more crashes...zend_alloc problems?

What to do, what to do.... I'm stuck here with a current version of php that I can get to segfault almost every time. Unfortunately, it segfaults on several different very large 400+ line scripts. I can't find a simple one to make it crash. I've attached 3 traces and the common thing seems to be zend_alloc. My environment is: Solaris 2.7 APACHE = apache_1.3.12 PHP = php4-200008240945 MODSSL = mod_ssl-2.6.6-1.3.12 ./configure \ --with-apxs=/usr/local/apache/bin/apxs \ --with-config-file-path=/var/baygate/www/conf \ --enable-track-vars \ --enable-trans-sid \ --with-ndbm \ --with-informix=/opt/informix/prod \ --with-system-regex \ --enable-sysvsem \ --enable-sysvshm ) Program received signal SIGSEGV, Segmentation fault. 0xdfb00844 in t_splay () (gdb) where #0 0xdfb00844 in t_splay () #1 0xdfb006bd in t_delete () #2 0xdfb0044a in realfree () #3 0xdfb000bf in _malloc_unlocked () #4 0xdfafff19 in malloc () #5 0xdf9b966e in _emalloc (size=94) at zend_alloc.c:155 #6 0xdf9b9aa5 in _estrdup ( s=0x819e65c "SID=714d19fe4ef5cea28155a7d6c3880c0b&ridId=None&messageString= None&ridDetail=3&dateInterval=1") at zend_alloc.c:298 #7 0xdf9eb35c in php_treat_data (arg=1, str=0x0) at php_variables.c:263 #8 0xdf9e15ce in php_hash_environment () at main.c:991 #9 0xdf9e1be6 in php_execute_script (primary_file=0x8047890) at main.c:1111 #10 0xdf9de1a4 in apache_php_module_main (r=0x819cd44, display_source_mode=0) at sapi_apache.c:89 #11 0xdf9ded47 in send_php (r=0x819cd44, display_source_mode=0, filename=0x0) at mod_php4.c:503 #12 0xdf9ded86 in send_parsed_php (r=0x819cd44) at mod_php4.c:514 #13 0x80b7465 in ap_invoke_handler (r=0x819cd44) at http_config.c:508 #14 0x80cbe48 in process_request_internal (r=0x819cd44) at http_request.c:1215 #15 0x80cbeb2 in ap_process_request (r=0x819cd44) at http_request.c:1231 #16 0x80c2ed7 in child_main (child_num_arg=0) at http_main.c:4267 #17 0x80c3188 in make_child (s=0x8198d14, slot=0, now=967161668) at http_main.c:4435 #18 0x80c350c in perform_idle_server_maintenance () at http_main.c:4599 #19 0x80c3a41 in standalone_main (argc=1, argv=0x8047b9c) at http_main.c:4831 #20 0x80c4098 in main (argc=1, argv=0x8047b9c) at http_main.c:5092 Program received signal SIGSEGV, Segmentation fault. 0xdfb007b2 in t_splay () (gdb) where #0 0xdfb007b2 in t_splay () #1 0xdfb006bd in t_delete () #2 0xdfb00467 in realfree () #3 0xdfb0099a in cleanfree () #4 0xdfb00144 in realloc () #5 0xdf9b9971 in _erealloc (ptr=0x8279bec, size=2, allow_failure=0) at zend_alloc.c:260 #6 0xdf9ceb39 in add_string_to_string (result=0x804524c, op1=0x804524c, op2=0x829e830) at zend_operators.c:935 #7 0xdf9c4171 in execute () #8 0xdf9c4c0c in execute () #9 0xdf9c4c0c in execute () #10 0xdf9d1846 in zend_execute_scripts (type=8, file_count=3) at zend.c:712 #11 0xdf9e1e08 in php_execute_script (primary_file=0x8047890) at main.c:1179 #12 0xdf9de1a4 in apache_php_module_main (r=0x819cd44, display_source_mode=0) at sapi_apache.c:89 #13 0xdf9ded47 in send_php (r=0x819cd44, display_source_mode=0, filename=0x0) at mod_php4.c:503 #14 0xdf9ded86 in send_parsed_php (r=0x819cd44) at mod_php4.c:514 #15 0x80b7465 in ap_invoke_handler (r=0x819cd44) at http_config.c:508 #16 0x80cbe48 in process_request_internal (r=0x819cd44) at http_request.c:1215 #17 0x80cbeb2 in ap_process_request (r=0x819cd44) at http_request.c:1231 #18 0x80c2ed7 in child_main (child_num_arg=0) at http_main.c:4267 #19 0x80c3188 in make_child (s=0x8198d14, slot=0, now=967159570) at http_main.c:4435 #20 0x80c350c in perform_idle_server_maintenance () at http_main.c:4599 #21 0x80c3a41 in standalone_main (argc=1, argv=0x8047b9c) at http_main.c:4831 #22 0x80c4098 in main (argc=1, argv=0x8047b9c) at http_main.c:5092 Program received signal SIGSEGV, Segmentation fault. 