Description:
------------
As usual with bugs related to garbage collection, I don't have a short reproduce code. The segmentation fault happens when running a pretty heavy integration test and is currently reproducible on PHP 5.3 (tested 5.3.4, 5.3.6RC3, 5.3.8 and PHP_5_3 svn HEAD). Unfortunately garbage collection is a bit too much for me to be able to make sense of it and debug the issue.

Interestingly enough I couldn't reproduce it on PHP 5.2 or PHP 5.4.

Happens both with gcc 3.4.6 and 4.2.5 with -O0.

SSH Access to the machine is available for anyone interested in investigating.



Actual result:
--------------
Here is the relevant portion of backtrace and some other gdb commands:

#0  0x000000000094a060 in gc_mark_roots () at /array1/compile/php-src/php/php-src/branches/PHP_5_3/Zend/zend_gc.c:434
434                             if (GC_ZVAL_GET_COLOR(current->u.pz) == GC_PURPLE) {
(gdb) bt full
#0  0x000000000094a060 in gc_mark_roots () at /array1/compile/php-src/php/php-src/branches/PHP_5_3/Zend/zend_gc.c:434
        current = (gc_root_buffer *) 0x11121a0
#1  0x000000000094a90c in gc_collect_cycles () at /array1/compile/php-src/php/php-src/branches/PHP_5_3/Zend/zend_gc.c:664
        p = (zval_gc_info *) 0x1e8fbd0
        q = (zval_gc_info *) 0x7fffffffccd8
        orig_free_list = (zval_gc_info *) 0x377c42d8edc99ee
        orig_next_to_free = (zval_gc_info *) 0x901e88190
        count = 0
#2  0x00000000009495c2 in gc_zval_possible_root (zv=0x3e37620) at /array1/compile/php-src/php/php-src/branches/PHP_5_3/Zend/zend_gc.c:166
        newRoot = (gc_root_buffer *) 0x0
#3  0x00000000009bb104 in ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER (execute_data=0x1390810) at zend_gc.h:183
        opline = (zend_op *) 0x1e8fbf8
        free_op1 = {var = 0x0}
        dim = (zval *) 0x3e37708
        container = (zval **) 0x3057850
#4  0x0000000000953c58 in execute (op_array=0x1e8be08) at zend_vm_execute.h:107
        ret = 0
        execute_data = (zend_execute_data *) 0x1390810
        nested = 1 '\001'
        original_in_execution = 0 '\0'
...
(gdb) print current->u.pz
$1 = (zval *) 0x3e9fd38
(gdb) print *current->u.pz
Cannot access memory at address 0x3e9fd38
(gdb) frame 4
#4  0x0000000000953c58 in execute (op_array=0x1e8be08) at zend_vm_execute.h:107
107                     if ((ret = EX(opline)->handler(execute_data TSRMLS_CC)) > 0) {
(gdb) dump_bt executor_globals.current_execute_data
[0x01390810] addItem() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/pear/Config/Container.php:153
[0x013905c0] addItem() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/pear/Config/Container.php:108
[0x01390450] createItem() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/pear/Config/Container.php:196
[0x01390008] createDirective() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/pear/Config/Container/PHPArray.php:113
[0x0138fbc0] _parseArray() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/pear/Config/Container/PHPArray.php:111
[0x0138f5a0] _parseArray() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/pear/Config/Container/PHPArray.php:75
[0x0138ef48] parseDatasrc() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/pear/Config.php:197
[0x0138ebd8] parseConfig() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/OA/Admin/Settings.php:364
[0x0138b9b0] writeConfigArrayToFile() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/OA/Admin/Settings.php:173
[0x0138b7a0] writeConfigChange() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/OX/Plugin/PluginManager.php:870
[0x0138ac18] _setPackage() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/OX/Plugin/PluginManager.php:518
[0x0138a0e8] enablePackage() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/tests/testClasses/TestEnv.php:183
[0x01389198] installPluginPackage() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/plugins_repo/apRetargetingDriverExternal/plugins/apRetargeting/lib/Dal/Drivers/tests/integration/External.plg.test.php:28
[0x01388f80] setUp() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/simpletest/invoker.php:67
[0x01388e50] invoke() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/simpletest/invoker.php:126
[0x01388878] invoke() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/simpletest/errors.php:48
[0x01388748] invoke() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/simpletest/invoker.php:126
[0x01388228] invoke() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/simpletest/exceptions.php:42
[0x01387a28] invoke() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/simpletest/test_case.php:135
[0x013873e0] run() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/simpletest/test_case.php:588
[0x01386d98] run() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/lib/simpletest/test_case.php:591
[0x01386b08] run() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/tests/testClasses/TestRunner.php:411
[0x01386320] runCase() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/tests/testClasses/TestRunner.php:194
[0x01385040] runFile() /usr/local/bamboo/test-home/xml-data/build-dir/RET-TRUNK-PHPBUG/tests/run.php:123