Bug #66458 [Opn->Fbk]: Segmentation fault & zend_mm_heap corrupted

Edit report at https://bugs.php.net/bug.php?id=66458&edit=1 ID: 66458 Updated by: cmb@php.net Reported by: jeanseb@php.net Summary: Segmentation fault & zend_mm_heap corrupted -Status: Open +Status: Feedback Type: Bug Package: Reproducible crash Operating System: CentOS 6.4 PHP Version: 5.4.23 -Assigned To: +Assigned To: cmb Block user comment: N Private report: N New Comment: Is this still an issue? Previous Comments: ------------------------------------------------------------------------ [2014-01-17 12:18:56] jeanseb@php.net Little followup : I replace Apc with ZendOpCache + Memcache. In this configuration, Apache segfaults only once frequently but I have lots of zend_mm_heap corrupted. Disabling opcache.fastshutdown seens to solve the problems (https://bugs.php.net/bug.php?id=65590#1378722278). Fingers crossed... ------------------------------------------------------------------------ [2014-01-13 12:54:55] jeanseb at au-fil-du dot net I have a second coredump which is different from the first one. Program terminated with signal 11, Segmentation fault. #0 is_derived_class (object_ptr=<value optimized out>, method_name=0x7fdab37f3e00 "getProlongation", method_len=15, key=0x7fdab37f38d8) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_object_handlers.c:258 258 /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_object_handlers.c: No such file or directory. in /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_object_handlers.c Missing separate debuginfos, use: debuginfo-install httpd-2.2.25-1.el6.x86_64 (gdb) bt #0 is_derived_class (object_ptr=<value optimized out>, method_name=0x7fdab37f3e00 "getProlongation", method_len=15, key=0x7fdab37f38d8) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_object_handlers.c:258 #1 zend_std_get_method (object_ptr=<value optimized out>, method_name=0x7fdab37f3e00 "getProlongation", method_len=15, key=0x7fdab37f38d8) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_object_handlers.c:1054 #2 0x00007fdacaa48530 in ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER (execute_data=0x7fdad5357458) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_vm_execute.h:22391 #3 0x00007fdacaa35bf8 in execute (op_array=0x7fdad79f1f58) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_vm_execute.h:410 #4 0x00007fdaca9c04ac in zend_call_function (fci=0x7fffb5170b00, fci_cache=<value optimized out>) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_execute_API.c:956 #5 0x00007fdaca90fd07 in zif_call_user_func_array (ht=<value optimized out>, return_value=0x7fdad6c65ae8, return_value_ptr=<value optimized out>, this_ptr=<value optimized out>, return_value_used=<value optimized out>) at /data/remi/rpmbuild/BUILD/php-5.4.23/ext/standard/basic_functions.c:4750 #6 0x00007fdacaa41c1c in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_vm_execute.h:643 #7 0x00007fdacaa35bf8 in execute (op_array=0x7fdad6e96e10) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_vm_execute.h:410 #8 0x00007fdaca9cc4e0 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend.c:1319 #9 0x00007fdaca96f927 in php_execute_script (primary_file=0x7fffb51730f0) at /data/remi/rpmbuild/BUILD/php-5.4.23/main/main.c:2502 #10 0x00007fdacaa776d5 in php_handler (r=0x7fdad6c06040) at /data/remi/rpmbuild/BUILD/php-5.4.23/sapi/apache2handler/sapi_apache2.c:667 #11 0x00007fdad5444430 in ap_run_handler () #12 0x00007fdad5447cbe in ap_invoke_handler () #13 0x00007fdad545329c in ap_internal_redirect () #14 0x00007fdacc458965 in ?? () from /etc/httpd/modules/mod_rewrite.so #15 0x00007fdad5444430 in ap_run_handler () #16 0x00007fdad5447cbe in ap_invoke_handler () #17 0x00007fdad5453460 in ap_process_request () #18 0x00007fdad5450248 in ?? () #19 0x00007fdad544bf48 in ap_run_process_connection () #20 0x00007fdad5458497 in ?? () #21 0x00007fdad54587ba in ?? () #22 0x00007fdad5458aeb in ap_mpm_run () #23 0x00007fdad542fd55 in main () ------------------------------------------------------------------------ [2014-01-13 12:43:14] jeanseb