Bug #76446 [Ana]: zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc.

Edit report at https://bugs.php.net/bug.php?id=76446&edit=1 ID: 76446 Updated by: laruence@php.net Reported by: spam2 at rhsoft dot net Summary: zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc. Status: Analyzed Type: Bug Package: Reproducible crash PHP Version: master-Git-2018-06-11 (Git) Block user comment: N Private report: N New Comment: is that possible that you could grant me a ssh access to your box to debugging it? (vid mail) that will be much helpful :) Previous Comments: ------------------------------------------------------------------------ [2018-06-11 20:46:58] spam2 at rhsoft dot net https://git.php.net/?p=php-src.git;a=commit;h=e4e334effb9d8b6945e045fa97133f5a65d45ea6 (Remove dead code for ADD_STRING/ADD_CHAR optimization) still don't fix that * OK: cl_api->navigation_base_internal->test(0.023) zend_mm_heap corrupted php: /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc.u.type_info) & (1<<6))' failed. Program received signal SIGABRT, Aborted. 0x00007ffff68e2660 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.6-24.fc27.x86_64 cyrus-sasl-lib-2.1.26-34.fc27.x86_64 expat-2.2.5-1.fc27.x86_64 fontconfig-2.12.6-4.fc27.x86_64 freetype-2.8-8.fc27.x86_64 gd-2.2.5-3.fc27.x86_64 jbigkit-libs-2.1-8.fc27.x86_64 keyutils-libs-1.5.10-3.fc27.x86_64 krb5-libs-1.15.2-9.fc27.x86_64 libX11-1.6.5-4.fc27.x86_64 libXau-1.0.8-9.fc27.x86_64 libXpm-3.5.12-4.fc27.x86_64 libcom_err-1.43.5-2.fc27.x86_64 libcrypt-nss-2.26-28.fc27.x86_64 libcurl-7.55.1-12.fc27.x86_64 libgcc-7.3.1-5.fc27.x86_64 libgomp-7.3.1-5.fc27.x86_64 libicu-57.1-9.fc27.x86_64 libidn2-2.0.5-1.fc27.x86_64 libjpeg-turbo-1.5.3-1.fc27.x86_64 libnghttp2-1.31.1-1.fc27.x86_64 libpng-1.6.31-1.fc27.x86_64 libpsl-0.18.0-3.fc27.x86_64 libselinux-2.7-3.fc27.x86_64 libssh2-1.8.0-5.fc27.x86_64 libstdc++-7.3.1-5.fc27.x86_64 libtidy-5.4.0-3.fc27.x86_64 libtiff-4.0.9-10.fc27.x86_64 libunistring-0.9.10-1.fc27.x86_64 libwebp-1.0.0-1.fc27.x86_64 libxcb-1.12-5.fc27.x86_64 libxml2-2.9.7-1.fc2! 7.x86_64 libzip-1.3.2-1.fc27.x86_64 nspr-4.19.0-1.fc27.x86_64 nss-3.37.3-1.0.fc27.x86_64 nss-softokn-freebl-3.37.3-1.0.fc27.x86_64 nss-util-3.37.3-1.0.fc27.x86_64 openldap-2.4.45-4.fc27.x86_64 openssl-libs-1.1.0h-3.fc27.x86_64 pcre2-10.31-4.fc27.x86_64 systemd-libs-234-11.git5f8984e.fc27.x86_64 xz-libs-5.2.3-4.fc27.x86_64 (gdb) f 4 #4 0x000055555588a52e in zend_string_destroy (str=0x7fffe3d08b18, __zend_filename=0x5555559ce4a8 "/home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_vm_execute.h", __zend_lineno=12424) at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_variables.c:73 73 ZEND_ASSERT(!ZSTR_IS_INTERNED(str)); (gdb) p (char*)str->val $1 = 0x7fffe3d08b30 "&amp;openmenu=" ------------------------------------------------------------------------ [2018-06-11 13:48:58] nikic@php.net Can't say if it's *the* issue, but at least an issue is this: <?php "x{$a}y"; Crashes under opcache. Reason is that the ROPE_END is optimized away as dead code, leading to a FREE on ROPE_ADD, which is illegal. I think something similar to this would also cause your case. ------------------------------------------------------------------------ [2018-06-11 13:33:15] spam2 at rhsoft dot net there a 3 codelines in the whole codebase containing "&amp;openmenu=" from the last gdb-output which are basically "use rope instead of concat" $openstr = "&amp;openmenu={$local_row['hid']}{$addlang}"; $openstr2 = "&amp;openmenu={$openmenu}{$addlang}"; $open_part = "&amp;openmenu={$sid}{$langadd}"; Program received signal SIGABRT, Aborted. 