PHP 4.0 Bug #4231: Apache gets a SEGV; possibly related to arrays w/ object references

From: ewout@denouden.com Operating system: RedHat Linux 5.1 PHP version: 4.0 Release Candidate 1 PHP Bug Type: Reproduceable crash Bug description: Apache gets a SEGV; possibly related to arrays w/ object references I don't have a 'short' script reproducing the problem at hand. Building a small CMS here and the source is a bit too big to include in this box. [Can send extract on request] What might help is the following. Somewhere in the main script (www.mysite.tld/index.php) it says: $session = new Session (); $user = new User ($session->user); This works; no crashes, and it creates a session and user object using data from a MySQL server. The User subsystem has a cache (a tree build with arrays pointing to the objects). For testing purposes I added the following, which should work: (user IDs are in the database etc etc) $a = new User (0); $b = new User (1); $c = new User (2); $a still works, but after that ($b, $c) PHP gives up and crashes. See attached GDB dump. If you're interested in the offending script, send me a mail. Note: I was working on a somewhat older Apache 1.3.9/PHP4.0b3 system and thought that might be the problem. Upgrading to 1.3.12/4.0RC1 gives exactly the same problem. The Apache is a 1.3.12, clean except for an added mod_roaming. PHP is installed as a DSO module and --with-mysql. The GDB backtrace: (gdb) run -X Starting program: /usr/local/packages/apache/./bin/httpd -X Program received signal SIGSEGV, Segmentation fault. zend_hash_clean (ht=0x810e714) at zend_hash.c:552 552 p = p->pListNext; (gdb) bt #0 zend_hash_clean (ht=0x810e714) at zend_hash.c:552 #1 0x401890dc in execute (op_array=0x810b788) at ./zend_execute.c:1640 #2 0x40188f52 in execute (op_array=0x810b520) at ./zend_execute.c:1624 #3 0x40188f52 in execute (op_array=0x810b788) at ./zend_execute.c:1624 #4 0x40188f52 in execute (op_array=0x810b520) at ./zend_execute.c:1624 #5 0x40188f52 in execute (op_array=0x8106964) at ./zend_execute.c:1624 #6 0x401733d7 in php_execute_script (primary_file=0xbffff868) at main.c:1146 #7 0x4019f890 in apache_php_module_main (r=0x80fe84c, fd=19, display_source_mode=0) at sapi_apache.c:88 #8 0x401a0154 in send_php (r=0x80fe84c, display_source_mode=0, filename=0x80fed94 "/www/HNO/index.php") at mod_php4.c:491 #9 0x401a0190 in send_parsed_php (r=0x80fe84c) at mod_php4.c:503 #10 0x806bec3 in ap_invoke_handler () #11 0x807f3f9 in process_request_internal () #12 0x807f818 in ap_internal_redirect () #13 0x8060b2d in handle_dir () #14 0x806bec3 in ap_invoke_handler () #15 0x807f3f9 in process_request_internal () #16 0x807f45c in ap_process_request () #17 0x8076cfe in child_main () #18 0x8076e8c in make_child () #19 0x8076fe9 in startup_children () #20 0x8077616 in standalone_main () #21 0x8077da3 in main () #22 0x4007bcb3 in __libc_start_main (main=0x8077a5c <main>, argc=2, argv=0xbffffab4, init=0x804ec60 <_init>, fini=0x80abd7c <_fini>, rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffffaac) at ../sysdeps/generic/libc-start.c:78 (gdb) Apache log: [Tue Apr 25 03:42:28 2000] Script: '/www/HNO/index.php' --------------------------------------- zend_execute_API.c(217) : Block 0xBFFFF5C4 status: Beginning: Overrun (magic=0x40015000, expected=0x7312F8DC) End: Unknown ---------------------------------------