Edit report at https://bugs.php.net/bug.php?id=81580&edit=1
ID: 81580
Updated by: nikic@php.net
Reported by: patrick dot schaaf at yalwa dot com
Summary: SEGV (probably stack limits) while autoloading from
a shutdown function
Status: Open
Type: Bug
Package: Reproducible crash
Operating System: openSUSE Tumbleweed
PHP Version: 8.0.12
Block user comment: N
Private report: N
New Comment:
Not sure this is a stack overflow, the crash location is pretty typical for memory corruption.
Deeply nested zend_compile_binary_op() can occur for code containing a very large "a" .
"b" . "c" style expression with many operands. Is something like that present in
the detect_bot file?
Previous Comments:
------------------------------------------------------------------------
[2021-11-01 06:49:49] patrick dot schaaf at yalwa dot com
Description:
------------
Unfortunately, reproducible, but only in the sense of running production traffic and waiting a few
hundred requests for the first coredump... I encounter SEGVs quickly on our production codebase,
which has been running stably on the late(st) PHP 5.6 (yeah...), in our attempts at finally making
the jump to PHP 8.
System / context is openSUSE tumbleweed, pretty much latest, current apache, mod_php8 at PHP level
8.0.12. opcache disabled (not installed at all) because we saw other issues with opcache that
I'll try to reoirt seoarateky.
Code context: We have a little homegrown autoloader in use there, and also pretty much each web
request, registers shutdown function; one of them, was consistently implicated in 4 coredumps I got
in quick succession (seconds apart) on trying 8.0.12 with our production load. Actual place there in
the shutdown function, seen by a bit of gdb backtrace + data inspection, is a call to sprintf() with
one of the parameters, being a class_name::method() static call for a class in all these four cases
not yet autoloaded - triggering the autoloader for it and then that goes into a three-function stack
eating recursive triangle of calls for a few thousand frames while walking the AST.
Emphasis on this is something we do on each request served there, same on a ton of development
systems where we never saw the crashes / coredumps, weirdly. Trying to reproduce with same context
(shutdown function running while that class was not autoloaded), I could not reproduce it "just
so" either, unfortunately.
Test script:
---------------
Don't have a reliable reproding test script, sorry. Here is what the call in the shutdown
function actually looks like, abbreviated:
apache_note('phpstat',
sprintf("%s-%s:%.0f:%.0f-%.0f:%.0f-%.0f:%.0f:%.0f:%.0f:%.0f:%.0f:%.0f:%.0f:%.0f:%.0f:%.0f:%.0f:%.0f:%.0f:%s:%s:%s:%s:%s",
self::$page,
...
# <-- crashes while autoloading / compiling "detect_bot" from here
detect_bot::get_apache_logtag(),
...
));
Actual result:
--------------
gdb / backtrace info, if anything is missing that you need to know, tell me the frame # and what to
look for.
