Bug #13322 Updated: Still SIGSEGV with DOMXML / double free()

ID: 13322 User updated by: ih@fido.cz Reported By: ih@fido.cz Status: Open Bug Type: Reproducible crash Operating System: Debian Linux 2.2 PHP Version: 4.0CVS-2001-09-15 New Comment: Problem is on shutdown and destroy/freeing alocated memory. Breakpoint 2, main (argc=2, argv=0xbffffdb4) at cgi_main.c:775 775 php_request_shutdown((void *) 0); php_request_shutdown (dummy=0x0) at main.c:711 736 zend_deactivate(TSRMLS_C); zend_deactivate () at zend.c:587 595 shutdown_executor(TSRMLS_C); shutdown_executor () at zend_execute_API.c:162 190 zend_destroy_rsrc_list(&EG(regular_list) TSRMLS_CC); zend_destroy_rsrc_list (ht=0x81798a4) at zend_list.c:235 231 void zend_destroy_rsrc_list(HashTable *ht TSRMLS_DC) 232 { 233 Bucket *p, *q; 234 235 while (1) { 236 p = ht->pListTail; 237 if (!p) { 238 break; 239 } 240 q = p->pListLast; 241 if (q) { 242 q->pListNext = NULL; 243 } 244 ht->pListTail = q; 245 246 if (ht->pDestructor) { 247 zend_try { 248 ht->pDestructor(p->pData); 249 } zend_end_try(); 250 } 251 if (!p->pDataPtr && p->pData) { 252 pefree(p->pData, ht->persistent); 253 } 254 pefree(p, ht->persistent); 255 } 256 pefree(ht->arBuckets, ht->persistent); 257 } ht = (HashTable *) 0x81798a4 {nTableSize = 8, nTableMask = 7, nNumOfElements = 2, nNextFreeElement = 3, pInternalPointer = 0x81ad614, pListHead = 0x81ad614, pListTail = 0x81ac7ec, arBuckets = 0x81a8894, pDestructor = 0x810cc14 <list_entry_destructor>, persistent = 0 '\000', nApplyCount = 0 '\000', bApplyProtection = 1 '\001', inconsistent = 0} p = (Bucket *) 0x81ac7ec {h = 2, nKeyLength = 0, pData = 0x81ac844, pDataPtr = 0x0, pListNext = 0x0, pListLast = 0x81ad614, pNext = 0x0, pLast = 0x0, arKey = ""} q = (Bucket)*ht->pListTail->pListLast {h = 1, nKeyLength = 0, pData = 0x81b09ac, pDataPtr = 0x0, pListNext = 0x81ac7ec, pListLast = 0x0, pNext = 0x0, pLast = 0x0, arKey = ""} print (Bucket)*ht->pListTail->pListLast->pListNext {h = 2, nKeyLength = 0, pData = 0x81ac844, pDataPtr = 0x0, pListNext = 0x0, pListLast = 0x81ad614, pNext = 0x0, pLast = 0x0, arKey = ""} ht->pDestructor(0x81ac844); print (Bucket)*p {h = 2, nKeyLength = 0, pData = 0x81ac844, pDataPtr = 0x0, pListNext = 0x0, pListLast = 0x81ad614, pNext = 0x0, pLast = 0x0, arKey = ""} pefree(p->pData, ht->persistent); and second cycle p= (Bucket)*ht->pListTail $142 = {h = 1, nKeyLength = 0, pData = 0x81b09ac, pDataPtr = 0x0, pListNext = 0x0, pListLast = 0x0, pNext = 0x0, pLast = 0x0, arKey = ""} q = p->pListLast; ht->pListTail = q; (now 0x0) ht->pDestructor still point to zend list destructor php_free_xml_doc and pData = 0x81b09ac are the same. What's wrong? Previous Comments: ------------------------------------------------------------------------ [2001-09-15 19:15:34] ih@fido.cz Result with newest libxml2-2.4.5 is the same. Program received signal SIGSEGV, Segmentation fault 0x401fa860 in free () from /lib/libc.so.6 (gdb) bt #0 0x401fa860 in free () from /lib/libc.so.6 #1 0x400efe79 in xmlFreeNodeList (cur=0x81f98e0) at tree.c:2372 #2 0x400efe37 in xmlFreeNodeList (cur=0x81f9898) at tree.c:2364 #3 0x400ee2dc in xmlFreeDoc (cur=0x81f9800) at tree.c:525 #4 0x806f06d in php_free_xml_doc (rsrc=0x81dae74) at php_domxml.c:353 #5 0x811d86a in list_entry_destructor (ptr=0x81dae74) at zend_list.c:177 #6 0x811da55 in zend_destroy_rsrc_list (ht=0x8185d84) at zend_list.c:248 #7 0x810ca20 in shutdown_executor () at zend_execute_API.c:190 #8 0x81162e6 in zend_deactivate () at zend.c:595 #9 0x8062c2f in php_request_shutdown (dummy=0x0) at main.c:736 #10 0x8061543 in main (argc=2, argv=0xbffffb04) at cgi_main.c:775 ------------------------------------------------------------------------ [2001-09-15 18:17:22] ih@fido.cz Problem is still here in last CVS. Standalone php (cgi) same problem. Program received signal SIGSEGV, Segmentation fault. 