#23333 [Opn->Csd]: Seg fault + hang using unset on array
| From: | sniper@php.net | Date: | Thu, 24 Apr 2003 17:06:05 +0000 |
| Subject: | #23333 [Opn->Csd]: Seg fault + hang using unset on array | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-38318@lists.php.net to get a copy of this message | ||
ID: 23333
Updated by: sniper@php.net
Reported By: smgallo at ccr dot buffalo dot edu
-Status: Open
+Status: Closed
Bug Type: Reproducible crash
Operating System: RedHat 7.3, glibc-2.2.5-39
PHP Version: 4.3.0
New Comment:
Please try using this CVS snapshot:
http://snaps.php.net/php4-STABLE-latest.tar.gz
For Windows:
http://snaps.php.net/win32/php4-win32-STABLE-latest.zip
Seems to be fixed, I just get this:
Fatal error: Allowed memory size of 8388608 bytes exhausted (tried to
allocate 35 bytes) in /home/jani/t2.php on line 19
When I set memory_limit=100M and max_execution_time=0, it
works fine and doesn't segfault.
(huge memory usage is normal as this array of yours is huge)
Previous Comments:
------------------------------------------------------------------------
[2003-04-24 11:01:31] smgallo at ccr dot buffalo dot edu
<?php
$big = array();
$test = array();
fwrite(STDOUT, "Start\n");
for($i=0; $i < 100000; $i++) {
$big[$i] = $i;
}
fwrite(STDOUT, "Middle\n");
for ($k=0; $k < 20; $k++) {
fwrite(STDOUT,"$k");
$test = array();
fwrite(STDOUT,".");
for($i=0; $i < 100000; $i++) {
$test[$i] = $big;
}
fwrite(STDOUT,".");
for($i=0; $i < 100000; $i++) {
unset($test[$i]);
}
// unset($test);
}
fwrite(STDOUT, "\nEnd\n");
?>
Running the above script produces the following output:
Start
Middle
0..1..2..
Segmentation fault
A trace in gdb produces:
Program received signal SIGSEGV, Segmentation fault.
0x4207ad8e in chunk_free () from /lib/i686/libc.so.6
(gdb) where
#0 0x4207ad8e in chunk_free () from /lib/i686/libc.so.6
#1 0x4207ad14 in free () from /lib/i686/libc.so.6
#2 0x08121bdc in zend_hash_destroy ()
#3 0x0811c5fa in _zval_dtor ()
#4 0x08114e01 in _zval_ptr_dtor ()
#5 0x08121aa6 in zend_hash_del_key_or_index ()
#6 0x0813587a in execute ()
#7 0x0811db3c in zend_execute_scripts ()
#8 0x080f75cd in php_execute_script ()
#9 0x081384a0 in main ()
#10 0x42017589 in __libc_start_main () from /lib/i686/libc.so.6
If I comment out the for loop containing the unset() and
instead use:
unset($test);
Then the script hangs. strace shows the following output and seems to
be in an infinite loop:
brk(0x8f73000) = 0x8f73000
brk(0x8f74000) = 0x8f74000
write(5, ".", 1.) = 1
munmap(0x40256000, 528384) = 0
brk(0x8a21000) = 0x8a21000
munmap(0x402d7000, 528384) = 0
write(5, "1", 11) = 1
write(5, ".", 1.) = 1
write(5, ".", 1.) = 1
munmap(0xcac4, 136005040) = -1 EINVAL (Invalid argument)
munmap(0xff797a94, 144821032) = -1 EINVAL (Invalid argument)
munmap(0x8658cc, 136016488) = -1 EINVAL (Invalid argument)
munmap(0xc608927c, 1108533240) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136028904) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136028960) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136029016) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136029072) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136029128) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136029184) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136029240) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136029296) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136029352) = -1 EINVAL (Invalid argument)
munmap(0xffffffcc, 136029408) = -1 EINVAL (Invalid argument)
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=23333&edit=1