PHP 4.0 Bug #4030: Apache SEGFAULTs on exit

From: orb@blib.win.tue.nl Operating system: FreeBSD-CURRENT (5.0 March 27) PHP version: 4.0 Release Candidate 1 PHP Bug Type: Reproduceable crash Bug description: Apache SEGFAULTs on exit With php4.0RC1 on FreeBSD-5.0-CURRENT (march 27), php configure options: ./configure \ --prefix=/usr/local \ --with-system-regex \ --with-apache=../apache_1.3.12 \ --with-config-file-path=/usr/local/etc \ --enable-debug \ --enable-track-vars \ --without-gd \ --with-zlib \ --with-mysql=/usr/local I get a segfault every time my .php page is accessed. Connections are closed by that time so the only annoying thing is a kernel warning message (and the fact that Zend still has a bug left ;-) Unfortunately this occurs only with certain php pages (which I'm happy to send to you if requested) but I couldn't narrow it down to a specific case. I have observed this behavior using earlier CVS versions but was unable to get a trace until now. (gdb) set args -X (gdb) run Starting program: /usr/local/sbin/./apache -X Program received signal SIGSEGV, Segmentation fault. _mem_block_check (ptr=0x83e58955, silent=1, __zend_filename=0x811be3c "zend_execute_API.c", __zend_lineno=217, __zend_orig_filename=0x0, __zend_orig_lineno=0) at zend_alloc.c:483 483 switch (p->magic) { (gdb) bt #0 _mem_block_check (ptr=0x83e58955, silent=1, __zend_filename=0x811be3c "zend_execute_API.c", __zend_lineno=217, __zend_orig_filename=0x0, __zend_orig_lineno=0) at zend_alloc.c:483 #1 0x8067ece in _efree (ptr=0x83e58955, __zend_filename=0x811be3c "zend_execute_API.c", __zend_lineno=217, __zend_orig_filename=0x0, __zend_orig_lineno=0) at zend_alloc.c:170 #2 0x806d714 in _zval_ptr_dtor (zval_ptr=0x81f2130, __zend_filename=0x811c4a5 "zend_variables.c", __zend_lineno=179) at zend_execute_API.c:217 #3 0x80724ab in _zval_ptr_dtor_wrapper (zval_ptr=0x81f2130) at zend_variables.c:179 #4 0x8075bfa in zend_hash_destroy (ht=0x81f20a4) at zend_hash.c:528 #5 0x806e9cd in destroy_op_array (op_array=0x81f2180) at zend_opcode.c:153 #6 0x806e8e7 in destroy_zend_function (function=0x81f2180) at zend_opcode.c:110 #7 0x8075dec in zend_hash_apply_deleter (ht=0x81921c0, p=0x81f8080) at zend_hash.c:583 #8 0x8075f99 in zend_hash_apply (ht=0x81921c0, apply_func=0x8068abc <is_not_internal_function>) at zend_hash.c:656 #9 0x8068d59 in shutdown_compiler () at zend_compile.c:127 #10 0x8072dc7 in zend_deactivate () at zend.c:464 #11 0x80613ac in php_request_shutdown (dummy=0x0) at main.c:663 #12 0x80d9bd5 in run_cleanups (c=0x81d95fc) at alloc.c:1706 #13 0x80d828b in ap_clear_pool (a=0x81d800c) at alloc.c:531 #14 0x80d830b in ap_destroy_pool (a=0x81d800c) at alloc.c:561 #15 0x80d8277 in ap_clear_pool (a=0x818200c) at alloc.c:528 #16 0x80e7e55 in child_main (child_num_arg=0) at http_main.c:3900 #17 0x80e8495 in make_child (s=0x8170034, slot=0, now=954771838) at http_main.c:4281 #18 0x80e860e in startup_children (number_to_start=5) at http_main.c:4363 #19 0x80e8c18 in standalone_main (argc=2, argv=0xbfbffae0) at http_main.c:4651 #20 0x80e9430 in main (argc=2, argv=0xbfbffae0) at http_main.c:4978 (gdb) list 478 zend_debug_alloc_output("%s(%d) : Actual locatio n (location was relayed)\n" ZEND_FILE_LINE_ORIG_RELAY_CC); 479 } 480 zend_debug_alloc_output("%10s\t","Beginning: "); 481 } 482 483 switch (p->magic) { 484 case MEM_BLOCK_START_MAGIC: 485 if (!silent) { 486 zend_debug_alloc_output("OK (allocated o n %s:%d, %d bytes)\n", p->filename, p->lineno, p->size); 487 } (gdb) print p $1 = (zend_mem_header *) 0x83e58931 (gdb) print *p Error accessing memory address 0x83e58931: Bad address.