#32751 [Fbk->Opn]: Segfault after code execution (destructor calls)

ID: 32751 User updated by: prism at pld-linux dot org Reported By: prism at pld-linux dot org -Status: Feedback +Status: Open Bug Type: Zend Engine 2 problem Operating System: PLD Linux Distribution PHP Version: 5.0.4 New Comment: Our Configure Command: './configure' 'LDFLAGS=' 'CFLAGS=-O2 -march=i686 -DEAPI=1 -I/usr/X11R6/include -I/usr/include/apr -I/usr/include/apr-util -I/usr/include' 'CXXFLAGS=-O2 -march=i686' 'FFLAGS=-O2 -march=i686' 'CPPFLAGS=' 'CC=i686-pld-linux-gcc' 'CXX=i686-pld-linux-g++' '--build=i686-pld-linux' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc/php' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib' '--libexecdir=/usr/lib' '--localstatedir=/var' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--x-libraries=/usr/X11R6/lib' '--with-apxs2=/usr/sbin/apxs' '--enable-maintainer-zts' '--with-config-file-path=/etc/php' '--with-exec-dir=/usr/bin' '--disable-debug' '--enable-memory-limit' '--enable-bcmath=shared' '--enable-calendar=shared' '--enable-ctype=shared' '--enable-dba=shared' '--enable-dbx=shared' '--enable-dio=shared' '--enable-dom=shared' '--enable-exif=shared' '--enable-filepro=shared' '--enable-ftp=shared' '--enable-gd-native-ttf' '--enable-gd-jus-conf' '--enable-magic-quotes' '--enable-mbstring=shared,all' '--enable-mbregex' '--enable-pcntl=shared' '--enable-posix=shared' '--enable-session' '--enable-shared' '--enable-shmop=shared' '--enable-sysvmsg=shared' '--enable-sysvsem=shared' '--enable-sysvshm=shared' '--enable-track-vars' '--enable-trans-sid' '--enable-safe-mode' '--enable-sockets=shared' '--enable-ucd-snmp-hack' '--enable-wddx=shared' '--enable-xml=shared' '--enable-yp=shared' '--enable-soap=shared' '--with-bz2=shared' '--with-cpdflib=shared' '--with-curl=shared' '--with-db4' '--with-dbase=shared' '--with-expat-dir=shared,/usr' '--with-iconv=shared' '--with-fam=shared' '--with-filepro=shared' '--with-freetype-dir=shared' '--with-gettext=shared' '--with-gd=shared,/usr' '--with-gdbm' '--with-gmp=shared' '--with-imap=shared' '--with-imap-ssl' '--with-interbase=shared,/usr' '--with-jpeg-dir=/usr' '--with-ldap=shared' '--with-mcrypt=shared' '--with-mhash=shared' '--with-mime-magic=shared,/usr/share/file/magic.mime' '--with-ming=shared' '--with-mnogosearch=shared,/usr' '--with-msession=shared' '--with-mssql=shared' '--with-mysql=shared,/usr' '--with-mysql-sock=/var/lib/mysql/mysql.sock' '--with-mysqli=shared' '--with-ncurses=shared' '--with-openssl=shared' '--with-pcre-regex=shared' '--with-pear=/usr/share/pear' '--with-pgsql=shared,/usr' '--with-png-dir=/usr' '--with-pspell=shared' '--with-readline=shared' '--with-recode=shared' '--with-regex=php' '--without-sablot-js' '--with-snmp=shared' '--with-sybase=shared,/usr' '--with-sybase-ct=shared,/usr' '--with-sqlite=shared,/usr' '--with-t1lib=shared' '--with-tidy=shared' '--with-tiff-dir=/usr' '--with-unixODBC=shared' '--with-xmlrpc=shared,/usr' '--with-xsl=shared' '--with-zlib=shared' '--with-zlib-dir=shared,/usr' Previous Comments: ------------------------------------------------------------------------ [2005-04-22 14:39:36] sniper@php.net Using this code, from the url you posted: <?php $link = mysql_pconnect('localhost', 'aaa', 'bbb'); mysql_select_db('ccc', $link); if($link) mysql_close($link); echo 'I am still alive'; ?