox%5CDevice%5CProfileBundle%5CEntity%5CDisabledAppPayload%24forceProxy%40%5BAnnot%5D%5D%5B1%5D") /Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Adapter/AbstractAdapter.php:144 [0x7f604dc1f300] Symfony\Component\Cache\Adapter\ChainAdapter->getItem("%5B%5BC%5DKidslox%5CDevice%5CProfileBundle%5CEntity%5CDisabledAppPayload%24forceProxy%40%5BAnnot%5D%5D%5B1%5D") /Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Adapter/ChainAdapter.php:80 [0x7f604dc1f1b0] Symfony\Component\Cache\Adapter\TraceableAdapter->getItem("%5B%5BC%5DKidslox%5CDevice%5CProfileBundle%5CEntity%5CDisabledAppPayload%24forceProxy%40%5BAnnot%5D%5D%5B1%5D") /Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/Adapter/TraceableAdapter.php:40 [0x7f604dc1f0d0] Symfony\Component\Cache\DoctrineProvider->doFetch("[[C]Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload$forceProxy@[Annot]][1]") /Users/mcfedr/projects/kidslox/server2/vendor/symfony/symfony/src/Symfony/Component/Cache/DoctrineProvider.php:34 [0x7f604dc1f050] Doctrine\Common\Cache\CacheProvider->fetch("[C]Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload$forceProxy@[Annot]") /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/cache/lib/Doctrine/Common/Cache/CacheProvider.php:78 [0x7f604dc1ef50] Doctrine\Common\Annotations\CachedReader->isCacheFresh("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload$forceProxy@[Annot]", object[0x7f604dc1efb0]) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/CachedReader.php:233 [0x7f604dc1ee20] Doctrine\Common\Annotations\CachedReader->fetchFromCache("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload$forceProxy", object[0x7f604dc1ee80]) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/CachedReader.php:194 [0x7f604dc1ec50] Doctrine\Common\Annotations\CachedReader->getPropertyAnnotations(object[0x7f604dc1eca0]) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/CachedReader.php:116 [0x7f604dc1eb90] Doctrine\Common\Annotations\CachedReader->getPropertyAnnotation(object[0x7f604dc1ebe0], "Doctrine\ORM\Mapping\JoinColumn") /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/annotations/lib/Doctrine/Common/Annotations/CachedReader.php:129 [0x7f604dc1ca50] Doctrine\ORM\Mapping\Driver\AnnotationDriver->loadMetadataForClass("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload", object[0x7f604dc1cab0]) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Mapping/Driver/AnnotationDriver.php:280 [0x7f604dc1c8e0] Doctrine\Common\Persistence\Mapping\Driver\MappingDriverChain->loadMetadataForClass("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload", object[0x7f604dc1c940]) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/common/lib/Doctrine/Common/Persistence/Mapping/Driver/MappingDriverChain.php:102 [0x7f604dc1c0c0] Doctrine\ORM\Mapping\ClassMetadataFactory->doLoadMetadata(object[0x7f604dc1c110], object[0x7f604dc1c120], true, array(1)[0x7f604dc1c140]) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Mapping/ClassMetadataFactory.php:151 [0x7f604dc1bdd0] Doctrine\Common\Persistence\Mapping\AbstractClassMetadataFactory->loadMetadata("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload") /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/common/lib/Doctrine/Common/Persistence/Mapping/AbstractClassMetadataFactory.php:332 [0x7f604dc1bce0] Doctrine\ORM\Mapping\ClassMetadataFactory->loadMetadata("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload") /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Mapping/ClassMetadataFactory.php:78 [0x7f604dc1b8b0] Doctrine\Common\Persistence\Mapping\AbstractClassMetadataFactory->getMetadataFor("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload") /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/common/lib/Doctrine/Common/Persistence/Mapping/AbstractClassMetadataFactory.php:216 [0x7f604dc1b830] Doctrine\ORM\EntityManager->getClassMetadata("Kidslox\Device\ProfileBundle\Entity\DisabledAppPayload") /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/EntityManager.php:281 ---Type <return> to continue, or q <return> to quit--- [0x7f604dc1b260] Doctrine\ORM\Persisters\Entity\SingleTablePersister->getSelectColumnsSQL() /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Persisters/Entity/SingleTablePersister.php:71 [0x7f604dc1ac10] Doctrine\ORM\Persisters\Entity\BasicEntityPersister->getSelectSQL(array(1)[0x7f604dc1ac60], array(15)[0x7f604dc1ac70], NULL, NULL, NULL) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Persisters/Entity/BasicEntityPersister.php:1070 [0x7f604dc1a650] Doctrine\ORM\Persisters\Entity\BasicEntityPersister->getOneToManyStatement(array(15)[0x7f604dc1a6a0], object[0x7f604dc1a6b0]) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Persisters/Entity/BasicEntityPersister.php:1805 [0x7f604dc1a590] Doctrine\ORM\Persisters\Entity\BasicEntityPersister->loadOneToManyCollection(array(15)[0x7f604dc1a5e0], object[0x7f604dc1a5f0], object[0x7f604dc1a600]) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/Persisters/Entity/BasicEntityPersister.php:1747 [0x7f604dc1a430] Doctrine\ORM\UnitOfWork->loadCollection(object[0x7f604dc1a480]) /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/UnitOfWork.php:2835 [0x7f604dc1a2c0] Doctrine\ORM\PersistentCollection->doInitialize() /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/PersistentCollection.php:699 [0x7f604dc1a210] Doctrine\ORM\PersistentCollection->initialize() /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/orm/lib/Doctrine/ORM/PersistentCollection.php:214 [0x7f604dc1a190] Doctrine\Common\Collections\AbstractLazyCollection->getIterator() /Users/mcfedr/projects/kidslox/server2/vendor/doctrine/collections/lib/Doctrine/Common/Collections/AbstractLazyCollection.php:274 ... ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74877&edit=1