php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #61704 Crash apache, phpinfo() threading issue
Submitted: 2012-04-12 20:27 UTC Modified: 2012-05-09 12:34 UTC
Votes:2
Avg. Score:4.5 ± 0.5
Reproduced:2 of 2 (100.0%)
Same Version:2 (100.0%)
Same OS:2 (100.0%)
From: ricardo dot nuno dot rodrigues at hotmail dot com Assigned: mysql (profile)
Status: Closed Package: MySQLi related
PHP Version: 5.4.0 OS: Windows 7 64bit
Private report: No CVE-ID: None
 [2012-04-12 20:27 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
Description:
------------
Where:
Win 7 x64 + Apache 2.2.19 (ApacheLounge) + PHP 5.4.0 TS VC9

APC crashes PHP/Apache

Test script:
---------------
Script:
<?php
phpinfo();
?>

Running:
ab -n 100 -c 20 http://127.0.0.1/phpinfo.php


Expected result:
----------------
Normal output from Apache Bench

Actual result:
--------------
[12-Apr-2012 19:56:38 UTC] PHP Fatal error:  Nesting level too deep - recursive 
dependency? in C:\AppServ\www\jobbist\phpinfo.php on line 2

Trace:
httpd__PID__1604__Date__04_12_2012__Time_09_19_44PM__89__Second_Chance_Exception
_C0000005.dmp the assembly instruction at php5ts!deflateEnd+f in 
C:\AppServ\php5\php5ts.dll from The PHP Group has caused an access violation 
exception (0xC0000005) when trying to read from memory location 0x0000023a on 
thread 54

In 
httpd__PID__8160__Date__04_12_2012__Time_09_20_12PM__550__Second_Chance_Exceptio
n_C0000005.dmp the assembly instruction at php5ts!shmdt+27 in 
C:\AppServ\php5\php5ts.dll from The PHP Group has caused an access violation 
exception (0xC0000005) when trying to write to memory location 0x00000018 on 
thread 0


Thread 54 - System ID 8672
Entry point   msvcr90!_endthreadex+6f 
Create time   12-04-2012 21:19:24 
Time spent in user mode   0 Days 0:0:0.15 
Time spent in kernel mode   0 Days 0:0:0.0 






Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!deflateEnd+f     0000021e     5da4ceda     01a47c70    
php5ts!libiconv_open+3de8a     4baf7820     4baf7820     4b95f0f0    
php5ts!php_request_shutdown+23d     4539ff6c     00000000     56433230    
php5ts!php_request_shutdown+a6     4bdfb4a8     4bdfb488     00000004    
libapr_1!apr_pstrdup+37     0195f0b0     4baf7820     4539fe44    
php5apache2_2+1b88     00000000     00000000     00000000    




PHP5TS!DEFLATEEND+FWARNING - DebugDiag was not able to locate debug symbols for 
php5ts.dll, so the information below may be incomplete.



In 
httpd__PID__1604__Date__04_12_2012__Time_09_19_44PM__89__Second_Chance_Exception
_C0000005.dmp the assembly instruction at php5ts!deflateEnd+f in 
C:\AppServ\php5\php5ts.dll from The PHP Group has caused an access violation 
exception (0xC0000005) when trying to read from memory location 0x0000023a on 
thread 54


Thread 0 - System ID 5076
Entry point   httpd+21e1 
Create time   12-04-2012 21:19:20 
Time spent in user mode   0 Days 0:0:0.951 
Time spent in kernel mode   0 Days 0:0:0.358 

Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!shmdt+27     0189e840     744c3b4e     5da4ab11    
php5ts!zend_hash_graceful_reverse_destroy+d     5df3c640     01cdc1d0     
01d6b8d8    
php5ts!zend_destroy_modules+21     00c9fdd0     00000000     5d9810b5    
php5ts!virtual_unlink+162     00000000     00000000     00000000    


PHP5TS!SHMDT+27WARNING - DebugDiag was not able to locate debug symbols for 
php5ts.dll, so the information below may be incomplete.


