#37084 [NEW]: Segmentation fault, probably caused by nested function

From: e dot borger at grib dot nl Operating system: Fedora Core 4 PHP version: 5.1.2 PHP Bug Type: Reproducible crash Bug description: Segmentation fault, probably caused by nested function Description: ------------ NB: not tested with 5.1.2, we use 5.0.4, this is the last version for Fedora Core 4. We haven't been able to upgrade to PHP 5.1.2 at the moment (don't know how at the moment :( ). Haven't found anything in the bug database regarding this problem, that's why I've noted version as 5.1.2. Occurs on both webserver as CLI, but the error only shows on the CLI... in a browser you'll get a blank page. This is probably a combination of factors, the reproduce code is the shortest possible I guess. It seems it's the combination of using a superglobal and a function in a switch. It doesn't make sense, but it does produce a segmentation fault. I first noticed this when using my DB abstraction layer (simply functions like function dbQuery($query) { return pg_query($query); } in a switch statement to switch between DBMS. The reproduce code stops segfaulting when removing either the first lines (defining $action), the switch statement (leaving the code of the default case in), removing the call of test() or placing test() outside the switch statement. Reproduce code: --------------- <?PHP if (!isset($_GET['action'])) { $action = 'none'; } else { $action = $GET['action']; } switch ($action) { default: function test() { echo 2; } echo 1; test(); echo 3; } ?> Expected result: ---------------- 123 Actual result: -------------- 12Segmentation Fault GDB output, as in the example (I don't know what else to do with it :)). [root@server html]# gdb php GNU gdb Red Hat Linux (6.3.0.0-1.84rh) Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"... (no debugging symbols found) Using host libthread_db library "/lib/libthread_db.so.1". (gdb) run index2.php Starting program: /usr/bin/php index2.php Reading symbols from shared object read from target memory...(no debugging symbols found)...done. Loaded system supplied DSO at 0x91d000 (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread -1208960384 (LWP 1849)] 12 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1208960384 (LWP 1849)] 0x08169082 in _zval_ptr_dtor () (gdb) bt #0 0x08169082 in _zval_ptr_dtor () #1 0x08192d21 in zend_switch_free_handler () #2 0x08191d37 in execute () #3 0x08193d95 in zend_do_fcall_common_helper () #4 0x08191d37 in execute () #5 0x08173d2a in zend_execute_scripts () #6 0x0813ea30 in php_execute_script () #7 0x081a880e in main () (gdb) frame 2 #2 0x08191d37 in execute () (gdb) print (char *)(executor_globals.function_state_ptr->function)->common.function_name Attempt to extract a component of a value that is not a structure. (gdb) kill Kill the program being debugged? (y or n) y (gdb) quit -- Edit bug report at http://bugs.php.net/?id=37084&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=37084&r=trysnapshot44 Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=37084&r=trysnapshot51 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=37084&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=37084&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=37084&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=37084&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=37084&r=needscript Try newer version: http://bugs.php.net/fix.php?id=37084&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=37084&r=support Expected behavior: http://bugs.php.net/fix.php?id=37084&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=37084&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=37084&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=37084&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=37084&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=37084&r=dst IIS Stability: http://bugs.php.net/fix.php?id=37084&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=37084&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=37084&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=37084&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=37084&r=mysqlcfg