Edit report at https://bugs.php.net/bug.php?id=79973&edit=1
ID: 79973
Comment by: php at mni dot de
Reported by: php at mni dot de
Summary: Segfault in php-fpm
Status: Open
Type: Bug
Package: FPM related
Operating System: CentOS 7.8.2003
PHP Version: 7.4.9
Block user comment: N
Private report: N
New Comment:
Just tested it on a Debian 10.5 Box with PHP 7.3.19, same Problem.
Previous Comments:
------------------------------------------------------------------------
[2020-08-16 19:26:09] nikic@php.net
No, this is almost certainly an issue with PHP or a PHP extension, just the place where it crashes
is pretty harmless, so it's hard to guess at the root cause here.
------------------------------------------------------------------------
[2020-08-16 16:07:07] php at mni dot de
Thanks for your Feedback, so opening a ticket at woo/wp would be the way to go?
------------------------------------------------------------------------
[2020-08-13 14:07:05] nikic@php.net
The backtrace corresponds to a number_format(39.899999999999999, 2) call. Doesn't crash locally
and presumably wouldn't crash for you either, if it were an isolated call.
------------------------------------------------------------------------
[2020-08-13 13:57:01] php at mni dot de
Description:
------------
We experiences a problem with a Wordpress/Woocommerce Installation. Some of our users are no longer
able to login, when they have a saved shopping cart in the database. The login fails with a 502 (Bad
Gateway) Error because the FPM-Child dies with a segfault:
[2083913.678027] php-fpm[18682]: segfault at 7ffd48dddff8 ip 000055ffaf5ae175 sp 00007ffd48dde000
error 6 in php-fpm[55ffaf320000+472000]
Core was generated by `php-fpm: pool www '.
Program terminated with signal 11, Segmentation fault.
#0 0x0000560723ee1e09 in zend_dtoa (dd=39.899999999999999, mode=mode@entry=3,
ndigits=ndigits@entry=2, decpt=decpt@entry=0x7ffcbac60098, sign=sign@entry=0x7ffcbac60174,
rve=rve@entry=0x7ffcbac60030) at /usr/src/debug/php-7.4.9/Zend/zend_strtod.c:3721
3721 {
If it is useful for debugging, i can send you the whole Core-Dump (350MB).
The problem exists also on Centos 7.6 with php7.3. I can 'solve' the problem by deleting
the saved shopping cart entry from the database. The problem ist reproducible on a staging server.
Please let me know, what further information do you need. Thank you in advance.
Expected result:
----------------
No segfault, User is able to login.
Actual result:
--------------
segfault, see above
backtrace
#0 0x0000560723ee1e09 in zend_dtoa (dd=39.899999999999999, mode=mode@entry=3,
ndigits=ndigits@entry=2, decpt=decpt@entry=0x7ffcbac60098, sign=sign@entry=0x7ffcbac60174,
rve=rve@entry=0x7ffcbac60030) at /usr/src/debug/php-7.4.9/Zend/zend_strtod.c:3721
#1 0x0000560723e5e1d7 in __cvt (value=value@entry=39.899999999999999, ndigit=ndigit@entry=2,
decpt=0x7ffcbac60098, sign=sign@entry=0x7ffcbac60174, fmode=fmode@entry=1, pad=1)
at /usr/src/debug/php-7.4.9/main/snprintf.c:90
#2 0x0000560723e5e4db in php_fcvt (sign=0x7ffcbac60174, decpt=0x7ffcbac60098, ndigit=2,
value=39.899999999999999) at /usr/src/debug/php-7.4.9/main/snprintf.c:386
#3 php_conv_fp (format=<optimized out>, num=num@entry=39.899999999999999, add_dp=NO,
precision=2, dec_point=<optimized out>, is_negative=is_negative@entry=0x7ffcbac60174,
buf=buf@entry=0x7ffcbac601a1 "", len=0x7ffcbac60178) at
/usr/src/debug/php-7.4.9/main/snprintf.c:386
#4 0x0000560723e6117a in xbuf_format_converter (xbuf=0x7ffcbac60620, is_char=0 '\000',
fmt=0x560723fb12f6 "F", ap=0x7ffcbac60650) at /usr/src/debug/php-7.4.9/main/spprintf.c:637
#5 0x0000560723ebe009 in zend_vstrpprintf (max_len=0, format=<optimized out>,
ap=ap@entry=0x7ffcbac60650) at /usr/src/debug/php-7.4.9/Zend/zend.c:243
#6 0x0000560723ebe104 in zend_strpprintf (max_len=max_len@entry=0,
format=format@entry=0x560723fb12f3 "%.*F") at /usr/src/debug/php-7.4.9/Zend/zend.c:264
#7 0x0000560723e1978e in _php_math_number_format_ex (d=39.899999999999999, dec=2,
