Bug #78175 [Csd]: Preloading segfaults at preload time and at runtime

Edit report at https://bugs.php.net/bug.php?id=78175&edit=1 ID: 78175 User updated by: nicolas dot grekas+php at gmail dot com Reported by: nicolas dot grekas+php at gmail dot com Summary: Preloading segfaults at preload time and at runtime Status: Closed Type: Bug Package: opcache PHP Version: 7.4.0alpha1 Assigned To: dmitry Block user comment: N Private report: N New Comment: The crash still exists, this time on a second request: run php info.php twice, the second time crashed the server. Previous Comments: ------------------------------------------------------------------------ [2019-06-18 14:19:28] dmitry@php.net Automatic comment on behalf of dmitry@zend.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=148eb202268b0c2786e9f541b46138e5d1271761 Log: Fixed bug #78175 (Preloading segfaults at preload time and at runtime) ------------------------------------------------------------------------ [2019-06-17 14:35:52] nikic@php.net Dmitry, can you take a look? I think we should create a stronger separation between preloading script and preloaded files. That is, require the use of opcache_compile_file() on everything that should be preloaded -- all other executed code (including include and require) should not be preloaded (or even cached, for that matter). Does that make sense? ------------------------------------------------------------------------ [2019-06-17 14:27:49] nikic@php.net First valgrind warning: ==4693== Invalid read of size 4 ==4693== at 0x93E9A9: zend_gc_delref (zend_types.h:1030) ==4693== by 0x93FAE1: gc_mark_grey (zend_gc.c:823) ==4693== by 0x940093: gc_mark_roots (zend_gc.c:958) ==4693== by 0x9412BE: zend_gc_collect_cycles (zend_gc.c:1434) ==4693== by 0x8EC2ED: shutdown_executor (zend_execute_API.c:277) ==4693== by 0x905C9B: zend_deactivate (zend.c:1178) ==4693== by 0x86950A: php_request_shutdown (main.c:1971) ==4693== by 0x10C23D4C: accel_finish_startup (ZendAccelerator.c:4340) ==4693== by 0x10C1F463: accel_post_startup (ZendAccelerator.c:2971) ==4693== by 0x90577B: zend_post_startup (zend.c:992) ==4693== by 0x86A265: php_module_startup (main.c:2399) ==4693== by 0x9EC4B0: php_cli_startup (php_cli.c:408) ==4693== Address 0x1116e600 is 0 bytes inside a block of size 56 free'd ==4693== at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==4693== by 0x8CCED1: _efree_custom (zend_alloc.c:2392) ==4693== by 0x8CD012: _efree (zend_alloc.c:2512) ==4693== by 0x10C4464F: _zend_shared_memdup (zend_shared_alloc.c:386) ==4693== by 0x10C446C3: zend_shared_memdup_put_free (zend_shared_alloc.c:398) ==4693== by 0x10C29858: zend_persist_zval (zend_persist.c:212) ==4693== by 0x10C2C754: zend_persist_class_entry (zend_persist.c:738) ==4693== by 0x10C2F5B3: zend_accel_persist_class_table (zend_persist.c:1028) ==4693== by 0x10C2F8CB: zend_accel_script_persist (zend_persist.c:1070) ==4693== by 0x10C2272B: preload_script_in_shared_memory (ZendAccelerator.c:3939) ==4693== by 0x10C236EA: accel_preload (ZendAccelerator.c:4187) ==4693== by 0x10C23D1E: accel_finish_startup (ZendAccelerator.c:4334) ==4693== Block was alloc'd at ==4693== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==4693== by 0x8CDC4F: __zend_malloc (zend_alloc.c:2895) ==4693== by 0x8CCE6A: _malloc_custom (zend_alloc.c:2383) ==4693== by 0x8CCF98: _emalloc (zend_alloc.c:2502) ==4693== by 0x91A582: _zend_new_array (zend_hash.c:256) ==4693== by 0x8E31D5: zend_try_ct_eval_array (zend_compile.c:7013) ==4693== by 0x8E8ABE: zend_eval_const_expr (zend_compile.c:8834) ==4693== by 0x8E7108: zend_const_expr_to_zval (zend_compile.c:8286) ==4693== by 0x8E003E: zend_compile_prop_decl (zend_compile.c:6023) ==4693== by 0x8E02E6: zend_compile_prop_group (zend_compile.c:6072) ==4693== by 0x8E7629: zend_compile_stmt (zend_compile.c:8409) ==4693== by 0x8DD43E: zend_compile_stmt_list (zend_compile.c:5176) Looks like GC is trying to use some structures that have been moved to SHM. Here is a very simple way to cause a crash (use as preload script). <?php register_shutdown_function(function() { echo "Shutdown\n"; }); It's not quite the same, but I think the root cause is basically the same. ------------------------------------------------------------------------ [2019-06-17 12:48:06] nicolas dot grekas+php at gmail dot com Description: ------------ From the code in this archive: https://send.firefox.com/download/f87c7176853e1dfa/#YxTCKp75r1nMwmq-PJfnSg Two separate crashes here: Cannot load the autoloader -------------------------- Run bin/console c:c && php -dopcache.preload=var/cache/dev/srcApp_KernelDevDebugContainer.preload.php -S localhost:8000 in this directory. This should spawn a web server with two ignorable warnings saying "Can't preload already declared class class@anonymous". Then in another console run php info.php. This makes the server process segfault. Cannot run preloading script ---------------------------- Add a return; line 321 in vendor/symfony/dependency-injection/Dumper/PhpDumper.php (just after $r->getDefaultProperties();). Run bin/console c:c && php -dopcache.preload=var/cache/dev/srcApp_KernelDevDebugContainer.preload.php -S localhost:8000 in this directory. This fails with a segfault. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78175&edit=1