|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2012-01-20 20:20 UTC] php at wallbash dot com
Description:
------------
First off: Sorry not being able to provide a better reproduce. I tried to dig into symfony but failed as I'm not familiar with it. I was testing phpunit against frameworks when I found this.
Running the symfony 2 test suite with RC6 leads to a segfault that I had across two machines so I'll open this just in case it helps out and ask sf people to maybe provide a better reproduce.
PHP Configure: Configure Command => './configure' '--enable-mbstring' '--with-readline' '--enable-pcntl' '--with-zlib' '--prefix=/opt/php-5.4.0RC6/' '--enable-debug'
Test script:
---------------
git clone git://github.com/symfony/symfony.git
cd symfony
./vendors.php
/opt/php-5.4.0RC6/bin/php `which phpunit` --debug --filter FormLoginTest
Expected result:
----------------
No segfault
Actual result:
--------------
Configuration read from /home/edo/Desktop/PHP/phpunit-dev/phpunit-testing-with-frameworks/vendor/symfony/phpunit.xml.dist
Starting test 'Symfony\Bundle\SecurityBundle\Tests\Functional\FormLoginTest::testFormLogin with data set #0 ('config.yml')'.
Segmentation fault (core dumped)
(gdb) bt
#0 _zend_mm_free_int (heap=0x1a85310, p=0x7fff9c786460) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_alloc.c:2100
#1 0x00000000006be6cd in zend_call_function (fci=0x7fff9c786210, fci_cache=<value optimized out>) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_execute_API.c:1019
#2 0x00000000006e06ff in zend_call_method (object_pp=0x7fff9c786338, obj_ce=0x5f4a370, fn_proxy=0x5f4a4d8, function_name=0xaa65b0 "__tostring", function_name_len=3, retval_ptr_ptr=<value optimized out>, param_count=0, arg1=0x0,
arg2=0x0) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_interfaces.c:97
#3 0x00000000006ebb11 in zend_std_cast_object_tostring (readobj=0x7fff9c786460, writeobj=0x7fff9c786390, type=<value optimized out>) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_object_handlers.c:1494
#4 0x00000000006c2ad0 in _convert_to_string (op=0x1a85310) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_operators.c:588
#5 0x000000000071212a in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER (execute_data=0x7f33c5361908) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_vm_execute.h:27073
#6 0x0000000000730010 in execute (op_array=0x5f4c280) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_vm_execute.h:410
#7 0x00000000006be773 in zend_call_function (fci=0x7fff9c786660, fci_cache=<value optimized out>) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_execute_API.c:958
#8 0x00000000005c4020 in zim_reflection_method_invokeArgs (ht=<value optimized out>, return_value=0x58193d0, return_value_ptr=<value optimized out>, this_ptr=<value optimized out>, return_value_used=<value optimized out>)
at /home/edo/Desktop/PHP/php-5.4.0RC6/ext/reflection/php_reflection.c:2926
#9 0x0000000000742c5c in zend_do_fcall_common_helper_SPEC (execute_data=0x7f33c53604c0) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_vm_execute.h:642
#10 0x0000000000730010 in execute (op_array=0x5c12cd8) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend_vm_execute.h:410
#11 0x00000000006c8d5a in zend_execute_scripts (type=8, retval=<value optimized out>, file_count=3) at /home/edo/Desktop/PHP/php-5.4.0RC6/Zend/zend.c:1272
#12 0x000000000066de5d in php_execute_script (primary_file=<value optimized out>) at /home/edo/Desktop/PHP/php-5.4.0RC6/main/main.c:2476
#13 0x0000000000770757 in do_cli (argc=0, argv=<value optimized out>) at /home/edo/Desktop/PHP/php-5.4.0RC6/sapi/cli/php_cli.c:983
#14 0x0000000000770e64 in main (argc=<value optimized out>, argv=<value optimized out>) at /home/edo/Desktop/PHP/php-5.4.0RC6/sapi/cli/php_cli.c:1356
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Thu Nov 21 09:01:32 2024 UTC |
