#25394 [Com]: Segfault and Crash on long scripts.

ID: 25394 Comment by: eugene at fsck dot net Reported By: mark dot meredith at shaw dot ca Status: Bogus Bug Type: Reproducible crash Operating System: MAC OS 10.2.6 PHP Version: 4CVS-2003-09-06 (stable) New Comment: I get the same problems with php-4.3.3 built with "-- enable-memory-limit" as recommended, as well as "memory_limit = -1" in php.ini. I ran a simple PHP script that contains 8192 identical lines that perform a simple variable assignment: $x = 1; My gdb session: --------------- (gdb) run ~/crash.php Starting program: /Users/eugene/src/php/php-4.3.3/sapi/cli/ php ~/crash.php Reading symbols for shared libraries . done Program received signal EXC_BAD_ACCESS, Could not access memory. execute (op_array=0x134de8) at /Users/eugene/src/php/php- 4.3.3/Zend/zend_execute.c:1027 1027 EX(Ts) = (temp_variable *) do_alloca(sizeof(temp_variable)*op_array->T); (gdb) bt #0 execute (op_array=0x134de8) at /Users/eugene/src/php/ php-4.3.3/Zend/zend_execute.c:1027 #1 0x000c704c in zend_execute_scripts (type=4231488, retval=0x0, file_count=3) at /Users/eugene/src/php/php- 4.3.3/Zend/zend.c:885 #2 0x0009c4ec in php_execute_script (primary_file=0x0) at /Users/eugene/src/php/php-4.3.3/main/main.c:1723 #3 0x000d9e34 in main (argc=2, argv=0xbffffc94) at /Users/ eugene/src/php/php-4.3.3/sapi/cli/php_cli.c:818 Mac OS X 10.2.8, build 6R65. $ uname -v Darwin Kernel Version 6.8: Wed Sep 10 15:20:55 PDT 2003; root:xnu/xnu-344.49.obj~2/RELEASE_PPC $ gcc -v Reading specs from /usr/libexec/gcc/darwin/ppc/3.3/specs Thread model: posix gcc version 3.3 20030304 (Apple Computer, Inc. build 1493) Previous Comments: ------------------------------------------------------------------------ [2003-09-07 11:28:14] sniper@php.net [xserver:~/jani/php4] admin% uname -v Darwin Kernel Version 6.6: Thu May 1 21:48:54 PDT 2003 [xserver:~/jani/php4] admin% sapi/cli/php ../t.php Allowed memory size of 8388608 bytes exhausted (tried to allocate 14155776 bytes) ------------------------------------------------------------------------ [2003-09-07 01:29:41] mark dot meredith at shaw dot ca Are you sure you were running this on a Apple Mac OS X box? I have tried the memory_limit directive and corresponding configure option. Even when set to allow 64MB the script still crashes at exactly the same length. I also used no memory directive and a memory limit of -1. Everything produces the same result at the same point in the script. After the report was labeled "Bogus" I got my hands on a brand new iBook. Same thing. I have also tried the www.serverlogistics.com and www.entropy.ch builds with the same crash at the same line. Thanks again for your time and efforts. I hope this is squashable. ------------------------------------------------------------------------ [2003-09-06 19:14:49] sniper@php.net Can not reproduce with a script that has $x=1 about 500'000 times. Only thing I get is: Allowed memory size of 8388608 bytes exhausted at /usr/src/web/php/php4_3/Zend/zend_opcode.c:48 (tried to allocate 11796480 bytes) I suggest you use '--enable-memory-limit' configure option and set the 'memory_limit' directive in php.ini to a reasonable amount. This will prevent any stupid scripts like this from crashing. ------------------------------------------------------------------------ [2003-09-06 03:50:36] mark dot meredith at shaw dot ca Description: ------------ I have tested this with the 4.3.2 and 4.3.3 official releases as well. I have not tried any earlier releases. I have tried with the command line or as an Apache 1 or Apache 2 module all with the same result. I used no extensions or modules for the builds in all cases. Apparently the bug does not occur for Windows XP Pro and likely some other operating systems. I was told this by some users of a PHP forum who tried their own test scripts. The result of memory_get_usage() placed on a script one line shorter than the crash length returned around 1MB. Thank you. Reproduce code: --------------- <?php /*presumably any long script that consumes enough memory will cause the problem*/ /*this assignment done about 10000 times*/ $x = 1; ?> Expected result: ---------------- Nothing but a clean run through. Actual result: -------------- The backtrace from the STABLE snapshot cli was... (gdb) bt #0 0x00183b9c in execute (op_array=0x4e7c58) at /Users/ markmere/Sources/php4-snapshot/Zend/zend_execute.c:1027 #1 0x0016e334 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /Users/markmere/Sources/php4-snapshot/ Zend/zend.c:885 #2 0x001208e0 in php_execute_script (primary_file=0xbffff7c0) at /Users/markmere/Sources/php4- snapshot/main/main.c:1723 #3 0x0018ea84 in main (argc=2, argv=0xbffffd24) at /Users/ markmere/Sources/php4-snapshot/sapi/cli/php_cli.c:819 #4 0x00002564 in _start (argc=2, argv=0xbffffd24, envp=0xbffffd30) at /SourceCache/Csu/Csu-45/crt.c:267 #5 0x000023e4 in start () ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=25394&edit=1