Bug #64111 [ReO->Fbk]: Segfault in gc_zval_possible_root

From: Date: Thu, 26 Nov 2020 16:57:52 +0000
Subject: Bug #64111 [ReO->Fbk]: Segfault in gc_zval_possible_root
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-230651@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=64111&edit=1

 ID:                 64111
 Updated by:         cmb@php.net
 Reported by:        remi@php.net
 Summary:            Segfault in gc_zval_possible_root
-Status:             Re-Opened
+Status:             Feedback
 Type:               Bug
 Package:            *General Issues
 Operating System:   GNU/Linux (Fedora 18)
 PHP Version:        5.4.11
-Assigned To:        
+Assigned To:        cmb
 Block user comment: N
 Private report:     N

 New Comment:

Since there has not been any feedback regarding PHP 7, I'm
assuming this issue has been resolved.  Or can anybody still
reproduce?


Previous Comments:
------------------------------------------------------------------------
[2016-07-09 12:29:30] razvanphp at yahoo dot com

Same on 5.6.22, debian jessie, xdebug enabled

razvan@www2:~$ sudo gdb /usr/sbin/php5-fpm /tmp/core.php5-fpm.406
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/php5-fpm...(no debugging symbols found)...done.
[New LWP 406]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm: pool www                                                      
'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000000000070de89 in gc_zval_possible_root ()
(gdb) bt
#0  0x000000000070de89 in gc_zval_possible_root ()
#1  0x00000000006fae98 in zend_hash_destroy ()
#2  0x00000000006eb83b in _zval_dtor_func ()
#3  0x00000000006dba80 in _zval_ptr_dtor ()
#4  0x00000000006e047c in zend_cleanup_user_class_data ()
#5  0x00000000006fb3f3 in zend_hash_reverse_apply ()
#6  0x00000000006dc21f in shutdown_executor ()
#7  0x00000000006ec936 in zend_deactivate ()
#8  0x0000000000688887 in php_request_shutdown ()
#9  0x0000000000464627 in main ()
(gdb)
razvan@www2:~$ php -v
PHP 5.6.22-0+deb8u1 (cli) (built: Jun  9 2016 07:14:06)
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies
    with Xdebug v2.2.5, Copyright (c) 2002-2014, by Derick Rethans

------------------------------------------------------------------------
[2016-02-11 08:05:03] de at plista dot com

Same issue on latest 5.5.32

root@foo:[/var/tmp/core-dumps] # gdb /usr/sbin/php5-fpm core-php5-fpm.25079
Reading symbols from /usr/sbin/php5-fpm...Reading symbols from
/usr/lib/debug/.build-id/ae/59c542ebeaa2fb26d4b6dcffd52eb1c63e76bb.debug...done.
done.
[New LWP 25079]
b[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm: pool www                                                      
'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00000000006f1651 in gc_zval_possible_root (zv=0x3a60050) at
/build/php5-uqo5AS/php5-5.5.32+dfsg/Zend/zend_gc.c:143
143	/build/php5-uqo5AS/php5-5.5.32+dfsg/Zend/zend_gc.c: No such file or directory.
tTraceback (most recent call last):
  File "/usr/share/gdb/auto-load/usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19-gdb.py",
line 63, in <module>
    from libstdcxx.v6.printers import register_libstdcxx_printers
ImportError: No module named 'libstdcxx'
(gdb)
(gdb)
(gdb) bt
#0  0x00000000006f1651 in gc_zval_possible_root (zv=0x3a60050) at
/build/php5-uqo5AS/php5-5.5.32+dfsg/Zend/zend_gc.c:143
#1  0x00000000006f4587 in zend_object_std_dtor (object=0x35829e0) at
/build/php5-uqo5AS/php5-5.5.32+dfsg/Zend/zend_objects.c:54
#2  0x00000000006f45b9 in zend_objects_free_object_storage (object=0x35829e0) at
/build/php5-uqo5AS/php5-5.5.32+dfsg/Zend/zend_objects.c:137
#3  0x00000000006f9fb7 in zend_objects_store_free_object_storage (objects=objects@entry=0xe6b6a0
<executor_globals+928>) at /build/php5-uqo5AS/php5-5.5.32+dfsg/Zend/zend_objects_API.c:97
#4  0x00000000006c2663 in shutdown_executor () at
/build/php5-uqo5AS/php5-5.5.32+dfsg/Zend/zend_execute_API.c:290
#5  0x00000000006d1ce2 in zend_deactivate () at /build/php5-uqo5AS/php5-5.5.32+dfsg/Zend/zend.c:946
#6  0x0000000000672572 in php_request_shutdown (dummy=dummy@entry=0x0) at
/build/php5-uqo5AS/php5-5.5.32+dfsg/main/main.c:1813
#7  0x0000000000461c54 in main (argc=<optimized out>, argv=<optimized out>) at
/build/php5-uqo5AS/php5-5.5.32+dfsg/sapi/fpm/fpm/fpm_main.c:1981
(gdb) quit