at au-fil-du dot net With bt : #0 zend_mm_remove_from_free_list (heap=0x7fdad694b130, mm_block=0xffffffffffff7fb8) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_alloc.c:786 786 /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_alloc.c: No such file or directory. in /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_alloc.c Missing separate debuginfos, use: debuginfo-install httpd-2.2.25-1.el6.x86_64 (gdb) bt #0 zend_mm_remove_from_free_list (heap=0x7fdad694b130, mm_block=0xffffffffffff7fb8) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_alloc.c:786 #1 0x00007fdaca9a7bce in _zend_mm_free_int (heap=0x7fdad694b130, p=0x7fdad77f6698) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_alloc.c:2106 #2 0x00007fdaca9da13d in zend_hash_destroy (ht=0x7fdad77c05d8) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_hash.c:563 #3 0x00007fdaca9cc1bb in _zval_dtor_func (zvalue=0x7fdad77f3e20) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_variables.c:45 #4 0x00007fdaca9bf75a in _zval_dtor (zval_ptr=0x7fdad74e6ab0) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_variables.h:35 #5 _zval_ptr_dtor (zval_ptr=0x7fdad74e6ab0) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_execute_API.c:436 #6 0x00007fdac7f39b96 in apc_free_class_entry_after_execution (src=0x7fdad77efba0) at /data/remi/rpmbuild/BUILD/php-pecl-apc-3.1.15/APC-3.1.15/apc_compile.c:2094 #7 0x00007fdac7f3d78c in apc_deactivate () at /data/remi/rpmbuild/BUILD/php-pecl-apc-3.1.15/APC-3.1.15/apc_main.c:1041 #8 apc_request_shutdown () at /data/remi/rpmbuild/BUILD/php-pecl-apc-3.1.15/APC-3.1.15/apc_main.c:1112 #9 0x00007fdac7f32ea5 in zm_deactivate_apc (type=<value optimized out>, module_number=<value optimized out>) at /data/remi/rpmbuild/BUILD/php-pecl-apc-3.1.15/APC-3.1.15/php_apc.c:412 #10 0x00007fdaca9d3374 in zend_deactivate_modules () at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_API.c:2370 #11 0x00007fdaca970515 in php_request_shutdown (dummy=<value optimized out>) at /data/remi/rpmbuild/BUILD/php-5.4.23/main/main.c:1777 #12 0x00007fdacaa775e7 in php_apache_request_dtor (r=0x7fdad70751d0) at /data/remi/rpmbuild/BUILD/php-5.4.23/sapi/apache2handler/sapi_apache2.c:507 #13 php_handler (r=0x7fdad70751d0) at /data/remi/rpmbuild/BUILD/php-5.4.23/sapi/apache2handler/sapi_apache2.c:679 #14 0x00007fdad5444430 in ap_run_handler () #15 0x00007fdad5447cbe in ap_invoke_handler () #16 0x00007fdad545329c in ap_internal_redirect () #17 0x00007fdacc458965 in ?? () from /etc/httpd/modules/mod_rewrite.so #18 0x00007fdad5444430 in ap_run_handler () #19 0x00007fdad5447cbe in ap_invoke_handler () #20 0x00007fdad5453460 in ap_process_request () #21 0x00007fdad5450248 in ?? () #22 0x00007fdad544bf48 in ap_run_process_connection () #23 0x00007fdad5458497 in ?? () #24 0x00007fdad54587ba in ?? () #25 0x00007fdad5458aeb in ap_mpm_run () #26 0x00007fdad542fd55 in main () ------------------------------------------------------------------------ [2014-01-13 10:28:02] jeanseb at au-fil-du dot net I have a coredump. And gdb give me that (without debug symbols) : Core was generated by `/usr/sbin/httpd'. Program terminated with signal 11, Segmentation fault. #0 zend_mm_remove_from_free_list (heap=0x7fdad694b130, mm_block=0xffffffffffff7fb8) at /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_alloc.c:786 786 /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_alloc.c: No such file or directory. in /data/remi/rpmbuild/BUILD/php-5.4.23/Zend/zend_alloc.c ------------------------------------------------------------------------ [2014-01-11 06:34:29] krakjoe@php.net Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. I'm aware you said you cannot find a way to reproduce, however that doesn't change what we require in order to assist you. We have no way of guessing what the problem is, we require a reproduce script in order to see the bug for ourselves. Please try to recreate the problem, and send us code. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=66458 -- Edit this bug report at https://bugs.php.net/bug.php?id=66458&edit=1