Did you try to run the same code using CLI ?

With CLI it works because CLI does not use the WSDL cache in memory (after finishing the program it forgets its cache). The first call to the webservice always works, even in the webserver.

But your idea was good. I tried it with a CLI script that calls the same code in a for loop:

pangaeaw@pans1:~/test$ php test.php 
Loop: 0
Loop: 1
Illegal Instruction (core dumped)

Now i debug this...

(gdb) run test.php
Starting program: /pangaea/gnu/bin/php test.php
Loop: 0
Loop: 1

Program received signal SIGILL, Illegal instruction.
0x0071727c in ?? ()
(gdb) bt
#0  0x0071727c in ?? ()
#1  0x00717280 in ?? ()
Previous frame identical to this frame (corrupt stack?)
(gdb)

Compiling with/without --enable-debug does not show more info. But the error is always SIGILL.

The code used for testing:
pangaeaw@pans1:~/test$ cat test.php
<?php
for ($i=0; $i<20; $i++) {
 echo "Loop: ".$i."\n";
 $ws=new SoapClient('http://ws.pangaea.de/ws/services/PangaVista?wsdl',array('encoding'=>'ISO-8859-1'));
 $ua='test/1.0';
 $sess=$ws->registerSession(NULL,$ua,'127.0.0.1',"PangaVista");
 $search=new stdClass();
 $search->queryString='grobe';
 $res=$ws->advSearch($sess,$search,0,10,'thumb');
}
?>

Can definitely reproduce this. Valgrind trace follows:

==8798== Invalid read of size 4
==8798==    at 0x81FE864: master_to_xml (php_encoding.c:362)
==8798==    by 0x8201ED5: model_to_xml_object (php_encoding.c:1459)
==8798==    by 0x82022B9: model_to_xml_object (php_encoding.c:1540)
==8798==    by 0x8202A93: to_xml_object (php_encoding.c:1716)
==8798==    by 0x8208C9C: sdl_guess_convert_xml (php_encoding.c:2979)
==8798==    by 0x81FE8AF: master_to_xml (php_encoding.c:366)
==8798==    by 0x81F9732: serialize_zval (soap.c:4162)
==8798==    by 0x81F9633: serialize_parameter (soap.c:4135)
==8798==    by 0x81F8AA5: serialize_function_call (soap.c:3970)
==8798==    by 0x81F2545: do_soap_call (soap.c:2477)
==8798==    by 0x81F3A76: zif_SoapClient___call (soap.c:2691)
==8798==    by 0x837BE3F: zend_call_function (zend_execute_API.c:952)
==8798==  Address 0x4B165E4 is 36 bytes inside a block of size 44 free'd
==8798==    at 0x401D048: free (vg_replace_malloc.c:235)
==8798==    by 0x820AA2D: delete_encoder (php_encoding.c:3301)
==8798==    by 0x83912EB: zend_hash_destroy (zend_hash.c:521)
==8798==    by 0x8235248: delete_sdl_impl (php_sdl.c:3196)
==8798==    by 0x82350C7: get_sdl (php_sdl.c:3153)
==8798==    by 0x81F1A76: zif_SoapClient_SoapClient (soap.c:2301)
==8798==    by 0x83A6870: execute_internal (zend_execute.c:1368)
==8798==    by 0x4A1D670: xdebug_execute_internal (xdebug.c:1428)
==8798==    by 0x83A6EB1: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:202)
==8798==    by 0x83A7B59: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:322)
==8798==    by 0x83A6A44: execute (zend_vm_execute.h:92)
==8798==    by 0x4A1D30C: xdebug_execute (xdebug.c:1366)
==8798==
==8798== Invalid read of size 4
==8798==    at 0x81FE886: master_to_xml (php_encoding.c:365)
==8798==    by 0x8201ED5: model_to_xml_object (php_encoding.c:1459)
==8798==    by 0x82022B9: model_to_xml_object (php_encoding.c:1540)
==8798==    by 0x8202A93: to_xml_object (php_encoding.c:1716)
==8798==    by 0x8208C9C: sdl_guess_convert_xml (php_encoding.c:2979)
==8798==    by 0x81FE8AF: master_to_xml (php_encoding.c:366)
==8798==    by 0x81F9732: serialize_zval (soap.c:4162)
==8798==    by 0x81F9633: serialize_parameter (soap.c:4135)
==8798==    by 0x81F8AA5: serialize_function_call (soap.c:3970)
==8798==    by 0x81F2545: do_soap_call (soap.c:2477)
==8798==    by 0x81F3A76: zif_SoapClient___call (soap.c:2691)
==8798==    by 0x837BE3F: zend_call_function (zend_execute_API.c:952)
==8798==  Address 0x4B165D8 is 24 bytes inside a block of size 44 free'd
==8798==    at 0x401D048: free (vg_replace_malloc.c:235)
==8798==    by 0x820AA2D: delete_encoder (php_encoding.c:3301)
==8798==    by 0x83912EB: zend_hash_destroy (zend_hash.c:521)
==8798==    by 0x8235248: delete_sdl_impl (php_sdl.c:3196)
==8798==    by 0x82350C7: get_sdl (php_sdl.c:3153)
==8798==    by 0x81F1A76: zif_SoapClient_SoapClient (soap.c:2301)
==8798==    by 0x83A6870: execute_internal (zend_execute.c:1368)
==8798==    by 0x4A1D670: xdebug_execute_internal (xdebug.c:1428)
==8798==    by 0x83A6EB1: zend_do_fcall_common_helper_SPEC (zend_vm_execute.h:202)
==8798==    by 0x83A7B59: ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (zend_vm_execute.h:322)
==8798==    by 0x83A6A44: execute (zend_vm_execute.h:92)
==8798==    by 0x4A1D30C: xdebug_execute (xdebug.c:1366)
==8798==

