Bug #76339 [Fbk->NoF]: segfault during shutdown

Edit report at https://bugs.php.net/bug.php?id=76339&edit=1 ID: 76339 Updated by: php-bugs@lists.php.net Reported by: ray dot ward at bigcommerce dot com Summary: segfault during shutdown -Status: Feedback +Status: No Feedback Type: Bug Package: opcache Operating System: Debian 8.10 PHP Version: 7.2.5 Assigned To: cmb Private report: N New Comment: No feedback was provided. The bug is being suspended because we assume that you are no longer experiencing the problem. If this is not the case and you are able to provide the information that was requested earlier, please do so and change the status of the bug back to "Re-Opened". Thank you. Previous Comments: ------------------------------------------------------------------------ [2021-07-08 13:50:33] cmb@php.net Is this still an issue with any of the actively supported PHP versions[1]? [1] <https://www.php.net/supported-versions.php> ------------------------------------------------------------------------ [2018-05-22 09:41:27] nikic@php.net What stands out from your last traces is the vgMemCheck___builtin_vec_delete call, which indicates that something is trying to C++ delete[] a string allocated by PHP, which should definitely not be happening. From your extension list, the only one I know to use C++ is intl. ------------------------------------------------------------------------ [2018-05-22 07:28:19] ray dot ward at bigcommerce dot com I think that these implode/malloc reads are irrelevant to my issue as we get them whether the request segfaults or not. I think it's something more related to garbage collection or opcache. Looking at xdebug traces, I can confirm that the request completely finishes processing, and then it segfaults. We also don't get the complete output sent when this occurs, I presume there's still content in the output buffer that hasn't been flushed. ------------------------------------------------------------------------ [2018-05-21 00:07:58] ray dot ward at bigcommerce dot com Although there are still other instances without any preg_replace ==22467== Invalid read of size 16 ==22467== at 0x40A9B4D: ??? ==22467== by 0x1C47C667: ??? ==22467== by 0x1C47C667: ??? ==22467== by 0x1C47C6C5: ??? ==22467== by 0xFFEFFC6DF: ??? ==22467== by 0x38072BCF: vgMemCheck___builtin_vec_delete (mc_malloc_wrappers.c:508) ==22467== Address 0x1c47c6c0 is 112 bytes inside a block of size 124 alloc'd ==22467== at 0x4C28C20: malloc (vg_replace_malloc.c:296) ==22467== by 0x5B1148: __zend_malloc (in /usr/sbin/php-fpm7.2) ==22467== by 0x53F3FC: php_implode (in /usr/sbin/php-fpm7.2) ==22467== by 0x53F745: zif_implode (in /usr/sbin/php-fpm7.2) ==22467== by 0x68A77B: execute_ex (in /usr/sbin/php-fpm7.2) ==22467== by 0x690015: zend_execute (in /usr/sbin/php-fpm7.2) ==22467== by 0x5DD012: zend_execute_scripts (in /usr/sbin/php-fpm7.2) ==22467== by 0x578337: php_execute_script (in /usr/sbin/php-fpm7.2) ==22467== by 0x42DD07: main (in /usr/sbin/php-fpm7.2) ==22467== ------------------------------------------------------------------------ [2018-05-21 00:01:57] ray dot ward at bigcommerce dot com I disabled the newrelic extension as it seems to mess with the traces (though itself not responsible for the problems). Here's an extract from a valgrind with ZEND_DONT_UNLOAD_MODULES=1 and USE_ZEND_ALLOC=0: ==22467== Invalid read of size 16 ==22467== at 0x40A9B4D: ??? ==22467== by 0x1D856F37: ??? ==22467== by 0x1D856F37: ??? ==22467== by 0x1D856F60: ??? ==22467== by 0xFFEFFC1AF: ??? ==22467== by 0x38072BCF: vgMemCheck___builtin_vec_delete (mc_malloc_wrappers.c:508) ==22467== Address 0x1d856f60 is 64 bytes inside a block of size 67 alloc'd ==22467== at 0x4C28C20: malloc (vg_replace_malloc.c:296) ==22467== by 0x5B1148: __zend_malloc (in /usr/sbin/php-fpm7.2) ==22467== by 0x53F3FC: php_implode (in /usr/sbin/php-fpm7.2) ==22467== by 0x53F745: zif_implode (in /usr/sbin/php-fpm7.2) ==22467== by 0x68A77B: execute_ex (in /usr/sbin/php-fpm7.2) ==22467== by 0x5CC6BB: zend_call_function (in /usr/sbin/php-fpm7.2) ==22467== by 0x474003: php_pcre_replace_func_impl (in /usr/sbin/php-fpm7.2) ==22467== by 0x475381: php_replace_in_subject_func (in /usr/sbin/php-fpm7.2) ==22467== by 0x4755EE: preg_replace_func_impl (in /usr/sbin/php-fpm7.2) ==22467== by 0x475BD1: zif_preg_replace_callback (in /usr/sbin/php-fpm7.2) ==22467== by 0x68E968: execute_ex (in /usr/sbin/php-fpm7.2) ==22467== by 0x690015: zend_execute (in /usr/sbin/php-fpm7.2) Seems to implicate something calling preg_replace_callback or preg_replace_callback_array. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=76339 -- Edit this bug report at https://bugs.php.net/bug.php?id=76339&edit=1