root@foo:[/var/tmp/core-dumps] # php -v
PHP 5.5.32-1+deb.sury.org~trusty+1 (cli) (built: Feb  5 2016 10:07:16) 
Copyright (c) 1997-2015 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2015 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2015, by Zend Technologies

------------------------------------------------------------------------
[2014-12-16 07:58:34] eugene at zhegan dot in

Same problem on 5.4.16.

[root@pitchblack php-fpm.cores]# gdb /usr/sbin/php-fpm core-php-fpm.25014 
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-51.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/sbin/php-fpm...Reading symbols from /usr/sbin/php-fpm...(no debugging
symbols found)...done.
(no debugging symbols found)...done.
[New LWP 25014]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `php-fpm: pool www              '.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f4d38cca289 in gc_zval_possible_root ()
Missing separate debuginfos, use: debuginfo-install php-fpm-5.4.16-23.el7_0.3.x86_64
(gdb) bt
#0  0x00007f4d38cca289 in gc_zval_possible_root ()
#1  0x00007f4d38cb7d38 in zend_hash_destroy ()
#2  0x00007f4d38ca8b0b in _zval_dtor_func ()
#3  0x00007f4d38c9a42a in _zval_ptr_dtor ()
#4  0x00007f4d38cb66c5 in zend_hash_apply_deleter ()
#5  0x00007f4d38cb7ef8 in zend_hash_graceful_reverse_destroy ()
#6  0x00007f4d38c9abbe in shutdown_executor ()
#7  0x00007f4d38ca9bb5 in zend_deactivate ()
#8  0x00007f4d38c495d5 in php_request_shutdown ()
#9  0x00007f4d38b08934 in main ()
(gdb) quit

------------------------------------------------------------------------
[2014-10-14 10:27:05] valery dot tereshko at gmail dot com

I have same issue in php-5.5.15

Core was generated by `/usr/bin/php -q /home/moodlee/public_html/admin/cli/cron.php'.
Program terminated with signal 11, Segmentation fault.
#0  0x0844d25f in gc_zval_possible_root (zv=0xa60b9e8) at
/home/cpeasyapache/src/php-5.5.15/Zend/zend_gc.c:143
143			GC_ZOBJ_CHECK_POSSIBLE_ROOT(zv);
(gdb) bt
#0  0x0844d25f in gc_zval_possible_root (zv=0xa60b9e8) at
/home/cpeasyapache/src/php-5.5.15/Zend/zend_gc.c:143
#1  0x084501f8 in zend_object_std_dtor (object=0xa4d0644) at
/home/cpeasyapache/src/php-5.5.15/Zend/zend_objects.c:54
#2  0x08450232 in zend_objects_free_object_storage (object=0xa4d0644) at
/home/cpeasyapache/src/php-5.5.15/Zend/zend_objects.c:137
#3  0x08455858 in zend_objects_store_free_object_storage (objects=0x87fb0e0) at
/home/cpeasyapache/src/php-5.5.15/Zend/zend_objects_API.c:97
#4  0x084239f1 in shutdown_executor () at
/home/cpeasyapache/src/php-5.5.15/Zend/zend_execute_API.c:293
#5  0x0842fe23 in zend_deactivate () at /home/cpeasyapache/src/php-5.5.15/Zend/zend.c:935
#6  0x083d2ab2 in php_request_shutdown (dummy=0x0) at
/home/cpeasyapache/src/php-5.5.15/main/main.c:1808
#7  0x084d15d9 in main (argc=3, argv=0xbfeaa914) at
/home/cpeasyapache/src/php-5.5.15/sapi/cgi/cgi_main.c:2505

------------------------------------------------------------------------
[2014-08-05 17:00:36] mike@php.net

commit typo

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=64111


--
Edit this bug report at https://bugs.php.net/bug.php?id=64111&edit=1


Thread (12 messages)

« previous php.bugs (#230651) next »