In 
httpd__PID__8160__Date__04_12_2012__Time_09_20_12PM__550__Second_Chance_Exceptio
n_C0000005.dmp the assembly instruction at php5ts!shmdt+27 in 
C:\AppServ\php5\php5ts.dll from The PHP Group has caused an access violation 
exception (0xC0000005) when trying to write to memory location 0x00000018 on 
thread 0


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-04-12 20:28 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
APC 3.1.11-dev
 [2012-04-13 09:08 UTC] pajoye@php.net
I do not see how:

[12-Apr-2012 19:56:38 UTC] PHP Fatal error:  Nesting level too deep - recursive 
dependency? in C:\AppServ\www\jobbist\phpinfo.php on line 2

can be raised using phpinfo(); only.

What's the output of phpinfo()? Can you same a static version of it somwhere as 
well as your php.ini?
 [2012-04-13 09:08 UTC] pajoye@php.net
-Status: Open +Status: Feedback
 [2012-04-13 21:08 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
Update: also without APC gave the same output
 [2012-04-13 21:08 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
-Summary: APC crash apache +Summary: Crash apache -Status: Feedback +Status: Open -Package: APC +Package: Reproducible crash
 [2012-04-13 21:13 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
It's literally only phpinfo - nothing more.

Loaded modules:
array (size=51)
  0 => string 'Core' (length=4)
  1 => string 'bcmath' (length=6)
  2 => string 'calendar' (length=8)
  3 => string 'com_dotnet' (length=10)
  4 => string 'ctype' (length=5)
  5 => string 'date' (length=4)
  6 => string 'ereg' (length=4)
  7 => string 'filter' (length=6)
  8 => string 'ftp' (length=3)
  9 => string 'hash' (length=4)
  10 => string 'iconv' (length=5)
  11 => string 'json' (length=4)
  12 => string 'mcrypt' (length=6)
  13 => string 'SPL' (length=3)
  14 => string 'odbc' (length=4)
  15 => string 'pcre' (length=4)
  16 => string 'Reflection' (length=10)
  17 => string 'session' (length=7)
  18 => string 'standard' (length=8)
  19 => string 'mysqlnd' (length=7)
  20 => string 'tokenizer' (length=9)
  21 => string 'zip' (length=3)
  22 => string 'zlib' (length=4)
  23 => string 'libxml' (length=6)
  24 => string 'dom' (length=3)
  25 => string 'PDO' (length=3)
  26 => string 'bz2' (length=3)
  27 => string 'SimpleXML' (length=9)
  28 => string 'wddx' (length=4)
  29 => string 'xml' (length=3)
  30 => string 'xmlreader' (length=9)
  31 => string 'xmlwriter' (length=9)
  32 => string 'apache2handler' (length=14)
  33 => string 'memcache' (length=8)
  34 => string 'snappy' (length=6)
  35 => string 'bloomy' (length=6)
  36 => string 'mbstring' (length=8)
  37 => string 'openssl' (length=7)
  38 => string 'curl' (length=4)
  39 => string 'gd' (length=2)
  40 => string 'exif' (length=4)
  41 => string 'mysqli' (length=6)
  42 => string 'Phar' (length=4)
  43 => string 'shmop' (length=5)
  44 => string 'sockets' (length=7)
  45 => string 'sqlite3' (length=7)
  46 => string 'lzf' (length=3)
  47 => string 'mongo' (length=5)
  48 => string 'Stomp' (length=5)
  49 => string 'mhash' (length=5)
  50 => string 'xdebug' (length=6)
 [2012-04-14 04:20 UTC] laruence@php.net
what's your xdebug.max_nesting_level ?
 [2012-04-14 07:20 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
[xdebug]
xdebug.profiler_enable = 0
xdebug.profiler_output_dir = "C:/xxxx/data"
xdebug.profiler_enable_trigger = 0
xdebug.remote_enable=on
xdebug.remote_host="localhost"
xdebug.remote_port=9000
xdebug.remote_handler="dbgp"
xdebug.show_mem_delta = 1
xdebug.show_local_vars = 1
xdebug.collect_vars = 1
xdebug.var_display_max_data = 2048
xdebug.var_display_max_depth = 5
xdebug.var_display_max_children = 512
xdebug.max_nesting_level = 10000
 [2012-04-14 07:23 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
Update-- even without xdebug it gives the same error
 [2012-04-14 08:34 UTC] pajoye@php.net
Can you show me your phpinfo pls? The full one.
 [2012-04-14 08:34 UTC] pajoye@php.net
-Package: Reproducible crash +Package: APC
 [2012-04-20 21:16 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
Update -- PHP 5.4.1RC2 problem stills - phpinfo output sent by email to Pierre 
Joye
 [2012-04-23 09:37 UTC] ninzya at inbox dot lv
Hi, ricardo.

