Bug #78592 [Com]: filter related extension cause Segmentation fault

Edit report at https://bugs.php.net/bug.php?id=78592&edit=1 ID: 78592 Comment by: john dot royer at gmail dot com Reported by: john dot royer at gmail dot com Summary: filter related extension cause Segmentation fault Status: Open Type: Bug Package: JSON related Operating System: Linux (Ubuntu 18.04) PHP Version: 7.3.9 Block user comment: N Private report: N New Comment: information update: I notice that PHP 7.3.8 has same issue. phpbrew build script: phpbrew install -j 8 7.3.8 +cli +json +pdo +xml +curl +mysql +hash +ctype +openssl +filter $ php -v PHP 7.3.8 (cli) (built: Sep 26 2019 13:51:13) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.3.8, Copyright (c) 1998-2018 Zend Technologies $ php -m [PHP Modules] Core ctype curl date dom filter hash json libxml mysqli mysqlnd openssl pcre PDO pdo_mysql Phar Reflection session SimpleXML SPL standard tokenizer xml xmlreader xmlwriter xsl zlib $ phpunit ... Run by vendor/bin/phpunit ... PHPUnit 7.5.15 by Sebastian Bergmann and contributors. ...........................................................Segmentation fault (core dumped) $ gdb which php core-php.17346 GNU gdb (Ubuntu 8.1-0ubuntu3.1) 8.1.0.20180409-git Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /home/zero/.phpbrew/php/738/bin/php...done. [New LWP 17346] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `php /home/zero/devel/boltics/vendor/bin/phpunit'. Program terminated with signal SIGSEGV, Segmentation fault. #0 zend_mm_alloc_small (bin_num=6, size=56, heap=0x7f2840e00040) at /home/zero/.phpbrew/build/738/Zend/zend_alloc.c:1289 1289 heap->free_slot[bin_num] = p->next_free_slot; (gdb) bt #0 zend_mm_alloc_small (bin_num=6, size=56, heap=0x7f2840e00040) at /home/zero/.phpbrew/build/738/Zend/zend_alloc.c:1289 #1 _emalloc_56 () at /home/zero/.phpbrew/build/738/Zend/zend_alloc.c:2423 #2 0x000055f67fdbb389 in _zend_new_array_0 () at /home/zero/.phpbrew/build/738/Zend/zend_hash.c:217 #3 0x000055f67fdc8bb2 in zend_fetch_debug_backtrace (return_value=return_value@entry=0x7ffda26668e0, skip_last=skip_last@entry=0, options=options@entry=0, limit=limit@entry=0) at /home/zero/.phpbrew/build/738/Zend/zend_builtin_functions.c:2498 #4 0x000055f67fdcfdaf in zend_default_exception_new_ex (class_type=0x55f680d85580, skip_top_traces=0) at /home/zero/.phpbrew/build/738/Zend/zend_exceptions.c:215 #5 0x000055f67fdb0eab in object_and_properties_init (arg=arg@entry=0x7ffda2666960, class_type=class_type@entry=0x55f680d85580, properties=properties@entry=0x0) at /home/zero/.phpbrew/build/738/Zend/zend_API.c:1335 #6 0x000055f67fdb0fa7 in object_init_ex (arg=arg@entry=0x7ffda2666960, class_type=class_type@entry=0x55f680d85580) at /home/zero/.phpbrew/build/738/Zend/zend_API.c:1343 #7 0x000055f67fb0d696 in zend_throw_exception (exception_ce=exception_ce@entry=0x55f680d85580, message=0x7f283eafa500 "Class Query executed does not exist", code=code@entry=-1) at /home/zero/.phpbrew/build/738/Zend/zend_exceptions.c:909 #8 0x000055f67fb0d84d in zend_throw_exception_ex (exception_ce=0x55f680d85580, code=code@entry=-1, format=format@entry=0x55f67ff4480e "Class %s does not exist") at /home/zero/.phpbrew/build/738/Zend/zend_exceptions.c:936 #9 0x000055f67fc6227d in reflection_class_object_ctor (execute_data=0x7f2840e26b50, is_object=<optimized out>, return_value=<optimized out>) at /home/zero/.phpbrew/build/738/ext/reflection/php_reflection.c:3744 #10 0x000055f67fe3c455 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /home/zero/.phpbrew/build/738/Zend/zend_vm_execute.h:980 #11 execute_ex (ex=0x7f2840e00040) at /home/zero/.phpbrew/build/738/Zend/zend_vm_execute.h:55485 #12 0x000055f67fda195b in zend_call_function (fci=fci@entry=0x7ffda2666ce0, fci_cache=<optimized