0x00007ffff68e2660 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.6-24.fc27.x86_64 cyrus-sasl-lib-2.1.26-34.fc27.x86_64 expat-2.2.5-1.fc27.x86_64 fontconfig-2.12.6-4.fc27.x86_64 freetype-2.8-8.fc27.x86_64 gd-2.2.5-3.fc27.x86_64 jbigkit-libs-2.1-8.fc27.x86_64 keyutils-libs-1.5.10-3.fc27.x86_64 krb5-libs-1.15.2-9.fc27.x86_64 libX11-1.6.5-4.fc27.x86_64 libXau-1.0.8-9.fc27.x86_64 libXpm-3.5.12-4.fc27.x86_64 libcom_err-1.43.5-2.fc27.x86_64 libcrypt-nss-2.26-28.fc27.x86_64 libcurl-7.55.1-12.fc27.x86_64 libgcc-7.3.1-5.fc27.x86_64 libgomp-7.3.1-5.fc27.x86_64 libicu-57.1-9.fc27.x86_64 libidn2-2.0.5-1.fc27.x86_64 libjpeg-turbo-1.5.3-1.fc27.x86_64 libnghttp2-1.31.1-1.fc27.x86_64 libpng-1.6.31-1.fc27.x86_64 libpsl-0.18.0-3.fc27.x86_64 libselinux-2.7-3.fc27.x86_64 libssh2-1.8.0-5.fc27.x86_64 libstdc++-7.3.1-5.fc27.x86_64 libtidy-5.4.0-3.fc27.x86_64 libtiff-4.0.9-10.fc27.x86_64 libunistring-0.9.10-1.fc27.x86_64 libwebp-1.0.0-1.fc27.x86_64 libxcb-1.12-5.fc27.x86_64 libxml2-2.9.7-1.fc2! 7.x86_64 libzip-1.3.2-1.fc27.x86_64 nspr-4.19.0-1.fc27.x86_64 nss-3.37.3-1.0.fc27.x86_64 nss-softokn-freebl-3.37.3-1.0.fc27.x86_64 nss-util-3.37.3-1.0.fc27.x86_64 openldap-2.4.45-4.fc27.x86_64 openssl-libs-1.1.0h-3.fc27.x86_64 pcre2-10.31-4.fc27.x86_64 systemd-libs-234-11.git5f8984e.fc27.x86_64 xz-libs-5.2.3-4.fc27.x86_64 (gdb) f 4 #4 0x000055555588a52e in zend_string_destroy (str=0x7fffe3d08b18, __zend_filename=0x5555559ce468 "/home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_vm_execute.h", __zend_lineno=12424) at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_variables.c:73 73 ZEND_ASSERT(!ZSTR_IS_INTERNED(str)); (gdb) p (char*)str->val $1 = 0x7fffe3d08b30 "&amp;openmenu=" ------------------------------------------------------------------------ [2018-06-11 13:19:26] nikic@php.net Thanks for the backtrace. What is happening is that we're trying to destroy an interned string, which means that at some point we did not mark a zval as !refcounted when storing the string into it. However, the backtrace is extremely generic, so it's hard to say where the string came from. Can you please run "f 4" followed by "p (char*)str->val" when the assertion occurs? This will print the contents of the string and may help in tracking down where it is coming from (e.g. class name, method name or similar). ------------------------------------------------------------------------ [2018-06-11 11:06:58] spam2 at rhsoft dot net yeah, that works after set "kernel.yama.ptrace_scope = 2" to "kernel.yama.ptrace_scope = 1" in sysctl.conf :-) php: /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc.u.type_info) & (1<<6))' failed. Program received signal SIGABRT, Aborted. 