|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2011-12-22 22:33 UTC] arekm at maven dot pl
Description:
------------
[arekm@ixion-pld php-5.4.0RC3]$ export LC_ALL=C
[arekm@ixion-pld php-5.4.0RC3]$ ./sapi/cli/php -n ~/a.php
If you see this, try to increase OBJECT_COUNT to 100,000Segmentation fault
[arekm@ixion-pld php-5.4.0RC3]$ ./sapi/cli/php -n --version
PHP 5.4.0RC3 (cli) (built: Dec 22 2011 23:19:37)
Copyright (c) 1997-2011 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2011 Zend Technologies
Test script:
---------------
<?
define('OBJECT_COUNT', 130000);
class Object {
private static $world = array();
private static $maxGuid = 0;
protected $_guid = null;
public function __construct() {
self::$world[$this->_guid = self::$maxGuid++] = $this;
}
public function __destruct() {
unset(self::$world[$this->_guid]);
}
}
for ($i = 0; $i < OBJECT_COUNT; ++$i) {
new Object();
}
// You probably won't see this because of the "zend_mm_heap corrupted"
echo 'If you see this, try to increase OBJECT_COUNT to 100,000';
?>
Expected result:
----------------
cli not segfaulting
Actual result:
--------------
Starting program: /home/users/arekm/rpm/BUILD/php-5.4.0RC3/sapi/cli/.libs/php -n
/home/users/arekm/a.php
[Thread debugging using libthread_db enabled]
If you see this, try to increase OBJECT_COUNT to 100,000
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7a462b9 in gc_zval_possible_root (zv=0x7ffff5677420) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_gc.c:143
143 GC_ZOBJ_CHECK_POSSIBLE_ROOT(zv);
(gdb) bt
#0 0x00007ffff7a462b9 in gc_zval_possible_root (zv=0x7ffff5677420) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_gc.c:143
#1 0x00007ffff7a48ba2 in zend_object_std_dtor (object=0x7ffff56773d0) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_objects.c:54
#2 0x00007ffff7a48bd9 in zend_objects_free_object_storage
(object=0x7ffff56773d0) at /home/users/arekm/rpm/BUILD/php-
5.4.0RC3/Zend/zend_objects.c:137
#3 0x00007ffff7a4e56f in zend_objects_store_free_object_storage
(objects=0x7ffff7dda700)
at /home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_objects_API.c:92
#4 0x00007ffff7a18c83 in shutdown_executor () at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_execute_API.c:297
#5 0x00007ffff7a27555 in zend_deactivate () at /home/users/arekm/rpm/BUILD/php-
5.4.0RC3/Zend/zend.c:934
#6 0x00007ffff79c820f in php_request_shutdown (dummy=<optimized out>) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/main/main.c:1781
#7 0x0000000000405538 in do_cli (argc=3, argv=0x7fffffffea38) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/sapi/cli/php_cli.c:1169
#8 0x0000000000404d4c in main (argc=3, argv=0x7fffffffea38) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/sapi/cli/php_cli.c:1356
(gdb) frame 0
#0 0x00007ffff7a462b9 in gc_zval_possible_root (zv=0x7ffff5677420) at
/home/users/arekm/rpm/BUILD/php-5.4.0RC3/Zend/zend_gc.c:143
143 GC_ZOBJ_CHECK_POSSIBLE_ROOT(zv);
(gdb) print zv
$1 = (zval *) 0x7ffff5677420
(gdb) print *zv
$2 = {
value = {
lval = 140737303870936,
dval = 6.9533466930949762e-310,
str = {
val = 0x7ffff500fdd8 "\270",
len = -184485184
},
ht = 0x7ffff500fdd8,
obj = {
handle = 4110482904,
handlers = 0x7ffff500fac0
}
},
refcount__gc = 4294967295,
type = 5 '\005',
is_ref__gc = 0 '\000'
}
(gdb)
Patchesbug60598 (last revision 2013-08-29 11:09 UTC by laruence@php.net)Pull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Fri Oct 24 04:00:01 2025 UTC |
Same on git master: [object_properties_init] name=Object addr=2e3b42b0 pt_addr=2e3b6270 pt[0]_addr=2e3b4dc8 pt[0].handle=#0 [zend_std_write_property] name=_guid (=pt[0]) old_addr=2e3b4dc8 new_addr=2e3b42f8 new.handle=#0 [object_properties_init] name=Object addr=2e3b6688 pt_addr=2e3b6a60 pt[0]_addr=2e3b4dc8 pt[0].handle=#0 [zend_std_write_property] name=_guid (=pt[0]) old_addr=2e3b4dc8 new_addr=2e3b66d0 new.handle=#1 [zval_collect_white] adding zval to zval_to_free-list zval: addr=2e3b42f8 refcnt=2 handle=#0 [gc_collect_cycles] freeing zval zval: addr=2e3b42f8 refcnt=2 handle=#0 ^^ - 1st zval free [zend_object_std_dtor] object=Object addr=2e3b42b0 pt_addr=2e3b6270 calling zval_ptr_dtor for pt[0]_addr=2e3b42f8 pt[0].refcnt=1515870810 ^^ - 2nd zval free pt[0].handle=#1515870810 [zend_object_std_dtor] object=Object addr=2e3b6688 pt_addr=2e3b6a60 calling zval_ptr_dtor for pt[0]_addr=2e3b66d0 pt[0].refcnt=1 pt[0].handle=#1 Patch for my debug output: https://gist.github.com/095e8dc10c3e18afb3e6 I recommend enabling ZEND_MM_HEAP_PROTECTION. This is why refcnt+handle is 0x5a5a5a5a on 2nd free.