#34617 [NEW]: zend_deactivate: objects_store used after zend_objects_store_destroy is called

From: guillaume dot outters at free dot fr Operating system: Mac OS X 10.4.2 PHP version: 6CVS-2005-09-23 (CVS) PHP Bug Type: Reproducible crash Bug description: zend_deactivate: objects_store used after zend_objects_store_destroy is called Description: ------------ In zend_deactivate: shutdown_executor() […] zend_destroy_rsrc_list() The first one calls zend_objects_store_destroy() and, in my case, the second one, through an xml_parser_dtor(), uses zend_objects_store_del_ref(). Inevitably, I got a crash. It seems that the XML parser (a resource) has kept references to Zend objects, because of a malformed XML; I don't know if, according to the Zend engine policy, it should have released them all or if it reveals a bug in the engine itself. What I know for sure is that commenting the zend_objects_store_destroy in zend_execute_API, and adding it to zend_deactivate() just before zend_ini_deactivate(), solves my problem. I use an Apache 2.1.7beta, but I don't think this has anything to do with it; my Mac is a PPC. The problem was revealed by an EXC_BAD_ACCESS, so I just put a breakpoint in free() and wait for it to be called with its first parameter looking like the beginning of the memory zone accessed at the crashing point. Reproduce code: --------------- Here is my crasher: http://guillaume.outters.free.fr/boum.tar.bz2 (uncompress in an Apache-accessible directory, everything should be here; call http://localhost/…/boum/album.php) racine.xml is the bad XML file (line 12: a closing "aff" instead of a "lieu" one). Maybe a simple parser with just an XML file read would reproduce the problem. I didn't try. Expected result: ---------------- No crash! Actual result: -------------- #0 0x0238e078 in zend_objects_store_del_ref (zobject=0x16ae108) at /tmp/php-src/Zend/zend_objects_API.c: 148 #1 0x02350874 in _zval_dtor_func (zvalue=0x16ae108, __zend_filename=0x2430a30 "/tmp/php-src/Zend/ zend_variables.h", __zend_lineno=35) at /tmp/php-src/Zend/ zend_variables.c:62 #2 0x0233804c in _zval_dtor (zvalue=0x16ae108, __zend_filename=0x2460fd0 "/tmp/php-src/Zend/ zend_execute_API.c", __zend_lineno=396) at /tmp/php-src/ Zend/zend_variables.h:35 #3 0x02338454 in _zval_ptr_dtor (zval_ptr=0x16adbc0, __zend_filename=0x245ae2c "/tmp/php-src/ext/xml/xml.c", __zend_lineno=374) at /tmp/php-src/Zend/zend_execute_API.c: 396 #4 0x022c6030 in xml_parser_dtor (rsrc=0x16ae048) at /tmp/ php-src/ext/xml/xml.c:374 #5 0x02370a34 in list_entry_destructor (ptr=0x16ae048) at / tmp/php-src/Zend/zend_list.c:184 #6 0x0236aff8 in zend_hash_apply_deleter (ht=0x251cf14, p=0x16adfe8) at /tmp/php-src/Zend/zend_hash.c:668 #7 0x0236b348 in zend_hash_graceful_reverse_destroy (ht=0x251cf14) at /tmp/php-src/Zend/zend_hash.c:734 #8 0x02370c9c in zend_destroy_rsrc_list (ht=0x251cf14) at / tmp/php-src/Zend/zend_list.c:240 #9 0x02355b4c in zend_deactivate () at /tmp/php-src/Zend/ zend.c:1602 -- Edit bug report at http://bugs.php.net/?id=34617&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=34617&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=34617&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=34617&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=34617&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=34617&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=34617&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=34617&r=needscript Try newer version: http://bugs.php.net/fix.php?id=34617&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=34617&r=support Expected behavior: http://bugs.php.net/fix.php?id=34617&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=34617&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=34617&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=34617&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=34617&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=34617&r=dst IIS Stability: http://bugs.php.net/fix.php?id=34617&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=34617&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=34617&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=34617&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=34617&r=mysqlcfg