gdb backtrace:
#0  0x00000030 in ?? ()
#1  0x081fe8d9 in master_to_xml (encode=0x873eca0, data=0x8733218, style=1,
    parent=0x873dcd8) at /dat/dev/php/php-5.1dev/ext/soap/php_encoding.c:369
#2  0x08201ed6 in model_to_xml_object (node=0x873dcd8, model=0x874a7e0,
    object=0x87331b8, style=1, strict=1)
    at /dat/dev/php/php-5.1dev/ext/soap/php_encoding.c:1459
#3  0x082022ba in model_to_xml_object (node=0x873dcd8, model=0x874b228,
    object=0x87331b8, style=1, strict=1)
    at /dat/dev/php/php-5.1dev/ext/soap/php_encoding.c:1540
#4  0x08202a94 in to_xml_object (type=0x874bf20, data=0x87331b8, style=1,
    parent=0x873dd50) at /dat/dev/php/php-5.1dev/ext/soap/php_encoding.c:1716
#5  0x08208c9d in sdl_guess_convert_xml (enc=0x874bf20, data=0x87331b8,
    style=1, parent=0x873dd50)
    at /dat/dev/php/php-5.1dev/ext/soap/php_encoding.c:2979
#6  0x081fe8b0 in master_to_xml (encode=0x874bf20, data=0x87331b8, style=1,
    parent=0x873dd50) at /dat/dev/php/php-5.1dev/ext/soap/php_encoding.c:366
#7  0x081f9733 in serialize_zval (val=0x87331b8, param=0x874bad0,
    paramName=0x874afb0 "searchDescription", style=1, parent=0x873dd50)
    at /dat/dev/php/php-5.1dev/ext/soap/soap.c:4162
#8  0x081f9634 in serialize_parameter (param=0x874bad0, param_val=0x87331b8,
    index=1, name=0x0, style=1, parent=0x873dd50)
    at /dat/dev/php/php-5.1dev/ext/soap/soap.c:4135
#9  0x081f8aa6 in serialize_function_call (this_ptr=0x87330b0,
    function=0x874bc80, function_name=0x0,
    uri=0x874bca8 "urn:PanWebServices.PangaVista", arguments=0x874e490,
    arg_count=5, version=1, soap_headers=0x0)
    at /dat/dev/php/php-5.1dev/ext/soap/soap.c:3970
#10 0x081f2546 in do_soap_call (this_ptr=0x87330b0,
    function=0x8739fd8 "advSearch", function_len=9, arg_count=5,
    real_args=0x874e490, return_value=0x87395a8,
    location=0x874ced8 "http://ws.pangaea.de/ws/services/PangaVista",
    soap_action=0x0, call_uri=0x0, soap_headers=0x0, output_headers=0x0)
    at /dat/dev/php/php-5.1dev/ext/soap/soap.c:2477
#11 0x081f3a77 in zif_SoapClient___call (ht=2, return_value=0x87395a8,
    return_value_ptr=0x0, this_ptr=0x87330b0, return_value_used=1)
    at /dat/dev/php/php-5.1dev/ext/soap/soap.c:2691
#12 0x0837be40 in zend_call_function (fci=0xbf8fb374, fci_cache=0xbf8fb348)
    at /dat/dev/php/php-5.1dev/Zend/zend_execute_API.c:952
#13 0x0839b6ab in zend_call_method (object_pp=0xbf8fb42c, obj_ce=0x8703ea0,
    fn_proxy=0x8703fbc, function_name=0x85a6318 "__call", function_name_len=6,
    retval_ptr_ptr=0xbf8fb3ec, param_count=2, arg1=0x8739810, arg2=0x87398e8)
    at /dat/dev/php/php-5.1dev/Zend/zend_interfaces.c:88
#14 0x083a3008 in zend_std_call_user_call (ht=5, return_value=0x8739928,
    return_value_ptr=0x0, this_ptr=0x87330b0, return_value_used=1)
    at /dat/dev/php/php-5.1dev/Zend/zend_object_handlers.c:634
#15 0x083a6871 in execute_internal (execute_data_ptr=0xbf8fb774,
    return_value_used=1) at /dat/dev/php/php-5.1dev/Zend/zend_execute.c:1368
#16 0xb76d0671 in xdebug_execute_internal (current_execute_data=0xbf8fb774,
    return_value_used=1) at /dat/dev/php/xdebug/xdebug.c:1428
#17 0x083a6eb2 in zend_do_fcall_common_helper_SPEC (execute_data=0xbf8fb774)
    at zend_vm_execute.h:202
#18 0x083a7b5a in ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER (execute_data=0xbf8fb774)
    at zend_vm_execute.h:322
#19 0x083a6a45 in execute (op_array=0x8732908) at zend_vm_execute.h:92
#20 0xb76d030d in xdebug_execute (op_array=0x8732908)
    at /dat/dev/php/xdebug/xdebug.c:1366
#21 0x08387aed in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /dat/dev/php/php-5.1dev/Zend/zend.c:1109
#22 0x0833fdca in php_execute_script (primary_file=0xbf8fdc10)
    at /dat/dev/php/php-5.1dev/main/main.c:1728
#23 0x083f7b74 in main (argc=2, argv=0xbf8fdd24)
    at /dat/dev/php/php-5.1dev/sapi/cli/php_cli.c:1092

