PHP 4.0 Bug #5470: Segfault in add_assoc_long

From: pour@mieterra.com Operating system: Linux PHP version: 4.0.1pl2 PHP Bug Type: Reproduceable crash Bug description: Segfault in add_assoc_long The crash occurs the second time I try to load a page after starting Apache 1.3.9 using the '-X' flag. I am willing to help debug this, but would like pointers to where to start, such as, where is the first place that some argument values look suspicious (the Zend code is too obfuscated with macros for me to make much sense of it w/out help). FWIW, the last version of PHP that works with the scripts is the March 24 snapshot. I had a whole different set of errors with the 4.0 release (having to do with the session stuff, which works fine now). The backtrace is: (gdb) where #0 0x820f2c4 in ?? () #1 0x4036758b in add_assoc_long (arg=0x84268b0, key=0x404f3318 "ìË\037", n=138567524) at zend_API.c:238 #2 0x4036c25e in object.8 () at zend_list.c:281 #3 0x403676c9 in add_assoc_bool (arg=0x8425f64, key=0x4049071c "zend_execute_API.c", b=272) at zend_API.c:258 #4 0x40360c96 in convert_scalar_to_array (op=0x40508cbc, type=1078526528) at zend_operators.c:424 #5 0x4034e81e in execute (op_array=0x838c264) at ./zend_execute.c:1197 #6 0x40356738 in execute (op_array=0x8424958) at ./zend_execute.c:169 #7 0x40356738 in execute (op_array=0x826b00c) at ./zend_execute.c:169 #8 0x4035cea7 in execute (op_array=0x834f438) at ./zend_execute.c:171 #9 0x40356738 in execute (op_array=0x83c8e08) at ./zend_execute.c:169 #10 0x40356738 in execute (op_array=0x826b1bc) at ./zend_execute.c:169 #11 0x4035cea7 in execute (op_array=0x826b374) at ./zend_execute.c:171 #12 0x40379ab2 in cfglex (cfglval=0xbffff908) at configuration-scanner.c:701 #13 0x403769d9 in php_error_cb (type=136671632, error_filename=0x13 <Address 0x13 out of bounds>, error_lineno=0, format=0x8257190 "ðR%\b¸\"%\bP]\t\b", orig_args=0x8257190) at main.c:338 #14 0x40377003 in php_module_startup (sf=0x8257190) at main.c:794 #15 0x4037734c in php_hash_environment () at main.c:957 #16 0x8053e3e in ap_invoke_handler () #17 0x8061ebb in ap_some_auth_required () #18 0x8062196 in ap_internal_redirect () #19 0x402bab65 in object.8 () #20 0x8053e3e in ap_invoke_handler () #21 0x8061ebb in ap_some_auth_required () #22 0x8061f18 in ap_process_request () #23 0x805bfe8 in ap_child_terminate () #24 0x805c147 in ap_child_terminate () #25 0x805c248 in ap_child_terminate () #26 0x805c6f8 in ap_child_terminate () #27 0x805ccfb in main () #28 0x400bbcb3 in __libc_start_main (main=0x805ca80 <main>, argc=2, argv=0xbffffb54, init=0x804f750 <_init>, fini=0x807cefc <_fini>, rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffffb4c) at ../sysdeps/generic/libc-start.c:78