Re: Crash in Apache2Filter

Sebastian Bergmann wrote:

Win32, Apache 2.0.36-dev, PHP 4.2.0-dev (both current CVS) ap_save_brigade(ap_filter_t * 0x00800e40, apr_bucket_brigade * * 0x00800a8c, apr_bucket_brigade * * 0x10e6fe6c, apr_pool_t * 0x007ff898) line 562 + 49 bytes php_output_filter(ap_filter_t * 0x00800e40, apr_bucket_brigade * 0x00800f60) line 354 + 32 bytes ap_pass_brigade(ap_filter_t * 0x00800e40, apr_bucket_brigade * 0x00800f60) line 534 + 16 bytes default_handler(request_rec * 0x007ff8d0) line 3248 ap_run_handler(request_rec * 0x007ff8d0) line 194 + 78 bytes ap_invoke_handler(request_rec * 0x007ff8d0) line 373 + 9 bytes ap_process_request(request_rec * 0x007ff8d0) line 261 + 9 bytes ap_process_http_connection(conn_rec * 0x007eb760) line 291 + 9 bytes ap_run_process_connection(conn_rec * 0x007eb760) line 85 + 78 bytes ap_process_connection(conn_rec * 0x007eb760, void * 0x007eb6a0) line 209 worker_main(long 249) line 1110 _threadstartex(void * 0x0087d638) line 212 + 13 bytes

This looks similar to what I'm seeing. I posted the following to dev@httpd: -------------------------------------------------------------------------- I'm trying to get a PHP4 OS/2 port working with Apache 2.0.35 but have hit a problem that may need a filtering guru to fix. I'm working with the 4.2.0 branch as that's what's slated to be released before long. The problem I've found is that the SG(server_context), which holds a pointer to data allocated from the request pool, lives into the next request which causes a crash in ap_save_brigade() called from php_output_filter(). Tracing through with a debugger, the sequence of events is: - SG(server_context) starts life as NULL - php_output_filter() sets it, uses it, executes script, NULLs it again - php_input_filter() sets it, uses it - request ends - next request, php_output_filter() sees it's non-null & tries to use it, SEGFAULT! So it looks like SG(server_context) needs to be NULLed at the end of the request but I can't see an appropriate place to do that. It also seems fishy to me (and is probably the real problem) that php_input_filter() is run AFTER php_execute_script() has finished. Isn't that's too late?