Re: Segmention fault in HEAD (zend_hash_find)

Fixed. At 08:04 28/01/2003, Magnus Määttä wrote:

Hi! This code produces this segfault under HEAD. <?php declare(ticks = 1); function test() { } ?> bt ( for the whole bt: http://novell.stoldgods.nu/~magnus/bt ): Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 16384 (LWP 31900)] 0x0825350c in zend_hash_find (ht=0x83bbdb4, arKey=0x1 <Address 0x1 out of bounds>, nKeyLength=1, pData=0xbfffbcf4)

    at /opt/DEV/php/php5/Zend/zend_hash.c:873
873             HANDLE_NUMERIC(arKey, nKeyLength, zend_hash_index_find(ht, idx, pData));

(gdb) bt #0 0x0825350c in zend_hash_find (ht=0x83bbdb4, arKey=0x1 <Address 0x1 out of bounds>, nKeyLength=1, pData=0xbfffbcf4)

    at /opt/DEV/php/php5/Zend/zend_hash.c:873
#1  0x0823bf0b in do_bind_function (opline=0x418a3334, function_table=0x83bbdb4, class_table=0x83bbe64, compile_time=1)
    at /opt/DEV/php/php5/Zend/zend_compile.c:1703
#2  0x0823c331 in zend_do_early_binding () at /opt/DEV/php/php5/Zend/zend_compile.c:1792
#3  0x0822a55b in zendparse () at /opt/DEV/php/php5/Zend/zend_language_parser.y:155
#4  0x0822fd8d in compile_file (file_handle=0xbffff800, type=2) at /opt/DEV/php/php5/Zend/zend_language_scanner.l:297
#5  0x0824c75e in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /opt/DEV/php/php5/Zend/zend.c:992
#6  0x08213907 in php_execute_script (primary_file=0xbffff800) at /opt/DEV/php/php5/main/main.c:1691
#7  0x0826dbfd in main (argc=2, argv=0xbffff894) at /opt/DEV/php/php5/sapi/cli/php_cli.c:753

#8 0x40a7fa44 in __libc_start_main () from /lib/libc.so.6 (gdb) bt full #0 0x0825350c in zend_hash_find (ht=0x83bbdb4, arKey=0x1 <Address 0x1 out of bounds>, nKeyLength=1, pData=0xbfffbcf4)

    at /opt/DEV/php/php5/Zend/zend_hash.c:873
        tmp = 0x1 <Address 0x1 out of bounds>
        h = 1099587512
        nIndex = 1099587512
        p = (struct bucket *) 0x418d1ffc
#1  0x0823bf0b in do_bind_function (opline=0x418a3334, function_table=0x83bbdb4, class_table=0x83bbe64, compile_time=1)
    at /opt/DEV/php/php5/Zend/zend_compile.c:1703
        function = (union _zend_function *) 0x831b4a0
#2  0x0823c331 in zend_do_early_binding () at /opt/DEV/php/php5/Zend/zend_compile.c:1792
        opline = (struct _zend_op *) 0x418a3334
#3  0x0822a55b in zendparse () at /opt/DEV/php/php5/Zend/zend_language_parser.y:155
        zendchar = -2
        zendlval = {op_type = 1, throw_list = 0x0, u = {constant = {value = {lval = 138932069, dval = 4.3126331443290903e-314,
        str = {val = 0x847ef65 "\n\n}", len = 2}, ht = 0x847ef65, obj = {handle = 138932069, handlers = 0x2}}, refcount = 1,
      type = 1 '\001', is_ref = 0 '\0'}, var = 138932069, opline_num = 138932069, op_array = 0x847ef65,
    previously_active_class_entry = 0x847ef65, jmp_addr = 0x847ef65, EA = {var = 138932069, type = 2}}}
        zendnerrs = 0
        yystate = 71
        yyn = 6
        yyresult = 0
        yyerrstatus = 0
        yychar1 = 137
        yyssa = {0, 1, 2, 71, 139, 246, 373, 458, 515, 563, 617, 656, 686, 709, 58, 0, 19124, 16686, 15188, 16385, 16124, 16385,
  -12431, 2055, -11392, -16385, 28976, 16384, -12431, 2055, -29767, 1801, 24900, 2054, -11472, -16385, 16048, 16385, 58, 0, 19392,
  16686, 0, 0, 1, 0 <repeats 25 times>, 30240, 27745, -17521, 0, -17440, 2107, -11480, -16385, -10352, 2085, -17448, 2107, 12736,
  16778, 12644, 16569, -11384, -16385, 12736, 16778, -4548, 2, -11432, -16385, -11713, 2085, -18957, 0, -17440, 2107, -11432,
  -16385, -10352, 2085, -17448, 2107, 18480, 16778, -17184, 2107, 12620, 16778, 18480, 16778, -10292, 2, -11384, -16385, -11713,
  2085, -17448, 2107, 12796, 16778, 5684, 0, 5684, 0, 12808, 16778, 1421, 0, 12668, 16778, 12796, 16778, 0, 0, 5684, 0, -11336,
  -16385, 27860, 2083, 18476, 16778, -25604, 2105, 4, 0, -10352, 2085, -17448, 2107, 12796, 16778, 12844, 16778, 704, 0, 5632, 0,
  12808, 16778, -11288, -16385, 28348, 2083, 5632, 0, -20800, 2097, 48, 0, 0, 0, 0, 0, 12844, 16778, -17184, 2107, 12736, 16778, 0,

0, 60, 0, -11240, -16385, 16830, 2084, 0, 0, 5632, 0, 0, 0, -20800, 2097}

        yyss = (short int *) 0xbfffd270
        yyssp = (short int *) 0xbfffd276

around 60k more after that.. Regards Magnus Määttä -- PHP Development Mailing List <http://www.php.net/> To unsubscribe, visit: http://www.php.net/unsub.php