I have now compiled it again only with xml and soap modules linked statically with --enable-debug, this time it coredumps even in the first loop (there must be something completely broken, that the script generates two different signals with/without debug). From the webserver logs you see that master_to_xml is also in the error log (together with other soap functions):

(gdb) run ~/test/test.php
Starting program: /pangaea/install/php5.1-200604131430/sapi/cli/php ~/test/test.php
Loop: 0

Program received signal SIGSEGV, Segmentation fault.
master_to_xml (encode=0x424b60, data=0x43fc28, style=1, parent=0x429740)
    at /pangaea/install/php5.1-200604131430/ext/soap/php_encoding.c:363
363                             data = encode->to_xml_before(&encode->details, data);
(gdb) bt
#0  master_to_xml (encode=0x424b60, data=0x43fc28, style=1, parent=0x429740)
    at /pangaea/install/php5.1-200604131430/ext/soap/php_encoding.c:363
#1  0x0011ca0c in model_to_xml_object (node=0x429740, model=0x43a8b0, object=0x43fc28, style=1, strict=1)
    at /pangaea/install/php5.1-200604131430/ext/soap/php_encoding.c:1461
#2  0x0011cb5c in model_to_xml_object (node=0x429740, model=0x43a8e0, object=0x428258, style=1, strict=1)
    at /pangaea/install/php5.1-200604131430/ext/soap/php_encoding.c:1542
#3  0x0011d300 in to_xml_object (type=0x439ef8, data=0x428258, style=1, parent=0x423138)
    at /pangaea/install/php5.1-200604131430/ext/soap/php_encoding.c:1718
#4  0x0011fd60 in sdl_guess_convert_xml (enc=0x439ef8, data=0x428258, style=1, parent=0x423138)
    at /pangaea/install/php5.1-200604131430/ext/soap/php_encoding.c:2981
#5  0x0011b7e4 in master_to_xml (encode=0x439ef8, data=0x428258, style=1, parent=0x423138)
    at /pangaea/install/php5.1-200604131430/ext/soap/php_encoding.c:366
#6  0x0010d45c in serialize_zval (val=0x428258, param=0x42f430, paramName=0x413718 "searchDescription", style=1, 
    parent=0x423138) at /pangaea/install/php5.1-200604131430/ext/soap/soap.c:4167
#7  0x0010d60c in serialize_parameter (param=0x42f430, param_val=0x428258, index=1, name=0x0, style=1, 
    parent=0x423138) at /pangaea/install/php5.1-200604131430/ext/soap/soap.c:4140
#8  0x001124ac in serialize_function_call (this_ptr=0x427f60, function=0x415118, 
    function_name=0x1 <Address 0x1 out of bounds>, uri=0x42f430 "", arguments=0x44059c, arg_count=5, version=1, 