out>, fci_cache@entry=0x7ffda2666cc0) at /home/zero/.phpbrew/build/738/Zend/zend_execute_API.c:756 #13 0x000055f67fde1b33 in zend_std_call_getter (zobj=zobj@entry=0x7f2837e76a80, prop_name=prop_name@entry=0x7f2840ffac40, retval=retval@entry=0x7f2840e255a0) at /home/zero/.phpbrew/build/738/Zend/zend_object_handlers.c:206 #14 0x000055f67fde35de in zend_std_read_property (object=<optimized out>, member=<optimized out>, type=0, cache_slot=<optimized out>, rv=0x7f2840e255a0) at /home/zero/.phpbrew/build/738/Zend/zend_object_handlers.c:706 #15 0x000055f67fdf74de in ZEND_FETCH_OBJ_R_SPEC_TMPVAR_CONST_HANDLER () at /home/zero/.phpbrew/build/738/Zend/zend_vm_execute.h:13586 #16 0x000055f67fe3696d in execute_ex (ex=0x7f2840e00040) at /home/zero/.phpbrew/build/738/Zend/zend_vm_execute.h:56931 #17 0x000055f67fda195b in zend_call_function (fci=fci@entry=0x7ffda2666fc0, fci_cache=<optimized out>, fci_cache@entry=0x7ffda2666fa0) at /home/zero/.phpbrew/build/738/Zend/zend_execute_API.c:756 #18 0x000055f67fcb6db5 in zif_call_user_func_array (execute_data=0x7f2840e253b0, return_value=0x7f2840e253a0) at /home/zero/.phpbrew/build/738/ext/standard/basic_functions.c:4942 #19 0x000055f67fe3b45e in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at /home/zero/.phpbrew/build/738/Zend/zend_vm_execute.h:892 #20 execute_ex (ex=0x7f2840e00040) at /home/zero/.phpbrew/build/738/Zend/zend_vm_execute.h:55481 #21 0x000055f67fe3d57e in zend_execute (op_array=op_array@entry=0x7f2840e812a0, return_value=0x0, return_value@entry=0x7f283faa9680) at /home/zero/.phpbrew/build/738/Zend/zend_vm_execute.h:60881 #22 0x000055f67fdaf512 in zend_execute_scripts (type=type@entry=8, retval=0x7f283faa9680, retval@entry=0x0, file_count=1088574176, file_count@entry=3) at /home/zero/.phpbrew/build/738/Zend/zend.c:1568 #23 0x000055f67fd4fca0 in php_execute_script (primary_file=0x7ffda2669690) at /home/zero/.phpbrew/build/738/main/main.c:2634 #24 0x000055f67fe3fa5c in do_cli (argc=2, argv=0x55f680c29490) at /home/zero/.phpbrew/build/738/sapi/cli/php_cli.c:997 #25 0x000055f67fb1c62b in main (argc=2, argv=0x55f680c29490) at /home/zero/.phpbrew/build/738/sapi/cli/php_cli.c:1389 Previous Comments: ------------------------------------------------------------------------ [2019-09-26 03:37:06] john dot royer at gmail dot com Here are more infomations. //======== PHP with JSON , but no filter =========== build script: phpbrew install 7.3.9 +cli +json +pdo +xml +curl +mysql +hash +ctype +openssl Run phpunit again: $ phpunit ... Run by vendor/bin/phpunit ... PHPUnit 7.5.15 by Sebastian Bergmann and contributors. ..................................ESE....F...............ES.... 63 / 303 ( 20%) ........FF........F.................FFF.......F.......F...... 126 / 303 ( 41%) ......F........................................................ 189 / 303 ( 62%) ..............................EE...EE.......................... 252 / 303 ( 83%) ................................................... 303 / 303 (100%) Time: 2.06 minutes, Memory: 86.50 MB There were 7 errors: 1) Tests\app\Http\Controllers\BarcodeControllerTest::testUploadingCsv Error: Call to undefined function Predis\Connection\filter_var() // ============= PHP without JSON but has filter ================== build script: phpbrew install 7.3.9 +cli +pdo +xml +curl +mysql +hash +ctype +openssl +filter Run PHPUnut : $ phpunit ... Run by vendor/bin/phpunit ... PHPUnit 7.5.15 by Sebastian Bergmann and contributors. ..EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESEESSSEEEEEEEEE.........EEEE 63 / 303 ( 20%) EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE 126 / 303 ( 41%) EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE.EEEEEEEEEEEEEEEEEEEEEE 189 / 303 ( 62%) EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE 252 / 303 ( 