> And I can not reproduce this. Not with PHP 4.3.12-dev, PHP 5.1-dev..and I have glibc 2.3.4 (FC2) What is the configure line you are using with PHP? ------------------------------------------------------------------------ [2005-04-20 01:17:06] tony2001@php.net Works fine on SuSE 9.2/glibc 2.3.3. I'm 100% sure it also works on other systems I have around here, but I'll check it tomorrow. ------------------------------------------------------------------------ [2005-04-19 22:37:43] prism at pld-linux dot org I did't try in other OS. Later, I'll see in Windows - but I have to set up the environment first. Yes. I used glibc 2.3.4 before, and switched to 2.3.5 to see if it helps. It also happened earlier, when I had some older glibc, but I ignored it. The code also fails in CLI. Actually, we test it in CLI because Apache doesn't get any output from PHP module since it dies - proxy says that zero-sized reply comes. And finally: Yes, we build as much we can as modules to package it into separate packages. ------------------------------------------------------------------------ [2005-04-19 22:23:38] tony2001@php.net Are you able to reproduce it under a different OS? Or at least with different glibc? Is it reproducible only with Apache2 or with CLI too? As far as I can see, mysql is built as shared module or am I wrong? ------------------------------------------------------------------------ [2005-04-18 21:49:05] prism at pld-linux dot org Description: ------------ Zend engine or all modules which use persistent_list. persistent_list is destroyed after modules are unloaded. But some modules register own destructors for elements put on persistent_list. When Zend destroys such entry from persistent_list, it tries to call destructor from unloaded module and segfaults. Reproduce code: --------------- Look here: http://comments.gmane.org/gmane.linux.pld.devel.english/785 and start reading from post written at 16 Apr 17:33 by Michal Lukaszek, and below from that. Expected result: ---------------- No segfault. Actual result: -------------- > (gdb) bt > #0 0xb78a6978 in ?? () > #1 0xb7f557da in plist_entry_destructor (ptr=0x81e11b8) > at /home/comp/rpm/BUILD/php-5.0.4/Zend/zend_list.c:204 > #2 0xb7f5385f in zend_hash_apply_deleter (ht=0x8052c50, p=0x81ec1a0) > at /home/comp/rpm/BUILD/php-5.0.4/Zend/zend_hash.c:574 > #3 0xb7f53ab0 in zend_hash_graceful_reverse_destroy (ht=0x8052c50) > at /home/comp/rpm/BUILD/php-5.0.4/Zend/zend_hash.c:640 > #4 0xb7f558f6 in zend_destroy_rsrc_list (ht=0x8052c50, tsrm_ls=0x804f0a0) > at /home/comp/rpm/BUILD/php-5.0.4/Zend/zend_list.c:234 > #5 0xb7f49c20 in zend_shutdown (tsrm_ls=0x804f0a0) > at /home/comp/rpm/BUILD/php-5.0.4/Zend/zend.c:714 > #6 0xb7ef42d5 in php_module_shutdown (tsrm_ls=0x804f0a0) > at /home/comp/rpm/BUILD/php-5.0.4/main/main.c:1518 > #7 0x0804be1e in main (argc=2, argv=0xbffff174) > at /home/comp/rpm/BUILD/php-5.0.4/sapi/cli/php_cli.c:1055 > (gdb) f 1 > #1 0xb7f557da in plist_entry_destructor (ptr=0x81e11b8) > at /home/comp/rpm/BUILD/php-5.0.4/Zend/zend_list.c:204 > 204 ld->plist_dtor_ex(le TSRMLS_CC); > (gdb) p ld->plist_dtor_ex > $1 = 0xb78a6978 > (gdb) x ld->plist_dtor_ex > 0xb78a6978: Cannot access memory at address 0xb78a6978 it's in (unloaded) php-mysql module > The list here is "persistent_list", which is used by php-mysql for > persistent connection - so it's probably bug in php-mysql module or php > engine itself. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=32751&edit=1