Bug #78255 [NEW]: general protection when opcode is enabled

From: whissi at whissi dot de Operating system: Linux PHP version: 7.3.7 Package: Reproducible crash Bug Type: Bug Bug description:general protection when opcode is enabled Description: ------------ I don't have a small reproducer to share yet (working on this), but at least I was able to catch a backtrace: # gdb /usr/lib64/php7.3/bin/php-fpm GNU gdb (Gentoo 8.3 vanilla) 8.3 Copyright (C) 2019 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-pc-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://bugs.gentoo.org/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/lib64/php7.3/bin/php-fpm... Reading symbols from /usr/lib64/debug//usr/lib64/php7.3/bin/php-fpm.debug... (gdb) (gdb) set follow-fork-mode child (gdb) r --nodaemonize --fpm-config /etc/php/fpm-php7.3/php-fpm.debug.conf Starting program: /usr/lib64/php7.3/bin/php-fpm --nodaemonize --fpm-config /etc/php/fpm-php7.3/php-fpm.debug.conf [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". [05-Jul-2019 17:51:27] NOTICE: fpm is running, pid 23812 [Attaching after Thread 0x7ffff480a980 (LWP 23812) fork to child process 23819] [New inferior 2 (process 23819)] [Detaching after fork from parent process 23812] [Inferior 1 (process 23812) detached] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". [05-Jul-2019 17:51:27] NOTICE: ready to handle connections Thread 2.1 "php-fpm" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff480a980 (LWP 23819)] zend_mm_alloc_small (bin_num=6, size=56, heap=0x7ffff4600040) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_alloc.c:1289 1289 /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_alloc.c: No such file or directory. (gdb) bt #0 zend_mm_alloc_small (bin_num=6, size=56, heap=0x7ffff4600040) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_alloc.c:1289 #1 _emalloc_56 () at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_alloc.c:2423 #2 0x0000555555a01dc9 in _zend_new_array_0 () at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_hash.c:217 #3 0x000055555592d361 in zif_explode (execute_data=0x7ffff46228c0, return_value=0x7ffff46228a0) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/standard/string.c:1173 #4 0x0000555555a7912f in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_vm_execute.h:690 #5 execute_ex (ex=0x7ffff4600040) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_vm_execute.h:55465 #6 0x00005555559e8bc1 in zend_call_function (fci=fci@entry=0x7fffffffac70, fci_cache=0x7fffb37d2a68, fci_cache@entry=0x7fffffffac50) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_execute_API.c:756 #7 0x000055555571ae95 in preg_do_repl_func (mark=<optimized out>, count=<optimized out>, subpat_names=0x0, offsets=0x55555662f390, subject=0x7fff927cf418 "[apress_testimonial by=\"Max Mustermann\" designation=\"t5 Content\" testimonialbordercolor=\"#eaeaea\" testimonialauthorcolor=\"#333333\"]Digitaler Content benötigt authentische Menschen, die diesen verfas"..., fcc=0x7fffffffac50, fci=0x7fffffffac70) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:1500 #8 php_pcre_replace_func_impl (pce=0x555556631ed0, subject_str=0x7fff927cf400, subject=0x7fff927cf418 "[apress_testimonial by=\"Max Mustermann\" designation=\"t5 Content\" testimonialbordercolor=\"#eaeaea\" testimonialauthorcolor=\"#333333\"]Digitaler Content benötigt authentische Menschen, die diesen verfas"..., subject_len=1592, fci=0x7fffffffac70, fcc=0x7fffffffac50, limit=18446744073709551614, replace_count=0x7fffffffabb8) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:1891 #9 0x000055555571c20c in php_pcre_replace_func (replace_count=0x7fffffffabb8, limit=18446744073709551615, fcc=0x7fffffffac50, fci=0x7fffffffac70, subject_str=0x7fff927cf400, regex=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2018 #10 php_replace_in_subject_func (fci=fci@entry=0x7fffffffac70, fcc=fcc@entry=0x7fffffffac50, subject=subject@entry=0x7ffff4621d60, limit=limit@entry=18446744073709551615, replace_count=0x7fffffffabb8, regex=<optimized out>, regex=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2145 #11 0x000055555571c487 in preg_replace_func_impl (regex=regex@entry=0x7ffff4621d40, fci=fci@entry=0x7fffffffac70, fcc=fcc@entry=0x7fffffffac50, subject=subject@entry=0x7ffff4621d60, limit_val=-1, return_value=<optimized out>, return_value=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2195 #12 0x000055555571c91e in zif_preg_replace_callback (execute_data=0x7ffff4621cf0, return_value=0x7ffff4621cc0) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2358 #13 0x0000555555a7912f in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_vm_execute.h:690 #14 execute_ex (ex=0x7ffff4600040) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_vm_execute.h:55465 #15 0x00005555559e8bc1 in zend_call_function (fci=fci@entry=0x7fffffffb0e0, fci_cache=0x7fffb3d80b90, fci_cache@entry=0x7fffffffb0c0) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_execute_API.c:756 #16 0x000055555571ae95 in preg_do_repl_func (mark=<optimized out>, count=<optimized out>, subpat_names=0x0, offsets=0x55555662ec50, subject=0x7fff92306018 "[vc_column width=\"1/3\" offset=\"vc_hidden-sm vc_hidden-xs\"][apress_testimonial by=\"Max Mustermann\" designation=\"t5 Content\" testimonialbordercolor=\"#eaeaea\" testimonialauthorcolor=\"#333333\"]Digitaler "..., fcc=0x7fffffffb0c0, fci=0x7fffffffb0e0) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:1500 #17 php_pcre_replace_func_impl (pce=0x555556631c40, subject_str=0x7fff92306000, subject=0x7fff92306018 "[vc_column width=\"1/3\" offset=\"vc_hidden-sm vc_hidden-xs\"][apress_testimonial by=\"Max Mustermann\" designation=\"t5 Content\" testimonialbordercolor=\"#eaeaea\" testimonialauthorcolor=\"#333333\"]Digitaler "..., subject_len=5021, fci=0x7fffffffb0e0, fcc=0x7fffffffb0c0, --Type <RET> for more, q to quit, c to continue without paging--c