#29566 [Opn]: foreach/string handling strangeness (crash)

ID: 29566 User updated by: stefan at hotpaenz dot de Reported By: stefan at hotpaenz dot de Status: Open Bug Type: Reproducible crash Operating System: Linux 2.6.3 PHP Version: 5.0.1 New Comment: Okay, I just discovered PHP only crashes with a non-debug build. My configure line is: ./configure --disable-cli --enable-cgi --without-pear Previous Comments: ------------------------------------------------------------------------ [2004-08-25 09:13:18] stefan at hotpaenz dot de It still crashes with stable PHP5 snapshot 200408250430 and HEAD snapshot 200408250630. Is there anything else I could do beside testing again and again? I would like to help you making PHP better, and I have some C knowledge, but I don't really understand the inner workings of Zend/PHP. Is there anything I could add to the code to reveal what leads to the crash? ------------------------------------------------------------------------ [2004-08-24 23:43:54] helly@php.net Please try using this CVS snapshot: http://snaps.php.net/php5-STABLE-latest.tar.gz For Windows: http://snaps.php.net/win32/php5.0-win32-latest.zip ------------------------------------------------------------------------ [2004-08-24 10:32:22] stefan at hotpaenz dot de I use Linux 2.6.3 and glibc 2.3.2. PHP crashes _after_ printing the warning "Invalid argument supplied for foreach()" at the end of the script (perhaps when cleaning up?). I tested again with the 200408240630 snapshots (stable and HEAD). This is the HEAD backtrace: #0 _efree (ptr=0x75736f6e) at /root/php/test/php5-200408240630/Zend/zend_alloc.c:285 285 CALCULATE_REAL_SIZE_AND_CACHE_INDEX(p->size); (gdb) bt #0 _efree (ptr=0x75736f6e) at /root/php/test/php5-200408240630/Zend/zend_alloc.c:285 #1 0x08178298 in _zval_ptr_dtor (zval_ptr=0xbfffd6a8) at /root/php/test/php5-200408240630/Zend/zend_execute_API.c:390 #2 0x081a3407 in zend_switch_free_handler (execute_data=0xbfffd710) at /root/php/test/php5-200408240630/Zend/zend_execute.c:245 #3 0x0819eb48 in execute (op_array=0x8274014) at /root/php/test/php5-200408240630/Zend/zend_execute.c:1498 #4 0x08181f95 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/php/test/php5-200408240630/Zend/zend.c:1052 #5 0x0814d5ad in php_execute_script (primary_file=0xbffffaa0) at /root/php/test/php5-200408240630/main/main.c:1633 #6 0x081a9c81 in main (argc=2, argv=0xbffffb64) at /root/php/test/php5-200408240630/sapi/cgi/cgi_main.c:1568 The backtrace of stable is slightly different: #0 _efree (ptr=0x75736f6e) at /root/php/test/php5-STABLE-200408240630/Zend/zend_alloc.c:263 263 CALCULATE_REAL_SIZE_AND_CACHE_INDEX(p->size); (gdb) bt #0 _efree (ptr=0x75736f6e) at /root/php/test/php5-STABLE-200408240630/Zend/zend_alloc.c:263 #1 0x081764b8 in _zval_ptr_dtor (zval_ptr=0xbfffd678) at /root/php/test/php5-STABLE-200408240630/Zend/zend_execute_API.c:391 #2 0x081a0632 in zend_switch_free_handler (execute_data=0xbfffd6f0, opline=0x8272464, op_array=0x826deec) at /root/php/test/php5-STABLE-200408240630/Zend/zend_execute.c:210 #3 0x0819c0a9 in execute (op_array=0x826deec) at /root/php/test/php5-STABLE-200408240630/Zend/zend_execute.c:1400 #4 0x081802b5 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/php/test/php5-STABLE-200408240630/Zend/zend.c:1061 #5 0x0814b99d in php_execute_script (primary_file=0xbffffa80) at /root/php/test/php5-STABLE-200408240630/main/main.c:1629 #6 0x081a68c7 in main (argc=2, argv=0xbffffb44) at /root/php/test/php5-STABLE-200408240630/sapi/cgi/cgi_main.c:1568 ------------------------------------------------------------------------ [2004-08-24 09:46:48] tony2001@php.net No crash with latest HEAD (Linux 2.6.8.1, glibc 2.3.2). ------------------------------------------------------------------------ [2004-08-24 09:40:13] stefan at hotpaenz dot de Indeed it works fine with the latest PHP4 snapshot (200408232230 tested), but this is a PHP5 bug. For the record: It still crashes with the 200408232230 PHP5 snapshot (unstable) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/29566 -- Edit this bug report at http://bugs.php.net/?id=29566&edit=1