0x00007ffff68e2660 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.6-24.fc27.x86_64 cyrus-sasl-lib-2.1.26-34.fc27.x86_64 expat-2.2.5-1.fc27.x86_64 fontconfig-2.12.6-4.fc27.x86_64 freetype-2.8-8.fc27.x86_64 gd-2.2.5-3.fc27.x86_64 jbigkit-libs-2.1-8.fc27.x86_64 keyutils-libs-1.5.10-3.fc27.x86_64 krb5-libs-1.15.2-9.fc27.x86_64 libX11-1.6.5-4.fc27.x86_64 libXau-1.0.8-9.fc27.x86_64 libXpm-3.5.12-4.fc27.x86_64 libcom_err-1.43.5-2.fc27.x86_64 libcrypt-nss-2.26-28.fc27.x86_64 libcurl-7.55.1-12.fc27.x86_64 libgcc-7.3.1-5.fc27.x86_64 libgomp-7.3.1-5.fc27.x86_64 libicu-57.1-9.fc27.x86_64 libidn2-2.0.5-1.fc27.x86_64 libjpeg-turbo-1.5.3-1.fc27.x86_64 libnghttp2-1.31.1-1.fc27.x86_64 libpng-1.6.31-1.fc27.x86_64 libpsl-0.18.0-3.fc27.x86_64 libselinux-2.7-3.fc27.x86_64 libssh2-1.8.0-5.fc27.x86_64 libstdc++-7.3.1-5.fc27.x86_64 libtidy-5.4.0-3.fc27.x86_64 libtiff-4.0.9-10.fc27.x86_64 libunistring-0.9.10-1.fc27.x86_64 libwebp-1.0.0-1.fc27.x86_64 libxcb-1.12-5.fc27.x86_64 libxml2-2.9.7-1.fc2! 7.x86_64 libzip-1.3.2-1.fc27.x86_64 nspr-4.19.0-1.fc27.x86_64 nss-3.37.3-1.0.fc27.x86_64 nss-softokn-freebl-3.37.3-1.0.fc27.x86_64 nss-util-3.37.3-1.0.fc27.x86_64 openldap-2.4.45-4.fc27.x86_64 openssl-libs-1.1.0h-3.fc27.x86_64 pcre2-10.31-4.fc27.x86_64 systemd-libs-234-11.git5f8984e.fc27.x86_64 xz-libs-5.2.3-4.fc27.x86_64 (gdb) bt #0 0x00007ffff68e2660 in raise () from /lib64/libc.so.6 #1 0x00007ffff68e3c41 in abort () from /lib64/libc.so.6 #2 0x00007ffff68daf7a in __assert_fail_base () from /lib64/libc.so.6 #3 0x00007ffff68daff2 in __assert_fail () from /lib64/libc.so.6 #4 0x000055555588a52e in zend_string_destroy (str=0x7fffe3d08b18, __zend_filename=0x5555559ce468 "/home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_vm_execute.h", __zend_lineno=12424) at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_variables.c:73 #5 0x000055555588a4a4 in _zval_dtor_func (p=0x7fffe3d08b18, __zend_filename=0x5555559ce468 "/home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_vm_execute.h", __zend_lineno=12424) at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_variables.c:67 #6 0x00005555558e8ec5 in _zval_ptr_dtor_nogc (zval_ptr=0x7ffff60206b0, __zend_filename=0x5555559ce468 "/home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_vm_execute.h", __zend_lineno=12424) at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_variables.h:40 #7 0x000055555590a8a5 in ZEND_FREE_SPEC_TMPVAR_HANDLER () at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_vm_execute.h:12424 #8 0x00005555559605c9 in execute_ex (ex=0x7ffff6020030) at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_vm_execute.h:55857 #9 0x00005555559646d1 in zend_execute (op_array=0x7ffff607d700, return_value=0x0) at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_vm_execute.h:59895 #10 0x000055555588e3c8 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend.c:1564 #11 0x00005555557fc9b0 in php_execute_script (primary_file=0x7fffffffdf10) at /home/builduser/rpmbuild/BUILD/php-7.3.0/main/main.c:2467 #12 0x0000555555967082 in do_cli (argc=4, argv=0x555555d1a100) at /home/builduser/rpmbuild/BUILD/php-7.3.0/sapi/cli/php_cli.c:1011 #13 0x000055555596803d in main (argc=4, argv=0x555555d1a100) at /home/builduser/rpmbuild/BUILD/php-7.3.0/sapi/cli/php_cli.c:1404 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=76446 -- Edit this bug report at https://bugs.php.net/bug.php?id=76446&edit=1