php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #46656 Crash on array allocation/gc
Submitted: 2008-11-24 00:38 UTC Modified: 2008-12-20 19:31 UTC
From: ezyang@php.net Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 5.3CVS-2008-11-24 (snap) OS: win32 only - Windows Vista
Private report: No CVE-ID: None
 [2008-11-24 00:38 UTC] ezyang@php.net
Description:
------------
I am getting a crash on the following code:

class SimpleMock {
    // ...
    function SimpleMock() {
        $this->actions = new SimpleCallSchedule();
        $this->expectations = new SimpleCallSchedule();
        $this->call_counts = array();
        $this->expected_counts = array(); // here
        $this->max_counts = array();
        $this->expected_args = array();
        $this->expected_args_at = array();
        $this->getCurrentTestCase()->tell($this);
    }

Which is quite strange, because allocating an array shouldn't cause a crash! Here is the stack dump:

Thread 0 - System ID 4752
Entry point   php+2af2 
Create time   11/23/2008 7:29:25 PM 
Time spent in user mode   0 Days 0:0:3.73 
Time spent in kernel mode   0 Days 0:0:1.669 

Function     Arg 1     Arg 2     Arg 3   Source 
php5!zend_hash_apply+5     00000000     1008ff40     1008fe0d    
php5!gc_collect_cycles+2fc     04895474     00c0eb10     04ab4898    
php5!gc_collect_cycles+24d     04ab0ab8     04ab4898     105286f0    
php5!gc_collect_cycles+4b     04ab4898     1008cfaa     04ab4898    
php5!gc_zval_possible_root+ce     00000000     00000000     00000000    

PHP5!ZEND_HASH_APPLY+5WARNING - DebugDiag was not able to locate debug symbols for php5.dll, so the information below may be incomplete.

In php__PID__4896__Date__11_23_2008__Time_07_30_05PM__248__Second_Chance_Exception_C0000005.dmp the assembly instruction at php5!zend_hash_apply+5 in C:\Software\PHP\versions\5.3.0alpha3-dev\php5.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000026 on thread 0

I might be doing something wrong with regards to setting up the backtrace, since it's complaining about php5.dll even though I do have php5.dbg in my path. If you need a better backtrace, I can see what I can do.

If you're interested in attempting to reproduce this, the configuration is fairly standard. Use the instructions here <http://htmlpurifier.org/contribute.html> to setup the HTML Purifier development environment, and run the full test suite. (It doesn't work if you try to run just the test that PHP dies on, or try to run it by parts.)


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-11-25 08:37 UTC] jani@php.net
Can you reproduce this on a real OS, like some Linux for example?
 [2008-11-25 17:49 UTC] ezyang@php.net
Nope, I cannot reproduce on the latest 5.3 snap on Ubuntu Linux Intrepid.
 [2008-12-09 03:05 UTC] ezyang@php.net
Some new information about reproducing:

I have been able to reproduce on another machine, but not without a little bit of coaxing. In particular, these conditions must be met:

* PHPT tests must be set up. If they are skipped, the segfault does not occur.

* `php tests/index.php` --flush must be run with a PHP 5.2 version, prior to running `php tests/index.php` with a PHP 5.3 snap. The segfault does not occur on a cold run of the test suite.

It might be possible to reproduce on Linux; I'm currently reconstructing the experimental setup and will report back.
 [2008-12-09 03:30 UTC] ezyang@php.net
No luck. Poke me if any of you try to set things up on Windows.
 [2008-12-20 19:31 UTC] ezyang@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.

Can't repro with latest snaps, so I'm assuming this has been fixed.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed Jul 02 03:01:35 2025 UTC