    soap_headers=0x0) at /pangaea/install/php5.1-200604131430/ext/soap/soap.c:3975
#9  0x001132ac in do_soap_call (this_ptr=0x427f60, function=0x440650 "advSearch", function_len=9, arg_count=5, 
    real_args=0x440598, return_value=0x43fda0, location=0x43a6f0 "http://ws.pangaea.de/ws/services/PangaVista", 
    soap_action=0x0, call_uri=0x0, soap_headers=0x0, output_headers=0x0)
    at /pangaea/install/php5.1-200604131430/ext/soap/soap.c:2482
#10 0x00113ebc in zif_SoapClient___call (ht=2, return_value=0x43fda0, return_value_ptr=0x0, this_ptr=0x427f60, 
    return_value_used=1) at /pangaea/install/php5.1-200604131430/ext/soap/soap.c:2696
#11 0x002023bc in zend_call_function (fci=0xffbfef98, fci_cache=0x363c00)
    at /pangaea/install/php5.1-200604131430/Zend/zend_execute_API.c:952
#12 0x002226dc in zend_call_method (object_pp=0xffbff0b0, obj_ce=0x3d0e38, fn_proxy=0x3d0f54, 
    function_name=0x2ee3c8 "__call", function_name_len=6, retval_ptr_ptr=0xffbff04c, param_count=1515870810, 
    arg1=0x440008, arg2=0x4403a0) at /pangaea/install/php5.1-200604131430/Zend/zend_interfaces.c:88
#13 0x0022904c in zend_std_call_user_call (ht=-4198224, return_value=0x43ff60, return_value_ptr=0x0, 
    this_ptr=0x427f60, return_value_used=1) at /pangaea/install/php5.1-200604131430/Zend/zend_object_handlers.c:634
#14 0x0022e8fc in zend_do_fcall_common_helper_SPEC (execute_data=0xffbff388) at zend_vm_execute.h:200
#15 0x0022e0d0 in execute (op_array=0x422d08) at zend_vm_execute.h:92
#16 0x0020fef0 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /pangaea/install/php5.1-200604131430/Zend/zend.c:1109
#17 0x001cdb58 in php_execute_script (primary_file=0xffbffc28)
---Type <return> to continue, or q <return> to quit---
    at /pangaea/install/php5.1-200604131430/main/main.c:1732
#18 0x0029100c in main (argc=2, argv=0xffbffcc4) at /pangaea/install/php5.1-200604131430/sapi/cli/php_cli.c:1092
(gdb)

Could you try the following patch and make sure it works for you?

http://www.php.net/~andrei/soap_bug.diff

Works as CLI in patched snapshot:

pangaeaw@pans1:~/install/php5.1-200604151030/sapi/cli$ ./php ~/test/test.php
Loop: 0
Loop: 1
Loop: 2
Loop: 3
Loop: 4
Loop: 5
Loop: 6
Loop: 7
Loop: 8
Loop: 9
Loop: 10
Loop: 11
Loop: 12
Loop: 13
Loop: 14
Loop: 15
Loop: 16
Loop: 17
Loop: 18
Loop: 19

...and in the webserver with WSDL caching enabled: http://www.pangaea.de/PangaVista?query=grobe

You can apply this patch and close this bug.