dec_point=dec_point@entry=0x7ffcbac607bc ".+\f\340\002",
dec_point_len=dec_point_len@entry=1,
thousand_sep=thousand_sep@entry=0x7ffcbac607b8 ",\003D[.+\f\340\002",
thousand_sep_len=thousand_sep_len@entry=1) at /usr/src/debug/php-7.4.9/ext/standard/math.c:1160
#8 0x0000560723e19be7 in _php_math_number_format (d=<optimized out>, dec=<optimized
out>, dec_point=<optimized out>, thousand_sep=<optimized out>)
at /usr/src/debug/php-7.4.9/ext/standard/math.c:1138
#9 0x0000560723e19d69 in zif_number_format () at /usr/src/debug/php-7.4.9/ext/standard/math.c:1282
#10 0x0000560723f40768 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at
/usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:1314
#11 execute_ex () at /usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:53740
#12 0x0000560723eb07e6 in zend_call_function () at
/usr/src/debug/php-7.4.9/Zend/zend_execute_API.c:813
#13 0x0000560723de0b09 in php_array_user_compare (a=<optimized out>, b=<optimized out>)
at /usr/src/debug/php-7.4.9/ext/standard/array.c:971
#14 0x0000560723ed93f0 in zend_sort_3 (swp=<optimized out>, cmp=<optimized out>,
c=<optimized out>, b=<optimized out>, a=<optimized out>) at
/usr/src/debug/php-7.4.9/Zend/zend_sort.c:104
#15 zend_sort_3 (swp=<optimized out>, cmp=<optimized out>, c=<optimized out>,
b=<optimized out>, a=<optimized out>) at /usr/src/debug/php-7.4.9/Zend/zend_sort.c:98
#16 zend_insert_sort (base=0x7ff0b6085940, nmemb=<optimized out>, siz=32, cmp=0x560723de0a80
<php_array_user_compare>, swp=0x560723eca8e0 <zend_hash_bucket_swap>)
at /usr/src/debug/php-7.4.9/Zend/zend_sort.c:160
#17 0x0000560723ed1a2a in zend_hash_sort_ex (ht=ht@entry=0x7ff0b60839d8, sort=<optimized out>,
compar=compar@entry=0x560723de0a80 <php_array_user_compare>, renumber=<optimized out>)
at /usr/src/debug/php-7.4.9/Zend/zend_hash.c:2493
#18 0x0000560723de0f8f in php_usort () at /usr/src/debug/php-7.4.9/ext/standard/array.c:1038
#19 0x0000560723f40768 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at
/usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:1314
#20 execute_ex () at /usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:53740
#21 0x0000560723eb07e6 in zend_call_function () at
/usr/src/debug/php-7.4.9/Zend/zend_execute_API.c:813
#22 0x0000560723de0b09 in php_array_user_compare (a=<optimized out>, b=<optimized out>)
at /usr/src/debug/php-7.4.9/ext/standard/array.c:971
#23 0x0000560723ed93f0 in zend_sort_3 (swp=<optimized out>, cmp=<optimized out>,
c=<optimized out>, b=<optimized out>, a=<optimized out>) at
/usr/src/debug/php-7.4.9/Zend/zend_sort.c:104
#24 zend_sort_3 (swp=<optimized out>, cmp=<optimized out>, c=<optimized out>,
b=<optimized out>, a=<optimized out>) at /usr/src/debug/php-7.4.9/Zend/zend_sort.c:98
#25 zend_insert_sort (base=0x7ff0b6082640, nmemb=<optimized out>, siz=32, cmp=0x560723de0a80
<php_array_user_compare>, swp=0x560723eca8e0 <zend_hash_bucket_swap>)
at /usr/src/debug/php-7.4.9/Zend/zend_sort.c:160
#26 0x0000560723ed1a2a in zend_hash_sort_ex (ht=ht@entry=0x7ff0b60833f0, sort=<optimized out>,
compar=compar@entry=0x560723de0a80 <php_array_user_compare>, renumber=<optimized out>)
at /usr/src/debug/php-7.4.9/Zend/zend_hash.c:2493
#27 0x0000560723de0f8f in php_usort () at /usr/src/debug/php-7.4.9/ext/standard/array.c:1038
#28 0x0000560723f40768 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at
/usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:1314
#29 execute_ex () at /usr/src/debug/php-7.4.9/Zend/zend_vm_execute.h:53740
#30 0x0000560723eb07e6 in zend_call_function () at
/usr/src/debug/php-7.4.9/Zend/zend_execute_API.c:813
#31 0x0000560723de0b09 in php_array_user_compare (a=<optimized out>, b=<optimized out>)
at /usr/src/debug/php-7.4.9/ext/standard/array.c:971
#32 0x0000560723ed93f0 in zend_sort_3 (swp=<optimized out>, cmp=<optimized out>,
c=<optimized out>, b=<optimized out>, a=<optimized out>) at
/usr/src/debug/php-7.4.9/Zend/zend_sort.c:104
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=79973&edit=1