limit=18446744073709551615, replace_count=0x7fffffffb028) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:1891 #18 0x000055555571c20c in php_pcre_replace_func (replace_count=0x7fffffffb028, limit=18446744073709551615, fcc=0x7fffffffb0c0, fci=0x7fffffffb0e0, subject_str=0x7fff92306000, regex=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2018 #19 php_replace_in_subject_func (fci=fci@entry=0x7fffffffb0e0, fcc=fcc@entry=0x7fffffffb0c0, subject=subject@entry=0x7ffff46212c0, limit=limit@entry=18446744073709551615, replace_count=0x7fffffffb028, regex=<optimized out>, regex=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2145 #20 0x000055555571c487 in preg_replace_func_impl (regex=regex@entry=0x7ffff46212a0, fci=fci@entry=0x7fffffffb0e0, fcc=fcc@entry=0x7fffffffb0c0, subject=subject@entry=0x7ffff46212c0, limit_val=-1, return_value=<optimized out>, return_value=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2195 #21 0x000055555571c91e in zif_preg_replace_callback (execute_data=0x7ffff4621250, return_value=0x7ffff4621220) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2358 #22 0x0000555555a7912f in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_vm_execute.h:690 #23 execute_ex (ex=0x7ffff4600040) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_vm_execute.h:55465 #24 0x00005555559e8bc1 in zend_call_function (fci=fci@entry=0x7fffffffb550, fci_cache=0x7fffb3d80b90, fci_cache@entry=0x7fffffffb530) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_execute_API.c:756 #25 0x000055555571ae95 in preg_do_repl_func (mark=<optimized out>, count=<optimized out>, subpat_names=0x0, offsets=0x55555642b5a0, subject=0x7fff922f4018 "[vc_row full_width=\"stretch_row\" full_height=\"yes\" content_placement=\"middle\" apress_enable_separator=\"yes\" apress_separator_height=\"300\" apress_enable_row_overlay=\"\" css=\".vc_custom_1542919100842{mar"..., fcc=0x7fffffffb530, fci=0x7fffffffb550) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:1500 #26 php_pcre_replace_func_impl (pce=0x55555662da90, subject_str=0x7fff922f4000, subject=0x7fff922f4018 "[vc_row full_width=\"stretch_row\" full_height=\"yes\" content_placement=\"middle\" apress_enable_separator=\"yes\" apress_separator_height=\"300\" apress_enable_row_overlay=\"\" css=\".vc_custom_1542919100842{mar"..., subject_len=28732, fci=0x7fffffffb550, fcc=0x7fffffffb530, limit=18446744073709551604, replace_count=0x7fffffffb498) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:1891 #27 0x000055555571c20c in php_pcre_replace_func (replace_count=0x7fffffffb498, limit=18446744073709551615, fcc=0x7fffffffb530, fci=0x7fffffffb550, subject_str=0x7fff922f4000, regex=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2018 #28 php_replace_in_subject_func (fci=fci@entry=0x7fffffffb550, fcc=fcc@entry=0x7fffffffb530, subject=subject@entry=0x7ffff4620630, limit=limit@entry=18446744073709551615, replace_count=0x7fffffffb498, regex=<optimized out>, regex=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2145 #29 0x000055555571c487 in preg_replace_func_impl (regex=regex@entry=0x7ffff4620610, fci=fci@entry=0x7fffffffb550, fcc=fcc@entry=0x7fffffffb530, subject=subject@entry=0x7ffff4620630, limit_val=-1, return_value=<optimized out>, return_value=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2195 #30 0x000055555571c91e in zif_preg_replace_callback (execute_data=0x7ffff46205c0, return_value=0x7ffff4620580) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/ext/pcre/php_pcre.c:2358 #31 0x0000555555a7912f in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_vm_execute.h:690 #32 execute_ex (ex=0x7ffff4600040) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_vm_execute.h:55465 #33 0x0000555555a7d062 in zend_execute (op_array=op_array@entry=0x7ffff46750e0, return_value=0x0, return_value@entry=0x7fffb3d80b90) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend_vm_execute.h:60881 #34 0x00005555559f6944 in zend_execute_scripts (type=type@entry=8, retval=0x7fffb3d80b90, retval@entry=0x0, file_count=-194902832, file_count@entry=3) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/Zend/zend.c:1568 #35 0x000055555599b298 in php_execute_script (primary_file=0x7fffffffdc40) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/main/main.c:2630 #36 0x00005555556d8bd9 in main (argc=<optimized out>, argv=<optimized out>) at /var/tmp/portage/dev-lang/php-7.3.7/work/sapis-build/fpm/sapi/fpm/fpm/fpm_main.c:1950 (gdb) It's happening on a WordPress site using "WPBakery Page Builder" plugin. It crashes when a theme calls "vc_map()" function. It doesn't crash when opcode is disabled (opcache.enable=0). PHP-7.3.6 works, PHP-7.3.7 shows this error. -- Edit bug report at https://bugs.php.net/bug.php?id=78255&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=78255&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=78255&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=78255&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=78255&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78255&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78255&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78255&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78255&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78255&r=support Expected behavior: https://bugs.php.net/fix.php?id=78255&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78255&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78255&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78255&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=78255&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=78255&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78255&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78255&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78255&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78255&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78255&r=mysqlcfg