Bug #78811 [Com]: Crash seen during cyclic garbage collection in Phan's unit tests

Edit report at https://bugs.php.net/bug.php?id=78811&edit=1 ID: 78811 Comment by: tandre@php.net Reported by: tandre@php.net Summary: Crash seen during cyclic garbage collection in Phan's unit tests Status: Feedback Type: Bug Package: Reproducible crash Operating System: Linux Mint 18.3 Sylvia PHP Version: Next Major Version Block user comment: N Private report: N New Comment: I continue to see this when running with opcache (but without JIT) after rebasing against php-src 40dcf2bd3df6a59b632220c0038cf0c4cd89eeb1. Both NTS(non-debug) and ZTS debug are affected. I don't see any issues when I run the ZTS --enable-debug build with opcache.jit_buffer_size=500M. The only difference is that I see Parameter::create on top of the previous stack trace 0 Phan\Language\Element\Parameter::create /home/tyson/programming/phan/src/Phan/Language/Element/Parameter.php:63 1 Phan\Language\Element\FunctionFactory::Phan\Language\Element\{closure} /home/tyson/programming/phan/src/Phan/Language/Element/FunctionFactory.php:186 2 array_map <internal>:-1 3 Phan\Language\Element\FunctionFactory::functionListFromFunction /home/tyson/programming/phan/src/Phan/Language/Element/FunctionFactory.php:168 4 Phan\Language\Element\FunctionFactory::functionListFromSignature /home/tyson/programming/phan/src/Phan/Language/Element/FunctionFactory.php:74 5 Phan\CodeBase::hasInternalFunctionWithFQSEN /home/tyson/programming/phan/src/Phan/CodeBase.php:1392 6 Phan\CodeBase::hasFunctionWithFQSEN /home/tyson/programming/phan/src/Phan/CodeBase.php:1158 7 Phan\Analysis::loadMethodPlugins /home/tyson/programming/phan/src/Phan/Analysis.php:341 8 Phan\Phan::finishAnalyzingRemainingStatements /home/tyson/programming/phan/src/Phan/Phan.php:318 9 Phan\Phan::analyzeFileList /home/tyson/programming/phan/src/Phan/Phan.php:122 10 Phan\Tests\AbstractPhanFileTest::testFiles /home/tyson/programming/phan/tests/Phan/AbstractPhanFileTest.php:146 11 PHPUnit\Framework\TestCase::runTest /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestCase.php:1141 12 PHPUnit\Framework\TestCase::runBare /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestCase.php:811 13 PHPUnit\Framework\TestResult::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestResult.php:605 14 PHPUnit\Framework\TestCase::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestCase.php:667 15 PHPUnit\Framework\TestSuite::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestSuite.php:678 16 PHPUnit\Framework\TestSuite::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestSuite.php:678 17 PHPUnit\TextUI\TestRunner::doRun /home/tyson/programming/phan/vendor/phpunit/phpunit/src/TextUI/TestRunner.php:155 18 PHPUnit\TextUI\Command::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/TextUI/Command.php:171 19 PHPUnit\TextUI\Command::main /home/tyson/programming/phan/vendor/phpunit/phpunit/src/TextUI/Command.php:158 20 <main> /home/tyson/programming/phan/vendor/phpunit/phpunit/phpunit:1 PHPUnit 7.5.17 by Sebastian Bergmann and contributors. .................F............................................. 63 / 105 ( 60%) .....F................... Program received signal SIGSEGV, Segmentation fault. 0x0000000000900a8f in zend_gc_collect_cycles () (gdb) bt #0 0x0000000000900a8f in zend_gc_collect_cycles () #1 0x00000000008ff499 in gc_possible_root_when_full () #2 0x000000000096c17a in execute_ex () #3 0x00000000008c2acc in zend_call_function () #4 0x0000000000796626 in zif_array_map () #5 0x0000000000966093 in execute_ex () #6 0x00000000009702dc in zend_execute () #7 0x00000000008d4733 in zend_execute_scripts () #8 0x000000000085e378 in php_execute_script () #9 0x0000000000972783 in do_cli () #10 0x0000000000464ac3 in main () Previous Comments: ------------------------------------------------------------------------ [2019-11-15 11:39:17] nikic@php.net Can you please check whether you still see an issue after https://github.com/php/php-src/commit/bb41a1b7e70f42351b73c12b16947301c4db9cfc? This fixes the issue I saw, but it might be distinct from yours. ------------------------------------------------------------------------ [2019-11-15 11:31:10] nikic@php.net Based on JIT bisection, the miscompile is likely in PHPUnit\TextUI\ResultPrinter::formatWithColor in .../phan/vendor/phpunit/phpunit/src/TextUI/ResultPrinter.php:530. ------------------------------------------------------------------------ [2019-11-15 11:25:31] nikic@php.net I'm seeing php: /home/nikic/php-src/Zend/zend_variables.c:65: zend_string_destroy: Assertion `zend_gc_refcount(&(str)->gc) == 0' failed. Program received signal SIGABRT, Aborted. __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007ffff2775801 in __GI_abort () at abort.c:79 #2 0x00007ffff276539a in __assert_fail_base ( fmt=0x7ffff28ec7d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5555566017e0 "zend_gc_refcount(&(str)->gc) == 0", file=file@entry=0x555556601728 "/home/nikic/php-src/Zend/zend_variables.c", line=line@entry=65, function=function@entry=0x555556601940 <__PRETTY_FUNCTION__.12241> "zend_string_destroy") at assert.c:92 #3 0x00007ffff2765412 in __GI___assert_fail ( assertion=0x5555566017e0 "zend_gc_refcount(&(str)->gc) == 0", file=0x555556601728 "/home/nikic/php-src/Zend/zend_variables.c", line=65, function=0x555556601940 <__PRETTY_FUNCTION__.12241> "zend_string_destroy") at assert.c:101 #4 0x0000555555d4f9f0 in zend_string_destroy (str=0x55555858fe40) at /home/nikic/php-src/Zend/zend_variables.c:65 #5 0x0000555555d4f948 in rc_dtor_func (p=0x55555858fe40) at /home/nikic/php-src/Zend/zend_variables.c:57 #6 0x00000000480b323f in ?? () #7 0x00007fffffffa2a0 in ?? () #8 0x0000555555e21422 in execute_ex (ex=0x555556e566d0) at /home/nikic/php-src/Zend/zend_vm_execute.h:51386 with JIT only though. ------------------------------------------------------------------------ [2019-11-14 02:43:05] tandre@php.net A few more details can be found at https://github.com/phan/phan/issues/3511 ------------------------------------------------------------------------ [2019-11-14 02:41:56] tandre@php.net Description: ------------ This occurs even with a clean build. I failed to create a minimal example - it might require garbage collection at a specific time with a specific number of references to an object/closure, for all I know. - It crashes within array_map, seemingly trying to garbage collect the object which a method is being called on and crashing. NTS(Debug/normal) and ZTS(tried Debug) builds are having this issue for me. Build script used: https://github.com/TysonAndre/php-src/blob/travis-debug/travis/compile.sh revision 15fb532 (git clean -fdx and different install folders were used) PHP ini: extension=ast.so zend_extension=opcache.so opcache.protect_memory=1 opcache.enable_cli=1 short_open_tag=0 display_errors=stderr error_reporting=E_ALL Script used: # after composer.phar install on https://github.com/phan/phan/commit/1a0d7a67742d1727d12dd8556e849c72c71a4de3 USE_ZEND_ALLOC=0 gdb -args which php vendor/bin/phpunit --stop-on-error --stop-on-failure tests/Phan/PhanTest5.php ..... (gdb) run The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /home/tyson/php-8.0.0-debug-opcache-install/bin/php vendor/bin/phpunit tests/Phan/PhanTest5.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". PHPUnit 7.5.17 by Sebastian Bergmann and contributors. WARNING: Phan is around twice as slow when php is compiled with --enable-debug (That option is only needed when debugging Phan itself). (The above warning(s) about slow PHP settings can be disabled by setting 'skip_slow_php_options_warning' to true in .phan/config.php) .................F............................................. 63 / 105 ( 60%) .....F................... Program received signal SIGSEGV, Segmentation fault. 0x0000000000aad751 in zend_gc_collect_cycles () at /path/to/php-src/Zend/zend_gc.c:1562 1562 current->ref = GC_MAKE_GARBAGE(((char*)obj) - obj->handlers->offset); (gdb) bt #0 0x0000000000aad751 in zend_gc_collect_cycles () at /path/to/php-src/Zend/zend_gc.c:1562 #1 0x0000000000aab370 in gc_possible_root_when_full (ref=0x7fffe8328700) at /path/to/php-src/Zend/zend_gc.c:592 #2 0x0000000000aab4f3 in gc_possible_root (ref=0x7fffe8328700) at /path/to/php-src/Zend/zend_gc.c:642 #3 0x0000000000ad516f in zend_object_release (obj=0x7fffe8328700) at /path/to/php-src/Zend/zend_objects_API.h:77 #4 0x0000000000b426e4 in execute_ex (ex=0x7fffeb6155e0) at /path/to/php-src/Zend/zend_vm_execute.h:51386 #5 0x0000000000a6133f in zend_call_function (fci=0x7fffffff9d70, fci_cache=0x7fffffff9d50) at /path/to/php-src/Zend/zend_execute_API.c:779 #6 0x000000000087fb1d in zif_array_map (execute_data=0x7fffeb615570, return_value=0x7fffeb615560) at /path/to/php-src/ext/standard/array.c:6221 #7 0x0000000000ae354e in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /path/to/php-src/Zend/zend_vm_execute.h:1278 #8 0x0000000000b42b0c in execute_ex (ex=0x7fffeb614020) at /path/to/php-src/Zend/zend_vm_execute.h:51498 #9 0x0000000000b46b39 in zend_execute (op_array=0x7fffeb672300, return_value=0x0) at /path/to/php-src/Zend/zend_vm_execute.h:55566 #10 0x0000000000a771e3 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /path/to/php-src/Zend/zend.c:1666 #11 0x00000000009e4a1f in php_execute_script (primary_file=0x7fffffffc570) at /path/to/php-src/main/main.c:2586 #12 0x0000000000b49495 in do_cli (argc=3, argv=0x186e7d0) at /path/to/php-src/sapi/cli/php_cli.c:959 #13 0x0000000000b4a4b5 in main (argc=3, argv=0x186e7d0) at /path/to/php-src/sapi/cli/php_cli.c:1350 ------ Possible thoughts on why I saw this: - ReflectionUnionType->__toString() (unlikely) - Pre-existing issue in php 8 that got exposed due to different number of objects getting created - Changes internally in how zend_closure objects get fetched - this was in an array_map for an instance closure. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78811&edit=1