I guess that your PATH environment variable is pointing to other PHP version than 
the apache is loading. I had a similar problem and it turned out that because I 
had several PHP versions (several folders with different PHP versions) and PATH 
env variable was configured incorrectly, apache was loading a PHP version which 
then was trying to load DLLs that belong to an older version of PHP.
 [2012-04-23 19:54 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
Hi ninzya,
That's not the case - I have only one PHP version installed.
Thanks
Ricardo
 [2012-04-25 07:11 UTC] drueter at assyst dot com
FYI, I'm seeing this same execption when calling php_request_shutdown under certain conditions with PHP 5.3.10 on Windows XP 32 bit.  No Apache installed--calling from Delphi4PHP.

It seems that if I call php_request_shutdown immediately after calling php_execute_script the call works fine.  If I defer calling until just before  php_request_shutdown I get the exception consistently.

I am researching what happens during the period that the call to php_request_shutdown is deferred:  presumably something is being done that results in the exception when php_request_shutdown is subsequently called.
 [2012-04-25 19:54 UTC] drueter at assyst dot com
More information:  It seems that in my case the error ("PHP Fatal error:  Nesting level too deep - recursive dependency?") occurs when php_request_shutdown is called and ts_resource_ex returns an empty structure.

In other words, a session exists (and I can inspect it and see that it is healthy if I explicitly preserve a pointer to the session), but _sapi_globals_struct is empty (server_context is nil, etc.)

Any thoughts as to why ts_resource_ex would return an empty globals structure / why globals would not be available?  Presumably php_request_shutdown is failing for the same reason.

FYI, I am in a multi-threaded environment.  I see this declaration:

void* ts_resource_ex ( ts_rsrc_id id, THREAD_T* th_id )

But when called, nil is being passed to th_id.  Is this correct?  What should th_id be set to?  Under what conditions are the globals destroyed?
 [2012-04-25 20:01 UTC] drueter at assyst dot com
May be related to this discussion:  http://www.mombu.com/php/php/t-question-on-thread-safety-1019951-last.html
 [2012-04-26 05:29 UTC] pajoye@php.net
@ricardo dot nuno dot rodrigues at hotmail dot com

Please disable xdebug and try again.
 [2012-04-26 05:31 UTC] pajoye@php.net
-Status: Open +Status: Feedback
 [2012-04-26 05:31 UTC] pajoye@php.net
@drueter at assyst dot com

it is not related to this discussion. Stas explanation is correct.

Also it does not seem that your issue is related to this one. Please open a new 
one if necessary.
 [2012-04-26 14:43 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
-Status: Feedback +Status: Open
 [2012-04-26 14:43 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
xdebug excluded as mentioned earlier 
the error doesn't change with or without xdebug
 [2012-04-28 08:44 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
Update -- PHP 5.4.1 stills
Update -- without ANY extension stills

Update - mysqlnd

I made another test:
 1) no extensions
 2) run a large number ab -n 10000 -c 20 http://127.0.0.1/phpinfo.php
 3) run on the browser on SAME TIME to see what happens