----------------------
Core was generated by `/usr/sbin/httpd-prefork -DSYSCONFIG -DSSL -DSTATUS -C PidFile /run/httpd.pid
-C'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 zend_mm_alloc_small (bin_num=24, heap=0x7f31a4e00040) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_alloc.c:1255
1255 heap->free_slot[bin_num] = p->next_free_slot;
----------------------
(gdb) bt
#0 zend_mm_alloc_small (bin_num=24, heap=0x7f31a4e00040) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_alloc.c:1255
#1 zend_mm_alloc_heap (size=<optimized out>, heap=0x7f31a4e00040) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_alloc.c:1326
#2 _emalloc (size=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_alloc.c:2540
#3 0x00007f31a57dcc32 in zend_string_alloc (persistent=false, len=1003) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_string.h:143
#4 concat_function (result=0x7ffe8caef5c8, op1=<optimized out>, op2=<optimized out>)
at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_operators.c:1899
#5 0x00007f31a57c9e36 in zend_try_ct_eval_binary_op (op2=0x7ffe8caef4f8, op1=0x7ffe8caef4d8,
opcode=8, result=0x7ffe8caef5c8)
at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:7918
#6 zend_try_ct_eval_binary_op (op2=0x7ffe8caef4f8, op1=0x7ffe8caef4d8, opcode=8,
result=0x7ffe8caef5c8)
at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:7911
#7 zend_compile_binary_op (ast=0x7ffe8caef4f8, result=0x7ffe8caef5c0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:8094
#8 zend_compile_expr_inner (result=0x7ffe8caef5c0, ast=0x7ffe8caef4f8) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9538
#9 0x00007f31a57ca26c in zend_compile_expr (result=0x7ffe8caef5c0, ast=0x7f31a4f18cc8)
at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9640
#10 0x00007f31a57c8506 in zend_compile_binary_op (ast=0x7f31a4f18cf8, result=0x7ffe8caef6b0)
at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:8090
#11 zend_compile_expr_inner (result=0x7ffe8caef6b0, ast=0x7f31a4f18cf8) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9538
#12 0x00007f31a57ca26c in zend_compile_expr (result=0x7ffe8caef6b0, ast=0x7f31a4f18cf8)
at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9640
#13 0x00007f31a57c8506 in zend_compile_binary_op (ast=0x7f31a4f18d28, result=0x7ffe8caef7a0)
at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:8090
*** THESE THREE FRAMES, LIKE #11/#12/#13, then repeat over and over for a long stretch ***
#1830 0x00007f31a57ca26c in zend_compile_expr (result=0x7ffe8cb12ed0, ast=0x7f31a4f24ec0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9640
#1831 0x00007f31a57c8506 in zend_compile_binary_op (ast=0x7f31a4f24ef0, result=0x7ffe8cb12fc0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:8090
#1832 zend_compile_expr_inner (result=0x7ffe8cb12fc0, ast=0x7f31a4f24ef0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9538
#1833 0x00007f31a57ba04d in zend_compile_expr (ast=0x7f31a4f24ef0, result=0x7ffe8cb12fc0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9640
#1834 zend_compile_args (may_have_extra_named_args=<synthetic pointer>, fbc=0x5562fea7d800,
ast=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:3481
#1835 zend_compile_call_common (result=<optimized out>, args_ast=<optimized out>,
fbc=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:3568
#1836 0x00007f31a57cadb8 in zend_compile_call (ast=0x7f31a4f24f08, ast=0x7f31a4f24f08,
type=<optimized out>, result=0x7ffe8cb131d0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:4355
#1837 zend_compile_var_inner (by_ref=<optimized out>, type=<optimized out>,
ast=0x7f31a4f24f08, result=0x7ffe8cb131d0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9659
#1838 zend_compile_var (result=0x7ffe8cb131d0, ast=0x7f31a4f24f08, type=<optimized out>,
by_ref=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9685
#1839 0x00007f31a57bfe77 in zend_compile_expr (ast=0x7f31a4f24f08, result=0x7ffe8cb131d0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9640
#1840 zend_compile_stmt (ast=0x7f31a4f24f08) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9482
#1841 0x00007f31a57bfb7f in zend_compile_stmt_list (ast=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:5990
#1842 zend_compile_stmt (ast=0x7f31a4f16cb8) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9394
#1843 0x00007f31a57c4a6c in zend_compile_func_decl (result=<optimized out>, ast=<optimized
out>, toplevel=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:6988