Can you try reproducing with the current svn code? I went through the reproduce steps and the unit tests ran to completion for me. However, under Valgrind I did get some complaints for one of the tests. Can you tell if your crash is on this same test? Starting test 'Symfony\Bundle\SecurityBundle\Tests\Functional\FormLoginTest::testFormLogin with data set #0 ('config.yml')'. ==24587== Conditional jump or move depends on uninitialised value(s) ==24587== at 0x9DE434: zend_call_function (zend_execute_API.c:925) ==24587== by 0xA128C3: zend_call_method (zend_interfaces.c:97) ==24587== by 0xA2BAE6: zend_std_cast_object_tostring (zend_object_handlers.c:1494) ==24587== by 0x9E582A: _convert_to_string (zend_operators.c:588) ==24587== by 0xB05BB6: ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER (zend_vm_execute.h:27073) ==24587== by 0xA342CC: execute (zend_vm_execute.h:410) ==24587== by 0x9DE67C: zend_call_function (zend_execute_API.c:958) ==24587== by 0x74F4C9: zim_reflection_method_invokeArgs (php_reflection.c:2926) ==24587== by 0xA35C22: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:642) ==24587== by 0xA36C1E: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:752) ==24587== by 0xA342CC: execute (zend_vm_execute.h:410) ==24587== by 0x9F2AEF: zend_execute_scripts (zend.c:1272) ==24587== ==24587== Conditional jump or move depends on uninitialised value(s) ==24587== at 0x9DBB70: _zval_ptr_dtor (zend_execute_API.c:433) ==24587== by 0x9DED15: zend_call_function (zend_execute_API.c:1019) ==24587== by 0xA128C3: zend_call_method (zend_interfaces.c:97) ==24587== by 0xA2BAE6: zend_std_cast_object_tostring (zend_object_handlers.c:1494) ==24587== by 0x9E582A: _convert_to_string (zend_operators.c:588) ==24587== by 0xB05BB6: ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER (zend_vm_execute.h:27073) ==24587== by 0xA342CC: execute (zend_vm_execute.h:410) ==24587== by 0x9DE67C: zend_call_function (zend_execute_API.c:958) ==24587== by 0x74F4C9: zim_reflection_method_invokeArgs (php_reflection.c:2926) ==24587== by 0xA35C22: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:642) ==24587== by 0xA36C1E: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:752) ==24587== by 0xA342CC: execute (zend_vm_execute.h:410) ==24587== ==24587== Conditional jump or move depends on uninitialised value(s) ==24587== at 0x9DBC28: _zval_ptr_dtor (zend_execute_API.c:444) ==24587== by 0x9DED15: zend_call_function (zend_execute_API.c:1019) ==24587== by 0xA128C3: zend_call_method (zend_interfaces.c:97) ==24587== by 0xA2BAE6: zend_std_cast_object_tostring (zend_object_handlers.c:1494) ==24587== by 0x9E582A: _convert_to_string (zend_operators.c:588) ==24587== by 0xB05BB6: ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER (zend_vm_execute.h:27073) ==24587== by 0xA342CC: execute (zend_vm_execute.h:410) ==24587== by 0x9DE67C: zend_call_function (zend_execute_API.c:958) ==24587== by 0x74F4C9: zim_reflection_method_invokeArgs (php_reflection.c:2926) ==24587== by 0xA35C22: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:642) ==24587== by 0xA36C1E: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:752) ==24587== by 0xA342CC: execute (zend_vm_execute.h:410)fixed in trunk, will commit to branch when I got the permission from stas, and a simple reproduce script: <?php class test { public function __toString() { return "aaa"; } } $a = new test; require_once $a;I will take time to create a reproducible test on Saturday or Sunday. This looks like a kind a memory related issue as I can run each test individually, but not all tests in a batch. Trying to know more precisely what makes the process fail in scripts, I also installed XDebug extension. Here, a segmentation fault occurs when XDebug tries to write its coverage file. I hope this is not some kind of heap overflow that may introduce some vulnerability (ie. arbitrary code execution). Follows a debugger dump when only one script is run with XDebug activated and coverage asked. An output file cover.txt is created but remains empty. The fault now seems to occur next to a call in XDebug Extension. -- DUMP #1 -- If I try to run all the tests with XDebug activated and coverage asked, a segmentation fault still occurs but the back trace is now different, the segmentation fault now seems to occur next to a call in pdo.so -- DUMP #2 -- If I now try to run another single test with XDebug activated and coverage asked, a segmentation fault occurs again but the back trace is also different, the segmentation fault seems to occur also next to a call in pdo.so -- DUMP #3 - - $ php --version PHP 5.3.13 (cli) (built: May 8 2012 15:39:23) Copyright (c) 1997-2012 The PHP Group Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies with Xdebug v2.2.0, Copyright (c) 2002-2012, by Derick Rethans DUMPS come in next comments in order not to get the "Please do not SPAM our bug system." error message.