php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #47870 array() returns NULL (works in PHP_5_2!)
Submitted: 2009-04-01 23:20 UTC Modified: 2009-04-27 11:46 UTC
From: mbeccati@php.net Assigned:
Status: Closed Package: Arrays related
PHP Version: 5.3CVS-2009-04-01 (CVS) OS: FreeBSD 6.2
Private report: No CVE-ID: None
 [2009-04-01 23:20 UTC] mbeccati@php.net
Description:
------------
Again, another bug happening in a unit test of OpenX. The problem always happens in the same test at the same point. What happens is that a simple array() call is returning NULL on my FreeBSD system. The same test generates a segmentation fault when run on our Linux based continuous integration system.

Unfortunately I can't create a self-contained test case, but I can provide access to the system or more data.

I will also attach a backtrace of the core dump (which might even not be happening at the same place as the FreeBSD failure).

Reproduce code:
---------------
$ids = array();
echo 'On FreeBSD: ';
var_dump($ids);

Expected result:
----------------
On FreeBSD: Array ()

Actual result:
--------------
On FreeBSD: NULL

Backtrace (Linux):

Program terminated with signal 11, Segmentation fault.
(gdb) bt full
#0  ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (execute_data=0x2aaaaecf02d8) at /usr/local/src/php-5.3.0RC1/Zend/zend_execute.c:664
        opline = (zend_op *) 0x12eb418
        free_op2 = {var = 0x273c0d0}
        value = (zval *) 0x1
        variable_ptr_ptr = (zval **) 0x2a0e848
#1  0x00000000007242fb in execute (op_array=0x10fdf40) at /usr/local/src/php-5.3.0RC1/Zend/zend_vm_execute.h:104
        ret = <value optimized out>
        execute_data = (zend_execute_data *) 0x2aaaaecf02d8
        nested = 1 '\001'
        original_in_execution = 0 '\0'
#2  0x0000000000701306 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php-5.3.0RC1/Zend/zend.c:1188
        files = {{gp_offset = 40, fp_offset = 73, overflow_arg_area = 0x7fffbdf97f10, reg_save_area = 0x7fffbdf97e20}}
        i = 1
        file_handle = (zend_file_handle *) 0x7fffbdf9a3e0
        orig_op_array = (zend_op_array *) 0x0
        orig_retval_ptr_ptr = (zval **) 0x0
#3  0x00000000006ae155 in php_execute_script (primary_file=0x7fffbdf9a3e0) at /usr/local/src/php-5.3.0RC1/main/main.c:2157
        __orig_bailout = (jmp_buf *) 0x7fffbdf9a1c0
        __bailout = {{__jmpbuf = {15364672, 903771196811129754, 1, 0, 0, 0, 903771196811177402, 903720367174677233}, __mask_was_saved = 0, __saved_mask = {__val = {48, 7, 15372768, 9416, 216135044429,
        17634384, 229440404087961, 48, 7403025, 15235744, 0, 206158430215, 140736380641392, 17634352, 17634352, 140736380641392}}}}
        prepend_file_p = (zend_file_handle *) 0x0
        append_file_p = (zend_file_handle *) 0x8
        prepend_file = {type = ZEND_HANDLE_FILENAME, filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0,
        old_handle = 0x0, old_closer = 0}, reader = 0, fsizer = 0, closer = 0}}, free_filename = 0 '\0'}
        append_file = {type = ZEND_HANDLE_FILENAME, filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0,
        old_handle = 0x0, old_closer = 0}, reader = 0, fsizer = 0, closer = 0}}, free_filename = 0 '\0'}
        old_cwd = 0x7fffbdf97f20 ""
        retval = 0
#4  0x000000000078bcee in main (argc=10, argv=0x7fffbdf9a658) at /usr/local/src/php-5.3.0RC1/sapi/cli/php_cli.c:1159
        __bailout = {{__jmpbuf = {216132590528, 903720367176127146, 0, 140736380642896, 110, 0, 903771196811129834, 903720367173477278}, __mask_was_saved = 0, __saved_mask = {__val = {140736380642608,
        140736380642416, 57, 112, 15369344, 15369328, 216135048496, 216138037600, 81, 140736380641952, 216135037715, 47, 96, 50, 216130423719, 15369344}}}}
        exit_status = 0
        c = <value optimized out>
        file_handle = {type = ZEND_HANDLE_MAPPED, filename = 0x7fffbdf9a935 "run.php", opened_path = 0x0, handle = {fd = 17477016, fp = 0x10aad98, stream = {handle = 0x10aad98, isatty = 0, mmap = {
        len = 5351, pos = 0, map = 0x2aaaaed69000, buf = 0x2aaaaed69000 "", old_handle = 0x10d10b0, old_closer = 0x715dd0 <zend_stream_stdio_closer>}, reader = 0x716390 <zend_stream_stdio_reader>,
      fsizer = 0x7162d0 <zend_stream_stdio_fsizer>, closer = 0x716320 <zend_stream_mmap_closer>}}, free_filename = 0 '\0'}
        behavior = 1
        reflection_what = 0x0
        orig_optind = 1
        orig_optarg = 0x0
        arg_free = 0x7fffbdf9a935 "run.php"
        arg_excp = <value optimized out>
        script_file = 0x7fffbdf9a935 "run.php"
        interactive = 0
        module_started = 1
        request_started = 1
        lineno = 1
        exec_direct = 0x0
        exec_run = 0x0
        exec_begin = 0x0
        exec_end = 0x0
        param_error = <value optimized out>
        hide_argv = 0
        ini_entries_len = <value optimized out>