0x401fab13 in free () from /lib/libc.so.6 (gdb) bt #0 0x401fab13 in free () from /lib/libc.so.6 #1 0x401fa873 in free () from /lib/libc.so.6 #2 0x400efca9 in xmlFreeNodeList () from /usr/lib/libxml2.so.2 #3 0x400efc67 in xmlFreeNodeList () from /usr/lib/libxml2.so.2 #4 0x400ee18c in xmlFreeDoc () from /usr/lib/libxml2.so.2 #5 0x806f05d in php_free_xml_doc (rsrc=0x81dae54) at php_domxml.c:353 #6 0x811d85a in list_entry_destructor (ptr=0x81dae54) at zend_list.c:177 #7 0x811da45 in zend_destroy_rsrc_list (ht=0x8185d64) at zend_list.c:248 #8 0x810ca10 in shutdown_executor () at zend_execute_API.c:190 #9 0x81162d6 in zend_deactivate () at zend.c:595 #10 0x8062c1f in php_request_shutdown (dummy=0x0) at main.c:736 #11 0x8061533 in main (argc=2, argv=0xbffffb04) at cgi_main.c:775 ------------------------------------------------------------------------ [2001-09-15 17:47:39] ih@fido.cz I've got php4-200109151335.tar.bz from http://snaps.php.net. I can try last one http://snaps.php.net:8000/php4-200109151635.tar.bz2. ------------------------------------------------------------------------ [2001-09-15 17:31:20] joey@php.net I cannot duplicate this with current CVS...are you absolutely SURE you are using most recent CVS? ------------------------------------------------------------------------ [2001-09-15 17:27:32] ih@fido.cz ii libc6 2.2.4-1 GNU C Library: Shared libraries ii libc6-dbg 2.2.4-1 GNU C Library: Libraries with ii libc6-dev 2.2.4-1 GNU C Library: Development Lib ii libxml1 1.8.15-1 GNOME XML library ii libxml2 2.4.3-1 GNOME XML library ii libxml2-dev 2.4.3-1 Development files for the GNOM ii libxmltok1 1.1-6 XML Parser Toolkit, runtime libraries APACHE: Server version: Apache/1.3.20 (Unix) Server built: Sep 15 2001 22:10:37 Server's Module Magic Number: 19990320:10 Server compiled with.... -D HAVE_MMAP -D HAVE_SHMGET -D USE_SHMGET_SCOREBOARD. -D USE_MMAP_FILES -D USE_SYSVSEM_SERIALIZED_ACCEPT -D SINGLE_LISTEN_UNSERIALIZED_ACCEPT -D HTTPD_ROOT="/rscr/apprscr2" -D SUEXEC_BIN="/rscr/apprscr2/bin/suexec" -D DEFAULT_PIDLOG="logs/httpd.pid" -D DEFAULT_SCOREBOARD="logs/httpd.scoreboard" -D DEFAULT_LOCKFILE="logs/httpd.lock" -D DEFAULT_XFERLOG="logs/access_log" -D DEFAULT_ERRORLOG="logs/error_log" -D TYPES_CONFIG_FILE="conf/mime.types" -D SERVER_CONFIG_FILE="conf/httpd.conf" -D ACCESS_CONFIG_FILE="conf/access.conf" -D RESOURCE_CONFIG_FILE="conf/srm.conf" Compiled-in modules: http_core.c mod_log_config.c mod_mime.c mod_status.c mod_dir.c mod_alias.c mod_rewrite.c mod_access.c mod_auth.c mod_setenvif.c mod_php4.c mod_gzip.c EXTRA_CFLAGS=-DDYNAMIC_MODULE_LIMIT=0 ./configure --prefix=/rscr/apprscr2 \ --with-layout=Apache \ --disable-module=env \ --disable-module=negotiation \ --disable-module=userdir \ --disable-module=asis \ --disable-module=include \ --disable-module=cgi \ --disable-module=actions \ --disable-module=imap \ --disable-module=autoindex \ --enable-module=dir \ --enable-module=rewrite \ --enable-module=alias \ --enable-module=setenvif \ --activate-module=src/modules/php4/libphp4.a \ --activate-module=src/modules/gzip/mod_gzip.o PHP4_SNAPSHOT: php4-200109151335 /configure --prefix=/rscr/apprscr2 \ --with-apache=../apache_1.3.20 \ --with-config-file-path=/rscr/apprscr2/conf \ --with-pear=/rscr/pear2 \ --with-regex=system \ --enable-debug \ --enable-track-vars \ --enable-trans-sid \ --disable-rpath \ --enable-session \ --enable-memory-limit \ --enable-sysvsem \ --enable-sysvshm \ --enable-shmop \ --enable-ctype \ --enable-sockets \ --enable-exif \ --with-jpeg-dir=shared,/usr \ --with-xpm-dir=shared,/usr/X11R6 \ --with-png-dir=shared,/usr \ --with-ttf=shared,/usr \ --with-t1lib=shared,/usr \ --with-mm \ --with-pcre-regex=/usr \ --without-pgsql \ --with-mysql=/usr \ --with-dom=/usr \ --with-zlib=/usr \ --with-iconv=/usr ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/?id=13322 Edit this bug report at http://bugs.php.net/?id=13322&edit=1