I have only the following question:
Is it correct that no more /tmp/wsdl-* files are generated? There should be some hint in php.ini, that the wsdl_cache_dir is not longer needed. Or WHEN will it be used now (if not ZTS,...)?

Thanks for this patch, it is now really faster in this multithreaded webserver where no longer the wsdl/wsdl-cache file needs to be evaluated!

The bug is not fixed completely. With another webservice it crashes (one with an xsd:anyType value in one of the complex types):

[15/Apr/2006:13:55:20] catastrophe (24983):  CORE3260: Server crash detected (signal SIGSEGV)  [15/Apr/2006:13:55:20] info (24983):  CORE3261: Crash occurred in NSAPI SAF php5_execute  [15/Apr/2006:13:55:20] info (24983):  CORE3262: Crash occurred in function get_conversion from module /pangaea/webserver61/bin/libphp5.so

Code:
<?php
for ($i=0; $i<20; $i++) {
echo "Loop: ".$i."\n";
$ws=new SoapClient('http://opteron.bremen.wdc-mare.org:8800/servlet/AXIS/Search?wsdl',array('encoding'=>'ISO-8859-1'
$search=new stdClass();
$search->queryString='argo';
$search->ranges[]=$r=new stdClass();
$r->field='maxDateTime';
$r->min='2003-04-01';
$search->index='all';
$res=$ws->search($search,$i*10,10);
}
?>

The problem is that this cannot be reproduced with CLI, this crashes with SIGSEGV or SIGILL in the webserver only, so the above CLI script works.

Does it crash in the client code or the server code? Can you provide a short script that reproduces it on the webserver as well as a backtrace?

It is the same problem as before. The backtrace of the weserver is unusable because stack corrupt (mostly SIGILL, sometimes SIGSEGV but also without stack). I yesterday tried to get a backtrace (for the problem you fixed) the whole afternoon... It was horrible. With the CLI script it was reproducible but this time the CLI script works.

It is always soap client code, the soap server runs in AXIS (see wsdl in client code script). The script is used in the webserver with some additional parameter parsing logic, but the core used is the soap code from my last mail.

I think the script does in CLI mode also bad things but it does not crash. In the webserver, where more things are running at the same time the corrupt memory leads to a crash.

I hoped that you see the error when looking at the WSDL used: http://opteron.bremen.wdc-mare.org:8800/servlet/AXIS/Search?wsdl
Could be that there is an error in your code that makes this crash (the xsd:anyType in the RangeQuery or in the result???)

From the webserver log i can see that the crash occurs always in function "get_conversion()" (SIGSEGV or SIGBUS):
CORE3262: Crash occurred in function get_conversion from module /pangaea/webserver61/bin/libphp5.so

Funny is the follwing:
CORE3262: Crash occurred in function free from module /usr/lib/libmtmalloc.so.1 

When server dies with SIGILL (which is mostly the case)nothing is said about the location.

Andrei, also take a look at these lines in php_encoding.c:

line 358
        if (encode == NULL) {
            encode = get_conversion(UNKNOWN_TYPE);
        }
        if (encode->to_xml_before) {
            data = encode->to_xml_before(&encode->details, data);
        }
line 365
The get_conversion() may return NULL, but you're using encode without checking it for NULL. 
From what I can see, the backtrace points exactly to this problem:

Program received signal SIGSEGV, Segmentation fault.
master_to_xml (encode=0x424b60, data=0x43fc28, style=1,
parent=0x429740)
at /pangaea/install/php5.1-200604131430/ext/soap/php_encoding.c:363
363                             data =
encode->to_xml_before(&encode->details, data);

And xsd:anyType is mapped to xml without encoding... Could this be the problem now?

From the logs on the AXIS side of the server I can see that the crash now occurs on the decoding side (parsing the response from AXIS). Hope that helps...

And when returning an empty Apache Map (see wsdl) in the AXIS code it does not crash anymore. With all that the problem seems to be the decoding of the Apache Map entries of type xsd:anyType values from the SOAP response to PHP datatypes.

Fixed in CVS HEAD and PHP_5_1.