0xdfb007b2 in t_splay () (gdb) where #0 0xdfb007b2 in t_splay () #1 0xdfb006bd in t_delete () #2 0xdfb00467 in realfree () #3 0xdfb0099a in cleanfree () #4 0xdfb00144 in realloc () #5 0xdf9b9971 in _erealloc (ptr=0x8279bec, size=2, allow_failure=0) at zend_alloc.c:260 #6 0xdf9ceb39 in add_string_to_string (result=0x804524c, op1=0x804524c, op2=0x829e830) at zend_operators.c:935 #7 0xdf9c4171 in execute () #8 0xdf9c4c0c in execute () #9 0xdf9c4c0c in execute () #10 0xdf9d1846 in zend_execute_scripts (type=8, file_count=3) at zend.c:712 #11 0xdf9e1e08 in php_execute_script (primary_file=0x8047890) at main.c:1179 #12 0xdf9de1a4 in apache_php_module_main (r=0x819cd44, display_source_mode=0) at sapi_apache.c:89 #13 0xdf9ded47 in send_php (r=0x819cd44, display_source_mode=0, filename=0x0) at mod_php4.c:503 #14 0xdf9ded86 in send_parsed_php (r=0x819cd44) at mod_php4.c:514 #15 0x80b7465 in ap_invoke_handler (r=0x819cd44) at http_config.c:508 #16 0x80cbe48 in process_request_internal (r=0x819cd44) at http_request.c:1215 #17 0x80cbeb2 in ap_process_request (r=0x819cd44) at http_request.c:1231 #18 0x80c2ed7 in child_main (child_num_arg=0) at http_main.c:4267 #19 0x80c3188 in make_child (s=0x8198d14, slot=0, now=967159360) at http_main.c:4435 #20 0x80c350c in perform_idle_server_maintenance () at http_main.c:4599 #21 0x80c3a41 in standalone_main (argc=1, argv=0x8047b9c) at http_main.c:4831 #22 0x80c4098 in main (argc=1, argv=0x8047b9c) at http_main.c:5092 Program received signal SIGSEGV, Segmentation fault. 0xdfb006c4 in t_delete () (gdb) where #0 0xdfb006c4 in t_delete () #1 0xdfb0044a in realfree () #2 0xdfb000bf in _malloc_unlocked () #3 0xdfb002d7 in realloc () #4 0xdf9b9971 in _erealloc (ptr=0x8235014, size=256, allow_failure=0) at zend_alloc.c:260 #5 0xdfa58dd6 in url_adapt ( src=0x8252694 "NAME=\"graphForm\"\n ACTION=\"../../common/desktop/predefine dform.php\" \n onSubmit=\"return graphForm.ridId.value=parent.ridFrame.document .ridForm.ridDetail[top.ridFrame.document.ridForm.ridDetail.selecte"..., srclen=11787, data=0x8047594 "SID=6932e8f35dd6333118866270cf1f0f99", newlen=0x8047590) at url_scanner.c:149 #6 0xdfa1aee6 in session_adapt_uris ( src=0x825007c "\n<HTML>\n<!-- $Id: graphform.php,v 1.3 2000/08/05 00:54:17 d evin Exp $ -->\n<HEAD>\n\n\n<script language=\"javascript\" src=\"/~kocks/lib/ja vascript/genbuttons.js\"></script>\n<script language=\"javascript\">\n\tbg"..., srclen=11787, new=0x80477cc, newlen=0x80477d0) at session.c:1275 #7 0xdfa5b6f8 in php_ub_body_write_no_header ( str=0x825007c "\n<HTML>\n<!-- $Id: graphform.php,v 1.3 2000/08/05 00:54:17 d evin Exp $ -->\n<HEAD>\n\n\n<script language=\"javascript\" src=\"/~kocks/lib/ja vascript/genbuttons.js\"></script>\n<script language=\"javascript\">\n\tbg"..., str_length=11787) at output.c:292 #8 0xdfa5ba0e in php_ob_send () at output.c:253 #9 0xdfa5b3f9 in php_end_ob_buffer (send_buffer=1) at output.c:116 #10 0xdfa5b441 in php_end_ob_buffers (send_buffer=1) at output.c:133 #11 0xdf9de1b6 in apache_php_module_main (r=0x819cd44, display_source_mode=0) at sapi_apache.c:93 #12 0xdf9ded47 in send_php (r=0x819cd44, display_source_mode=0, filename=0x0) at mod_php4.c:503 #13 0xdf9ded86 in send_parsed_php (r=0x819cd44) at mod_php4.c:514 #14 0x80b7465 in ap_invoke_handler (r=0x819cd44) at http_config.c:508 #15 0x80cbe48 in process_request_internal (r=0x819cd44) at http_request.c:1215 #16 0x80cbeb2 in ap_process_request (r=0x819cd44) at http_request.c:1231 #17 0x80c2ed7 in child_main (child_num_arg=1) at http_main.c:4267 #18 0x80c3188 in make_child (s=0x8198d14, slot=1, now=967157327) at http_main.c:4435 #19 0x80c350c in perform_idle_server_maintenance () at http_main.c:4599 #20 0x80c3a41 in standalone_main (argc=1, argv=0x8047b9c) at http_main.c:4831 #21 0x80c4098 in main (argc=1, argv=0x8047b9c) at http_main.c:5092