Output 
(interesting part & repeated to see if happen on the same point and it does & 
results not change with ALL other extensions loaded):

mysqlnd

Fatal error: Nesting level too deep - recursive dependency? in 
C:\xxxx\phpinfo.php on line 3
mysqlnd	enabled
Version	mysqlnd 5.0.10 - 20111026 - $Id: 
b0b3b15c693b7f6aeb3aa66b646fee339f175e39 $
Compression	supported
SSL	supported
Command buffer size	8192
Read buffer size	32768
Read timeout	31536000
Collecting statistics	No
Collecting memory statistics	No
Tracing	0
 [2012-05-04 23:46 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
change to MySQL
 [2012-05-04 23:46 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
-Package: APC +Package: MySQLi related
 [2012-05-07 16:35 UTC] johannes@php.net
-Status: Open +Status: Assigned -Assigned To: +Assigned To: mysql
 [2012-05-07 16:35 UTC] johannes@php.net
This comes from using zend_hash_apply() on the plugin table on multiple threads. A fix using a mutex is on http://schlueters.de/~johannes/php/bug61704.diff

I'll switch to manual iteration however so the lock isn't needed.
 [2012-05-08 15:33 UTC] johannes@php.net
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src.git;a=commit;h=e8e661128a4dcee9d2f35ed3443d567ba2ad7870
Log: Fix #61704 (Crash apache, phpinfo() threading issue)
 [2012-05-08 15:33 UTC] johannes@php.net
-Summary: Crash apache +Summary: Crash apache, phpinfo() threading issue -Status: Assigned +Status: Closed
 [2012-05-08 15:33 UTC] johannes@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.


 [2012-05-08 22:19 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
trunk version not working
------------------

Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!deflateEnd+f     000001bc     0234b7c4     5d7197bd    
php5ts!php_version_compare+bf6a     25c3da78     25c3da78     00000000    
php5ts!php_request_shutdown+27b     0fd3ff6c     00000000     56433230    
php5ts!php_request_shutdown+93     26e26bb0     26e26b90     00000004    
libapr_1!apr_pstrdup+39     00000000     00000000     00000000    




PHP5TS!DEFLATEEND+FWARNING - DebugDiag was not able to locate debug symbols for 
php5ts.dll, so the information below may be incomplete.



In 
httpd__PID__9208__Date__05_08_2012__Time_11_13_15PM__269__Second_Chance_Exceptio
n_C0000005.dmp the assembly instruction at php5ts!deflateEnd+f in 
C:\AppServ\php5\php5ts.dll from The PHP Group has caused an access violation 
exception (0xC0000005) when trying to read from memory location 0x000001d8 on 
thread 42



Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!shmget+17a     00000001     00000000     00000000    
php_shmop_rsr!get_module+1a2     0c7d5398     0eb220d0     0c7d5398    
php5ts!zval_add_ref+17b5     0504fe10     0504fb64     00000000    
php5ts!execute+1fd     0eb3f458     0c7d5301     0c7d5398    
php5ts!zend_execute_scripts+119     00000001     0eb3f4e9     0504fb80    
user32!PostThreadMessageA+e1     0504ff6c     00000000     56433230    
php5ts!php_execute_script+a7     764d1194     0000027c     ffffffff    
KERNELBASE!WaitForSingleObjectEx+cb     00000020     609dc7f4     609f2cc6    
php5ts!xmlGetGlobalState+11     00888968     00000000     014c1738    
libhttpd!ap_regexec+d6     00ba9690     014927e7     0504fe30    
mod_rewrite+6387     014911d8     00000000     014911d8    
libhttpd!ap_run_handler+25     014911d8     014911d8     014911d8    
libhttpd!ap_invoke_handler+a2     00000000     01485330     0504fefc    
libhttpd!ap_die+26e     014911d8     00000000     00bd4918    
libhttpd!ap_psignature+15b2     01485330     00000018     01485330    
libhttpd!ap_run_process_connection+25     01485330     00c397c8     0504ff44    
libhttpd!ap_process_connection+33     01485330     014851b8     00000000    
libhttpd!ap_regkey_value_remove+fe7     01485328     9f1b9813     00000000    
msvcr100!_endthreadex+3f     00000000     0504ff94     764d339a    
msvcr100!_endthreadex+ce     01444ce0     0504ffd4     76ef9ef2    
kernel32!BaseThreadInitThunk+e     01444ce0     7b64113e     00000000    
ntdll!__RtlUserThreadStart+70     730bc59c     01444ce0     00000000    
ntdll!_RtlUserThreadStart+1b     730bc59c     01444ce0     00000000    




PHP5TS!SHMGET+17AWARNING - DebugDiag was not able to locate debug symbols for 
php5ts.dll, so the information below may be incomplete.



