SIGSEGV When Calling call_user_function()

I've run into a segmentation fault situation when calling call_user_function() in an extension I'm developing. I can reproduce the fault reliably when trying to pass 4 arguments to my user function. The strange (to me anyway) thing is that it doesn't crash when passing 3 or fewer arguments. Can anyone point out what might be causing this error? Here's my source code: void async_callback(getdns_context *context, getdns_callback_type_t callbackType, getdns_dict *response, void *userArg, getdns_transaction_t transID) { int phpResult = 0; zval *userArgs, **hashData; zval *clientArgs[4]; zval cbType, dictVal, funcName, retVal, transIDVal; char *phpCallback = NULL; HashTable *arrayHash; HashPosition hashPtr; userArgs = (zval *) userArg; arrayHash = Z_ARRVAL_P(userArgs); zend_hash_internal_pointer_reset_ex(arrayHash, &hashPtr); if (zend_hash_get_current_data_ex(arrayHash, (void**) &hashData, &hashPtr) == SUCCESS) { phpCallback = (char *) Z_STRVAL_PP(hashData); } else { php_error_docref(NULL TSRMLS_DC, E_ERROR, "Invalid callback parameters!"); return; } ZVAL_STRING(&funcName, phpCallback, 0); clientArgs[0] = &dictVal; ZVAL_LONG(clientArgs[0], (long) response); clientArgs[1] = &cbType; ZVAL_LONG(clientArgs[1], (long) callbackType); clientArgs[2] = userArgs; clientArgs[3] = &transIDVal; ZVAL_STRING(clientArgs[3], "0000000000000000", 1); phpResult = call_user_function(EG(function_table), NULL, &funcName, &retVal, 4, clientArgs TSRMLS_DC); if (phpResult == FAILURE) { php_error_docref(NULL TSRMLS_DC, E_ERROR, "Callback failed!"); } } Here's the stack trace produced when running my PHP client program that calls into this extension and passes the name of the user function: Program received signal SIGSEGV, Segmentation fault. 0x00000000006c8570 in gc_remove_from_buffer (root=0x7ffff5a364f4 <evmap_io_del+212>) at /projects/php/php-5.6.5/Zend/zend_gc.h:189 189 root->next->prev = root->prev; (gdb) bt #0 0x00000000006c8570 in gc_remove_from_buffer (root=0x7ffff5a364f4 <evmap_io_del+212>) at /projects/php/php-5.6.5/Zend/zend_gc.h:189 #1 gc_remove_zval_from_buffer (zv=zv@entry=0x7fffffffa350) at /projects/php/php-5.6.5/Zend/zend_gc.c:265 #2 0x000000000069a6d8 in i_zval_ptr_dtor (zval_ptr=0x7fffffffa350) at /projects/php/php-5.6.5/Zend/zend_execute.h:78 #3 zend_vm_stack_clear_multiple (nested=0) at /projects/php/php-5.6.5/Zend/zend_execute.h:308 #4 zend_call_function (fci=fci@entry=0x7fffffffa280, fci_cache=<optimized out>, fci_cache@entry=0x0) at /projects/php/php-5.6.5/Zend/zend_execute_API.c:886 #5 0x000000000069abae in call_user_function_ex (function_table=function_table@entry=0xdfd130, object_pp=<optimized out>, function_name=<optimized out>, retval_ptr_ptr=retval_ptr_ptr@entry=0x7fffffffa318, param_count=<optimized out>, params=params@entry=0x7ffff7fd40a0, no_separation=no_separation@entry=1, symbol_table=symbol_table@entry=0x0) at /projects/php/php-5.6.5/Zend/zend_execute_API.c:617 #6 0x000000000069ac02 in call_user_function (function_table=0xdfd130, object_pp=object_pp@entry=0x0, function_name=function_name@entry=0x7fffffffa390, retval_ptr=retval_ptr@entry=0x7fffffffa3b0, param_count=param_count@entry=4, params=params@entry=0x7fffffffa3f0) at /projects/php/php-5.6.5/Zend/zend_execute_API.c:590 #7 0x00007ffff60aab23 in async_callback (context=<optimized out>, callbackType=GETDNS_CALLBACK_COMPLETE, response=0xff6860, userArg=0x7ffff7fcf930, transID=<optimized out>) at /projects/getdns-php-bindings/phpgetdns.c:1191 #8 0x00007ffff57ed682 in ub_process () from /usr/lib/x86_64-linux-gnu/libunbound.so.2 #9 0x00007ffff5c780fa in priv_getdns_context_ub_read_cb (userarg=0xf476d0) at ./context.c:985 #10 0x00007ffff5a278b4 in event_base_loop () from /usr/lib/x86_64-linux-gnu/libevent_core-2.0.so.5 #11 0x00007ffff60adc03 in zif_php_getdns_context_run (ht=<optimized out>, return_value=0x7ffff7fd3d40, return_value_ptr=<optimized out>, this_ptr=<optimized out>, return_value_used=<optimized out>) at /projects/getdns-php-bindings/phpgetdns.c:3606 #12 0x000000000074d68e in zend_do_fcall_common_helper_SPEC (execute_data=<optimized out>) at /projects/php/php-5.6.5/Zend/zend_vm_execute.h:558 #13 0x00000000006e4108 in execute_ex (execute_data=0x7ffff7f9a590) at /projects/php/php-5.6.5/Zend/zend_vm_execute.h:363 #14 0x00000000006ab330 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /projects/php/php-5.6.5/Zend/zend.c:1341 #15 0x0000000000649255 in php_execute_script (primary_file=primary_file@entry=0x7fffffffcac0) at /projects/php/php-5.6.5/main/main.c:2584 #16 0x000000000074f2ef in do_cli (argc=2, argv=0xdfc540) at /projects/php/php-5.6.5/sapi/cli/php_cli.c:994 #17 0x0000000000426670 in main (argc=2, argv=0xdfc540) at /projects/php/php-5.6.5/sapi/cli/php_cli.c:1378 (gdb) up #1 gc_remove_zval_from_buffer (zv=zv@entry=0x7fffffffa350) at /projects/php/php-5.6.5/Zend/zend_gc.c:265 265 GC_REMOVE_FROM_BUFFER(root_buffer); (gdb) up #2 0x000000000069a6d8 in i_zval_ptr_dtor (zval_ptr=0x7fffffffa350) at /projects/php/php-5.6.5/Zend/zend_execute.h:78 78 GC_REMOVE_ZVAL_FROM_BUFFER(zval_ptr); (gdb) up #3 zend_vm_stack_clear_multiple (nested=0) at /projects/php/php-5.6.5/Zend/zend_execute.h:308 308 i_zval_ptr_dtor(q ZEND_FILE_LINE_CC TSRMLS_CC); (gdb) up #4 zend_call_function (fci=fci@entry=0x7fffffffa280, fci_cache=<optimized out>, fci_cache@entry=0x0) at /projects/php/php-5.6.5/Zend/zend_execute_API.c:886 886 zend_vm_stack_clear_multiple(0 TSRMLS_CC); (gdb) up #5 0x000000000069abae in call_user_function_ex (function_table=function_table@entry=0xdfd130, object_pp=<optimized out>, function_name=<optimized out>, retval_ptr_ptr=retval_ptr_ptr@entry=0x7fffffffa318, param_count=<optimized out>, params=params@entry=0x7ffff7fd40a0, no_separation=no_separation@entry=1, symbol_table=symbol_table@entry=0x0) at /projects/php/php-5.6.5/Zend/zend_execute_API.c:617 617 return zend_call_function(&fci, NULL TSRMLS_CC); (gdb) up #6 0x000000000069ac02 in call_user_function (function_table=0xdfd130, object_pp=object_pp@entry=0x0, function_name=function_name@entry=0x7fffffffa390, retval_ptr=retval_ptr@entry=0x7fffffffa3b0, param_count=param_count@entry=4, params=params@entry=0x7fffffffa3f0) at /projects/php/php-5.6.5/Zend/zend_execute_API.c:590 590 ex_retval = call_user_function_ex(function_table, object_pp, function_name, &local_retval_ptr, param_count, params_array, 1, NULL TSRMLS_CC); (gdb) up #7 0x00007ffff60aab23 in async_callback (context=<optimized out>, callbackType=GETDNS_CALLBACK_COMPLETE, response=0xff6860, userArg=0x7ffff7fcf930, transID=<optimized out>) at /projects/getdns-php-bindings/phpgetdns.c:1191 1191 phpResult = call_user_function(EG(function_table), NULL, (gdb) Any thoughts? From what I can see in gdb the variable with value 0x7fffffffa350 is the second element of the clientArgs array: (gdb) print clientArgs $1 = {0x7fffffffa370, 0x7fffffffa350, 0x7ffff7fcf930, 0x7fffffffa3d0} (gdb) Thank you, Scott