ID: 34712
User updated by: jason at jasonjustman dot com
Reported By: jason at jasonjustman dot com
-Status: Feedback
+Status: Open
Bug Type: Reproducible crash
-Operating System: solars 10
+Operating System: solaris 10
PHP Version: 5CVS-2005-10-03 (snap)
Assigned To: dmitry
New Comment:
http://www.jasonjustman.com/crash.phps
line 114 is what causes the segfault:
$this->_transform_actions = new
base_object_meta_transform_actions($this);
its not clean nor tight, but an example of the pattern that causes it
to crash
Previous Comments:
------------------------------------------------------------------------
[2005-10-03 22:23:13] sniper@php.net
We really need a reproducing script. Please try come up with one.
------------------------------------------------------------------------
[2005-10-03 18:02:29] jason at jasonjustman dot com
Like i said before, i can't track down the exact sequence (stacktrace
of the .php script code shows its in the 12-14th depth), and for full
debug - only after parsing about 15kloc of code.
When adding in debugging php source code in the new call (
$this->_helper = new helper($this);), it prevents the crash but in one
case a print_r($this) in the aggrevator:: scope resulted in an empty
object.
This testcase is more pseudocode of the segfault pattern than actual
instance. If you'd like I can privately attach the application source
- but again, its not an application problem - as turning off ze1_compat
doesn't cause a segfault , but is required for implicit clone.
This happens in the same spot for the 5.0.5, 5.0.6-dev and 5.0.6-latest
- even after building in seperate directories with no caching enabled.
------------------------------------------------------------------------
[2005-10-03 12:13:48] dmitry@php.net
This test case must not work at all.
$ php -d "zend.ze1_compatibility_mode=1" bug34712.php
Fatal error: Cannot use 'parent' as class name as it is reserved in
/home/dmitry/php/test/bug34712.php on line 20
Without "parent" it works fine on Linux/i386.
Try to make full rebuild.
------------------------------------------------------------------------
[2005-10-03 10:29:43] jason at jasonjustman dot com
last two lines of sample code should be:
$c = new child;
$a = new aggrevator($c);
------------------------------------------------------------------------
[2005-10-03 10:05:08] jason at jasonjustman dot com
Description:
------------
segfault in solaris 10, using php-5.0.6-dev - php5-STABLE-200510030637
Program received signal SIGSEGV, Segmentation fault.
0xff019b38 in zend_objects_clone_obj (zobject=0xff3fffd8) at
/export/apache/php5-STABLE-200510030637/Zend/zend_objects.c:181
181 new_obj_val = zend_objects_new(&new_object,
old_object->ce TSRMLS_CC);
(gdb) backtrace
#0 0xff019b38 in zend_objects_clone_obj (zobject=0xff3fffd8) at
/export/apache/php5-STABLE-200510030637/Zend/zend_objects.c:181
#1 0xff019970 in zval_add_ref_or_clone (p=0x0) at
/export/apache/php5-STABLE-200510030637/Zend/zend_objects.c:127
Reproduce code:
---------------
can't exactly pin down reproduceable code, but it seems to be something
similar to the following:
class aggrevator {
function aggrevator(&$obj) {
$this->obj = &$obj;
$this->_call();
}
function _call()
{
$this->obj->callback();
}
}
class helper {
function helper(&$obj)
{
$this->obj_ref = &$obj;
}
}
class parent { }
class child extends parent {
function callback() {
$this->_helper = new helper($this);
}
}
$c = new child;
$h = new helper($c);
Expected result:
----------------
not to crash...
Actual result:
--------------
f'd in the a, segfault
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=34712&edit=1