In 
httpd__PID__7336__Date__05_05_2012__Time_12_15_19AM__621__Second_Chance_Exceptio
n_C0000005.dmp the assembly instruction at php5ts!shmget+17a in 
C:\AppServ\php5\php5ts.dll from The PHP Group has caused an access violation 
exception (0xC0000005) when trying to read from memory location 0x00000000 on 
thread 27


Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!zend_register_internal_class_ex+c6d     1fa8ca48     1fa8ca48     
00000000    
php5ts!php_request_shutdown+27b     0adaff6c     00000000     56433230    
php5ts!php_request_shutdown+93     13906680     13906660     00000004    
libapr_1!apr_pstrdup+39     00000000     00000000     00000000    




PHP5TS!ZEND_REGISTER_INTERNAL_CLASS_EX+C6DWARNING - DebugDiag was not able to 
locate debug symbols for php5ts.dll, so the information below may be incomplete.



In 
httpd__PID__7980__Date__05_08_2012__Time_11_15_36PM__79__Second_Chance_Exception
_C0000005.dmp the assembly instruction at 
php5ts!zend_register_internal_class_ex+c6d in C:\AppServ\php5\php5ts.dll from 
The PHP Group has caused an access violation exception (0xC0000005) when trying 
to read from memory location 0x6b6abc8d on thread 215
 [2012-05-08 23:30 UTC] johannes@php.net
This is a different issue or you're using a build which is older than my fix. If it is a different issue it should get a new bug ID. I don't have Windows at hand to test php.net builds right now ... when testing please go from a setup without extra extensions and add them till the issue pops up. Thanks.
 [2012-05-09 12:34 UTC] ricardo dot nuno dot rodrigues at hotmail dot com
trunk version not working or PHP 5.4.3
------------------

I don't understand why you say that this version is older than your patch since 
I picked many hours after you said it's done. 



without any extension loaded
------------------

Function     Arg 1     Arg 2     Arg 3   Source 
php5ts!deflateEnd+f     000001bc     0234b7c4     5d7197bd    
php5ts!php_version_compare+bf6a     25c3da78     25c3da78     00000000    
php5ts!php_request_shutdown+27b     0fd3ff6c     00000000     56433230    
php5ts!php_request_shutdown+93     26e26bb0     26e26b90     00000004    
libapr_1!apr_pstrdup+39     00000000     00000000     00000000    




PHP5TS!DEFLATEEND+FWARNING - DebugDiag was not able to locate debug symbols for 
php5ts.dll, so the information below may be incomplete.



In 
httpd__PID__9208__Date__05_08_2012__Time_11_13_15PM__269__Second_Chance_Exceptio
n_C0000005.dmp the assembly instruction at php5ts!deflateEnd+f in 
C:\AppServ\php5\php5ts.dll from The PHP Group has caused an access violation 
exception (0xC0000005) when trying to read from memory location 0x000001d8 on 
thread 42
 [2014-10-07 23:26 UTC] stas@php.net
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=e8e661128a4dcee9d2f35ed3443d567ba2ad7870
Log: Fix #61704 (Crash apache, phpinfo() threading issue)
 [2014-10-07 23:37 UTC] stas@php.net
Automatic comment on behalf of johannes
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=e8e661128a4dcee9d2f35ed3443d567ba2ad7870
Log: Fix #61704 (Crash apache, phpinfo() threading issue)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Mar 28 17:01:29 2024 UTC