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-04-02 00:36 UTC] mbeccati@php.net
matteo@phenom-ubuntu:~/OX-trunk/tests$ valgrind --tool=memcheck --num-callers=30 --log-file=php.log /usr/local/bin/php run.php --type=unit --level=file --layer=dal --folder=lib/OA/Dal/Maintenance --file=Priority_getZoneImpressionForecasts.dal.test.php --format=text --host=test Priority_getZoneImpressionForecasts.dal.test.php
Segmentation fault
matteo@phenom-ubuntu:~/OX-trunk/tests$ cat php.log
==11808== Memcheck, a memory error detector.
==11808== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==11808== Using LibVEX rev 1854, a library for dynamic binary translation.
==11808== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==11808== Using valgrind-3.3.1-Debian, a dynamic binary instrumentation framework.
==11808== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==11808== For more details, rerun with: -v
==11808== 
==11808== My PID = 11808, parent PID = 10101.  Prog and args are:
==11808==    /usr/local/bin/php
==11808==    run.php
==11808==    --type=unit
==11808==    --level=file
==11808==    --layer=dal
==11808==    --folder=lib/OA/Dal/Maintenance
==11808==    --file=Priority_getZoneImpressionForecasts.dal.test.php
==11808==    --format=text
==11808==    --host=test
==11808==    Priority_getZoneImpressionForecasts.dal.test.php
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF79D: _zval_ptr_dtor (zend_execute_API.c:430)
==11808==    by 0x824537: zend_hash_clean (zend_hash.c:552)
==11808==    by 0x849231: zend_leave_helper_SPEC (zend_vm_execute.h:208)
==11808==    by 0x8DC019: ZEND_RETURN_SPEC_CV_HANDLER (zend_vm_execute.h:22098)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF861: _zval_ptr_dtor (zend_execute_API.c:441)
==11808==    by 0x824537: zend_hash_clean (zend_hash.c:552)
==11808==    by 0x849231: zend_leave_helper_SPEC (zend_vm_execute.h:208)
==11808==    by 0x8DC019: ZEND_RETURN_SPEC_CV_HANDLER (zend_vm_execute.h:22098)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881939: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881991: zend_assign_to_variable (zend_execute.c:669)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881A77: zend_assign_to_variable (zend_execute.c:684)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881939: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8EF8A8: ZEND_ASSIGN_SPEC_CV_TMP_HANDLER (zend_vm_execute.h:25711)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881991: zend_assign_to_variable (zend_execute.c:669)
==11808==    by 0x8EF8A8: ZEND_ASSIGN_SPEC_CV_TMP_HANDLER (zend_vm_execute.h:25711)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881A77: zend_assign_to_variable (zend_execute.c:684)
==11808==    by 0x8EF8A8: ZEND_ASSIGN_SPEC_CV_TMP_HANDLER (zend_vm_execute.h:25711)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881939: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8E6422: ZEND_ASSIGN_SPEC_CV_CONST_HANDLER (zend_vm_execute.h:24065)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881991: zend_assign_to_variable (zend_execute.c:669)