83%) EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESSSESSEEEE 303 / 303 (100%) Time: 3.07 seconds, Memory: 178.00 MB There were 282 errors: 1) ShopifyApiCallerTest::testSetAndGetShopDomain ErrorException: Use of undefined constant JSON_HEX_TAG - assumed 'JSON_HEX_TAG' (this will throw an Error in a future version of PHP) //==================================== Seems we need both JSON and filter extension to let segment fault occurs, right ? ------------------------------------------------------------------------ [2019-09-26 01:57:01] requinix@php.net > Is it means PHP crashed while using JSON extension ? More or less. The issue could be with json_decode(), or it could be with the engine internals that the function was using. What if you phpbrew install with filter and without json? Or with json and without filter? ------------------------------------------------------------------------ [2019-09-26 01:48:10] john dot royer at gmail dot com I got a core dump, as below: $ gdb which php core-php.21646 GNU gdb (Ubuntu 8.1-0ubuntu3.1) 8.1.0.20180409-git Copyright (C) 2018 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-linux-gnu". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/bin/php...(no debugging symbols found)...done. warning: core file may not match specified executable file. [New LWP 21646] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `php vendor/bin/phpunit'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000055e98d4fa1f2 in _emalloc_56 () (gdb) bt #0 0x000055e98d4fa1f2 in _emalloc_56 () #1 0x000055e98d52d149 in _zend_new_array_0 () #2 0x00007f1840827d99 in ?? () from /usr/lib/php/20180731/json.so #3 0x00007f1840828589 in ?? () from /usr/lib/php/20180731/json.so #4 0x00007f18408253f6 in php_json_decode_ex () from /usr/lib/php/20180731/json.so #5 0x00007f18408255c9 in ?? () from /usr/lib/php/20180731/json.so #6 0x000055e98d5b011b in execute_ex () #7 0x000055e98d5b03f3 in zend_execute () #8 0x000055e98d521272 in zend_execute_scripts () #9 0x000055e98d4c11f0 in php_execute_script () #10 0x000055e98d5b28cc in ?? () #11 0x000055e98d3786fb in ?? () #12 0x00007f184af64b97 in __libc_start_main (main=0x55e98d3782e0, argc=2, argv=0x7ffd793af448, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffd793af438) at ../csu/libc-start.c:310 #13 0x000055e98d37889a in _start () //================================== I don't know about gbd. Is it means PHP crashed while using JSON extension ? ------------------------------------------------------------------------ [2019-09-25 09:42:31] requinix@php.net Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php for *NIX and http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32 Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. ------------------------------------------------------------------------ [2019-09-25 07:22:04] john dot royer at gmail dot com Description: ------------ $ phpunit ... Run by vendor/bin/phpunit ... PHPUnit 7.5.15 by Sebastian Bergmann and contributors. ............................................................Segmentation fault (core dumped) //------------------------------- Sorry, issue cause only run after a lot of tests. If I just run patial test, like phpunit test/src/ApplicationTest.php, there is no error occur. My PHP environment is as the gist shown: https://gist.github.com/johnroyer/1c05332c94db0374ffc0d823fee0818b. Hope this helps. Test script: --------------- I use phpbrew to rebuild PHP 7.3.9 and add extension step by step. Issue occurs after a compile filter library : phpbrew install 7.3.9 +cli +json +pdo +xml +curl +mysql +hash +ctype +openssl +filter Expected result: ---------------- PHPUnit should run all the test and should not have any PHP language related issue. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78592&edit=1