Bug #76339 [Opn]: segfault during shutdown

Edit report at https://bugs.php.net/bug.php?id=76339&edit=1 ID: 76339 Updated by: nikic@php.net Reported by: ray dot ward at bigcommerce dot com Summary: segfault during shutdown Status: Open Type: Bug Package: opcache Operating System: Debian 8.10 PHP Version: 7.2.5 Block user comment: N Private report: N New Comment: Can you please try running PHP under valgrind using "USE_ZEND_ALLOC=0 valgrind php script.php" and post the resulting log? If you you can only reproduce under FPM, it should be possible to run FPM using "USE_ZEND_ALLOC=0 valgrind --trace-children=yes php-fpm". Also, can you provide your opcache configuration (e.g. do you use file cache?) and which extensions you have enabled? Previous Comments: ------------------------------------------------------------------------ [2018-05-14 07:28:31] ray dot ward at bigcommerce dot com disabling either of these flags for opcache.optimization_level makes the segfault go away ZEND_OPTIMIZER_PASS_1 (1<<0) /* CSE, STRING construction */ ZEND_OPTIMIZER_PASS_11 (1<<10) /* Merge equal constants */ ------------------------------------------------------------------------ [2018-05-14 05:12:30] ray dot ward at bigcommerce dot com Description: ------------ We're experiencing occasional segfaults during php shutdown php-fpm7.2[12494]: segfault at 0 ip 0000000000605e5b sp 00007fff78ece470 error 6 in php-fpm7.2[400000+35e000] Unfortunately I don't have much to go on apart from a GDB trace: Program received signal SIGSEGV, Segmentation fault. gc_mark_grey (ref=0x0) at ./Zend/zend_gc.c:562 #0 gc_mark_grey (ref=0x0) at ./Zend/zend_gc.c:562 #1 0x0000000000606ce8 in gc_mark_roots () at ./Zend/zend_gc.c:583 #2 zend_gc_collect_cycles () at ./Zend/zend_gc.c:1057 #3 0x0000000000606921 in gc_possible_root (ref=0x0) at ./Zend/zend_gc.c:286 #4 0x00000000005cab18 in gc_check_possible_root (ref=<optimized out>) at ./Zend/zend_gc.h:158 #5 i_zval_ptr_dtor (zval_ptr=0x7f318cfb6320, zval_ptr=0x7f318cfb6320) at ./Zend/zend_variables.h:51 #6 _zval_ptr_dtor (zval_ptr=zval_ptr@entry=0x7f318cfb6320) at ./Zend/zend_execute_API.c:532 #7 0x00000000004e633c in spl_object_storage_dtor (element=<optimized out>) at ./ext/spl/spl_observer.c:153 #8 0x00000000005ee825 in zend_hash_destroy (ht=ht@entry=0x7f3211c7c640) at ./Zend/zend_hash.c:1234 #9 0x00000000004e630a in spl_SplObjectStorage_free_storage (object=0x7f3211c7c6a8) at ./ext/spl/spl_observer.c:112 #10 0x000000000061ba8b in zend_objects_store_free_object_storage (objects=0x0, objects@entry=0xa0e0b8 <executor_globals+824>, fast_shutdown=152 '\230', fast_shutdown@entry=1 '\001') at ./Zend/zend_objects_API.c:105 #11 0x00000000005cb034 in shutdown_executor () at ./Zend/zend_execute_API.c:265 #12 0x00000000005dccbb in zend_deactivate () at ./Zend/zend.c:1036 #13 0x0000000000576e0a in php_request_shutdown (dummy=<optimized out>) at ./main/main.c:1904 #14 0x000000000042dd78 in main (argc=17133702, argv=0x1057043) at ./sapi/fpm/fpm/fpm_main.c:1994 _May_ be opcache related, disabling opcache eliminated the segfault. We rely on complex shutdown functions. Perhaps an object being referenced in a function has been GC'd already? ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76339&edit=1