Bug #78811 [Fbk]: Crash seen during cyclic garbage collection in Phan's unit tests

Edit report at https://bugs.php.net/bug.php?id=78811&edit=1 ID: 78811 Updated by: nikic@php.net Reported by: tandre@php.net Summary: Crash seen during cyclic garbage collection in Phan's unit tests Status: Feedback Type: Bug Package: Reproducible crash Operating System: Linux Mint 18.3 Sylvia PHP Version: Next Major Version Block user comment: N Private report: N New Comment: I can't reproduce this on a debug+nts build with opcache without jit. No warnings under valgrind either. Previous Comments: ------------------------------------------------------------------------ [2019-11-15 14:04:11] tandre@php.net I continue to see this when running with opcache (but without JIT) after rebasing against php-src 40dcf2bd3df6a59b632220c0038cf0c4cd89eeb1. Both NTS(non-debug) and ZTS debug are affected. I don't see any issues when I run the ZTS --enable-debug build with opcache.jit_buffer_size=500M. The only difference is that I see Parameter::create on top of the previous stack trace 0 Phan\Language\Element\Parameter::create /home/tyson/programming/phan/src/Phan/Language/Element/Parameter.php:63 1 Phan\Language\Element\FunctionFactory::Phan\Language\Element\{closure} /home/tyson/programming/phan/src/Phan/Language/Element/FunctionFactory.php:186 2 array_map <internal>:-1 3 Phan\Language\Element\FunctionFactory::functionListFromFunction /home/tyson/programming/phan/src/Phan/Language/Element/FunctionFactory.php:168 4 Phan\Language\Element\FunctionFactory::functionListFromSignature /home/tyson/programming/phan/src/Phan/Language/Element/FunctionFactory.php:74 5 Phan\CodeBase::hasInternalFunctionWithFQSEN /home/tyson/programming/phan/src/Phan/CodeBase.php:1392 6 Phan\CodeBase::hasFunctionWithFQSEN /home/tyson/programming/phan/src/Phan/CodeBase.php:1158 7 Phan\Analysis::loadMethodPlugins /home/tyson/programming/phan/src/Phan/Analysis.php:341 8 Phan\Phan::finishAnalyzingRemainingStatements /home/tyson/programming/phan/src/Phan/Phan.php:318 9 Phan\Phan::analyzeFileList /home/tyson/programming/phan/src/Phan/Phan.php:122 10 Phan\Tests\AbstractPhanFileTest::testFiles /home/tyson/programming/phan/tests/Phan/AbstractPhanFileTest.php:146 11 PHPUnit\Framework\TestCase::runTest /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestCase.php:1141 12 PHPUnit\Framework\TestCase::runBare /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestCase.php:811 13 PHPUnit\Framework\TestResult::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestResult.php:605 14 PHPUnit\Framework\TestCase::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestCase.php:667 15 PHPUnit\Framework\TestSuite::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestSuite.php:678 16 PHPUnit\Framework\TestSuite::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/Framework/TestSuite.php:678 17 PHPUnit\TextUI\TestRunner::doRun /home/tyson/programming/phan/vendor/phpunit/phpunit/src/TextUI/TestRunner.php:155 18 PHPUnit\TextUI\Command::run /home/tyson/programming/phan/vendor/phpunit/phpunit/src/TextUI/Command.php:171 19 PHPUnit\TextUI\Command::main /home/tyson/programming/phan/vendor/phpunit/phpunit/src/TextUI/Command.php:158 20 <main> /home/tyson/programming/phan/vendor/phpunit/phpunit/phpunit:1 PHPUnit 7.5.17 by Sebastian Bergmann and contributors. .................F............................................. 63 / 105 ( 60%) .....F................... Program received signal SIGSEGV, Segmentation fault. 0x0000000000900a8f in zend_gc_collect_cycles () (gdb) bt #0 0x0000000000900a8f in zend_gc_collect_cycles () #1 0x00000000008ff499 in gc_possible_root_when_full () #2 0x000000000096c17a in execute_ex () #3 0x00000000008c2acc in zend_call_function () #4 0x0000000000796626 in zif_array_map () #5 0x0000000000966093 in execute_ex () #6 0x00000000009702dc in zend_execute () #7 0x00000000008d4733 in zend_execute_scripts () #8 0x000000000085e378 in php_execute_script () #9 0x0000000000972783 in do_cli () #10 0x0000000000464ac3 in main () ------------------------------------------------------------------------ [2019-11-15 11:39:17] nikic@php.net Can you please check whether you still see an issue after https://github.com/php/php-src/commit/bb41a1b7e70f42351b73c12b16947301c4db9cfc? This fixes the issue I saw, but it might be distinct from yours. ------------------------------------------------------------------------ [2019-11-15 11:31:10] nikic@php.net Based on JIT bisection, the miscompile is likely in PHPUnit\TextUI\ResultPrinter::formatWithColor in .../phan/vendor/phpunit/phpunit/src/TextUI/ResultPrinter.php:530. ------------------------------------------------------------------------ [2019-11-15 11:25:31] nikic@php.net I'm seeing php: /home/nikic/php-src/Zend/zend_variables.c:65: zend_string_destroy: Assertion `zend_gc_refcount(&(str)->gc) == 0' failed. Program received signal SIGABRT, Aborted. __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51 #1 0x00007ffff2775801 in __GI_abort () at abort.c:79 #2 0x00007ffff276539a in __assert_fail_base ( fmt=0x7ffff28ec7d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5555566017e0 "zend_gc_refcount(&(str)->gc) == 0", file=file@entry=0x555556601728 "/home/nikic/php-src/Zend/zend_variables.c", line=line@entry=65, function=function@entry=0x555556601940 <__PRETTY_FUNCTION__.12241> "zend_string_destroy") at assert.c:92 #3 0x00007ffff2765412 in __GI___assert_fail ( assertion=0x5555566017e0 "zend_gc_refcount(&(str)->gc) == 0", file=0x555556601728 "/home/nikic/php-src/Zend/zend_variables.c", line=65, function=0x555556601940 <__PRETTY_FUNCTION__.12241> "zend_string_destroy") at assert.c:101 #4 0x0000555555d4f9f0 in zend_string_destroy (str=0x55555858fe40) at /home/nikic/php-src/Zend/zend_variables.c:65 #5 0x0000555555d4f948 in rc_dtor_func (p=0x55555858fe40) at /home/nikic/php-src/Zend/zend_variables.c:57 #6 0x00000000480b323f in ?? () #7 0x00007fffffffa2a0 in ?? () #8 0x0000555555e21422 in execute_ex (ex=0x555556e566d0) at /home/nikic/php-src/Zend/zend_vm_execute.h:51386 with JIT only though. ------------------------------------------------------------------------ [2019-11-14 02:43:05] tandre@php.net A few more details can be found at https://github.com/phan/phan/issues/3511 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=78811 -- Edit this bug report at https://bugs.php.net/bug.php?id=78811&edit=1