#28602 [NEW]: Segmentation fault in _zval_ptr_dtor()

From: arkadi at mebius dot lv Operating system: FreeBSD PHP version: 4.3.6 PHP Bug Type: Unknown/Other Function Bug description: Segmentation fault in _zval_ptr_dtor() Description: ------------ Apache 1.3.31, DSO mod_php4, FreeBSD 4.9, compiled with -O -g. I have apache core files with a segmentation fault error on the same line inside the PHP: #0 0x2842f72d in _zval_ptr_dtor (zval_ptr=0x8ff1158) at /usr/home/arkadi/build/php-4.3.6/Zend/zend_execute_API.c:289 289 (*zval_ptr)->refcount--; (gdb) bt #0 0x2842f72d in _zval_ptr_dtor (zval_ptr=0x8ff1158) at /usr/home/arkadi/build/php-4.3.6/Zend/zend_execute_API.c:289 #1 0x2843c839 in zend_hash_destroy (ht=0x83a5e0c) at /usr/home/arkadi/build/php-4.3.6/Zend/zend_hash.c:553 #2 0x2842f37e in shutdown_executor () at /usr/home/arkadi/build/php-4.3.6/Zend/zend_execute_API.c:180 #3 0x28437f80 in zend_deactivate () at /usr/home/arkadi/build/php-4.3.6/Zend/zend.c:667 #4 0x2840ea6e in php_request_shutdown (dummy=0x0) at /usr/home/arkadi/build/php-4.3.6/main/main.c:996 #5 0x28451667 in php_apache_request_shutdown (dummy=0x0) at /usr/home/arkadi/build/php-4.3.6/sapi/apache/mod_php4.c:302 #6 0x8050bfa in run_cleanups (c=0x838a80c) at alloc.c:1936 #7 0x804fbfb in ap_clear_pool (a=0x836400c) at alloc.c:650 #8 0x804fc5c in ap_destroy_pool (a=0x836400c) at alloc.c:680 #9 0x804fbe7 in ap_clear_pool (a=0x80d600c) at alloc.c:643 #10 0x805c2ae in child_main (child_num_arg=23) at http_main.c:4548 #11 0x805c8cd in make_child (s=0x8099034, slot=23, now=1086039560) at http_main.c:5051 #12 0x805cfe8 in standalone_main (argc=2, argv=0xbfbffbec) at http_main.c:5451 #13 0x805d597 in main (argc=2, argv=0xbfbffbec) at http_main.c:5757 (gdb) p zval_ptr $1 = (zval **) 0x8ff1158 (gdb) p **zval_ptr Cannot access memory at address 0x3. (gdb) p *zval_ptr $2 = (zval *) 0x3 The error happens approximatelly every 100,000 requests. MaxRequestPerChild is set to 10,000. There are malloc() errors in error_log that may be related: httpd in free(): warning: chunk is already free httpd in malloc(): warning: recursive call FATAL: emalloc(): Unable to allocate 1617 bytes or just malloc() w/o free(): httpd in malloc(): warning: recursive call FATAL: emalloc(): Unable to allocate 1851 bytes Since last httpd restart there are 300,000 requests, three core files, four free() errors and five malloc() errors in error_log. They happens at different times though. Similar problem was reported in bug #14239. -- Edit bug report at http://bugs.php.net/?id=28602&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=28602&r=trysnapshot4 Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=28602&r=trysnapshot5 Fixed in CVS: http://bugs.php.net/fix.php?id=28602&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=28602&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=28602&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=28602&r=needscript Try newer version: http://bugs.php.net/fix.php?id=28602&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=28602&r=support Expected behavior: http://bugs.php.net/fix.php?id=28602&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=28602&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=28602&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=28602&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=28602&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=28602&r=dst IIS Stability: http://bugs.php.net/fix.php?id=28602&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=28602&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=28602&r=float