==11808==    by 0x8E6422: ZEND_ASSIGN_SPEC_CV_CONST_HANDLER (zend_vm_execute.h:24065)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881A77: zend_assign_to_variable (zend_execute.c:684)
==11808==    by 0x8E6422: ZEND_ASSIGN_SPEC_CV_CONST_HANDLER (zend_vm_execute.h:24065)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF79D: _zval_ptr_dtor (zend_execute_API.c:430)
==11808==    by 0x845F0A: zend_assign_to_variable_reference (zend_execute.c:410)
==11808==    by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27405)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF861: _zval_ptr_dtor (zend_execute_API.c:441)
==11808==    by 0x845F0A: zend_assign_to_variable_reference (zend_execute.c:410)
==11808==    by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27405)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF893: _zval_ptr_dtor (zend_gc.h:182)
==11808==    by 0x845F0A: zend_assign_to_variable_reference (zend_execute.c:410)
==11808==    by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27405)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF89F: _zval_ptr_dtor (zend_gc.h:182)
==11808==    by 0x845F0A: zend_assign_to_variable_reference (zend_execute.c:410)
==11808==    by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27405)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x8818D4: zend_assign_to_variable (zend_execute.c:657)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Use of uninitialised value of size 8
==11808==    at 0x881933: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Process terminating with default action of signal 11 (SIGSEGV)
==11808==  Bad permissions for mapped region at address 0x8000015
==11808==    at 0x881933: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== ERROR SUMMARY: 42 errors from 17 contexts (suppressed: 18 from 2)
==11808== malloc/free: in use at exit: 29,165,534 bytes in 170,630 blocks.
==11808== malloc/free: 1,826,083 allocs, 1,655,453 frees, 157,087,187 bytes allocated.
==11808== For counts of detected errors, rerun with: -v
==11808== searching for pointers to 170,630 not-freed blocks.
==11808== checked 22,615,176 bytes.
==11808== 
==11808== LEAK SUMMARY:
==11808==    definitely lost: 388 bytes in 14 blocks.
==11808==      possibly lost: 0 bytes in 0 blocks.
==11808==    still reachable: 29,165,146 bytes in 170,616 blocks.
==11808==         suppressed: 0 bytes in 0 blocks.
==11808== Rerun with --leak-check=full to see details of leaked memory.

 [2009-04-02 09:11 UTC] mbeccati@php.net
I've tried to reduce the affected test to a smaller test case with no luck. As soon as I remove something from it. It suddenly starts to pass with no segfault.
 [2009-04-06 12:59 UTC] jani@php.net
Can you reproduce this with PHP_5_2 branch?
 [2009-04-06 13:05 UTC] mbeccati@php.net
Nope. Latest 5.1 and 5.2 work perfectly fine.
 [2009-04-26 15:43 UTC] jani@php.net
Try latest CVS just in case that GCC optimizer bugfix was the cause for 
this bug as well.
 [2009-04-27 11:46 UTC] mbeccati@php.net
Retested with latest CVS. Looks like the GCC optimizer bugfix also fixed this issue. Well done!
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Apr 24 16:01:31 2024 UTC