#1844 0x00007f31a57c015c in zend_compile_stmt (ast=0x7f31a4f24f20) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9447
#1845 0x00007f31a57bfb7f in zend_compile_stmt_list (ast=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:5990
#1846 zend_compile_stmt (ast=0x7f31a4f2fef8) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9394
#1847 0x00007f31a57c587a in zend_compile_class_decl (result=0x0, ast=0x7f31a4f30510,
toplevel=<optimized out>) at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86
64/Zend/zend_compile.c:7398
#1848 0x00007f31a57c652d in zend_compile_top_stmt (ast=0x7f31a4f30510) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9369
#1849 zend_compile_top_stmt (ast=0x7f31a4efe018) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_compile.c:9358
#1850 0x00007f31a579fd16 in zend_compile (type=type@entry=2) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_language_scanner.c:630
#1851 0x00007f31a57a015a in compile_file (file_handle=0x7ffe8cb13d20, type=8) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_language_scanner.c:665
#1852 0x00007f31a279bf2a in phar_compile_file (file_handle=0x7ffe8cb13d20, type=8) at
/usr/src/debug/php8-8.0.12-1.1.x86_64/ext/phar/phar.c:3364
#1853 0x00007f31a57a01d3 in compile_filename (type=8, filename=0x7f31a4e11fe0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_language_scanner.c:721
#1854 0x00007f31a57fe277 in zend_include_or_eval (inc_filename=0x7f31a4e11fe0, type=8) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_execute.c:4274
#1855 0x00007f31a580f914 in ZEND_INCLUDE_OR_EVAL_SPEC_TMPVAR_HANDLER (execute_data=0x7f31a4e11f10)
at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_vm_execute.h:14266
#1856 0x00007f31a584d1d8 in execute_ex (ex=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_vm_execute.h:53978
#1857 0x00007f31a57d008e in zend_call_function (fci=<optimized out>, fci_cache=<optimized
out>) at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_execute_API.c:895
#1858 0x00007f31a57d044a in zend_call_known_function (fn=0x7f31a4e013d8, object=<optimized
out>, called_scope=<optimized out>, retval_ptr=<optimized out>,
param_count=<optimized out>, params=0x7ffe8cb140d0, named_params=0x0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_execute_API.c:985
#1859 0x00007f31a56d5c4f in spl_perform_autoload (class_name=0x7f31a4e8f870, lc_name=0x7f31a4e8f870)
at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/ext/spl/php_spl.c:440
#1860 0x00007f31a57cf5b0 in zend_lookup_class_ex (name=name@entry=0x7f31a4e8f870,
key=0x7f31a4e8f870, flags=flags@entry=512) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_execute_API.c:1110
#1861 0x00007f31a57d49ef in zend_fetch_class_by_name (class_name=0x7f31a4e8f870, key=<optimized
out>, fetch_type=512) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_execute_API.c:1521
#1862 0x00007f31a5807d48 in ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER
(execute_data=0x7f31a4e11020) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_vm_execute.h:6570
#1863 0x00007f31a584d1d8 in execute_ex (ex=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_vm_execute.h:53978
#1864 0x00007f31a57d008e in zend_call_function (fci=<optimized out>, fci_cache=<optimized
out>) at /usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_execute_API.c:895
#1865 0x00007f31a57ce4ce in _call_user_function_impl (object=<optimized out>,
function_name=<optimized out>, retval_ptr=<optimized out>, param_count=<optimized
out>, params=<optimized out>, named_params=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_execute_API.c:659
#1866 0x00007f31a570f224 in user_shutdown_function_call (zv=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/ext/standard/basic_functions.c:1693
#1867 0x00007f31a57ec7b2 in zend_hash_apply (ht=0x7f31a4e58700, apply_func=0x7f31a570f1e0
<user_shutdown_function_call>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/Zend/zend_hash.c:1837
#1868 0x00007f31a570f3d6 in php_call_shutdown_functions () at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/ext/standard/basic_functions.c:1766
#1869 0x00007f31a5776755 in php_request_shutdown (dummy=<optimized out>) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/main/main.c:1782
#1870 0x00007f31a587694f in php_apache_request_dtor (r=0x5562fed463c0) at
/usr/src/debug/apache2-mod_php8-8.0.12-1.1.x86_64/sapi/apache2handler/sapi_apache2.c:54
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81580&edit=1