php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #44546 crash with SplHeap::next()
Submitted: 2008-03-27 10:56 UTC Modified: 2008-04-17 10:23 UTC
From: l dot alberton at quipo dot it Assigned: dmitry (profile)
Status: Closed Package: SPL related
PHP Version: 5.3CVS-2008-03-27 (snap) OS: Windows
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: l dot alberton at quipo dot it
New email:
PHP Version: OS:

 

 [2008-03-27 10:56 UTC] l dot alberton at quipo dot it
Description:
------------
I was trying the latest SPL features, but every time I call the next() method of a SplHeap object (SplMaxHeap, SplMinHeap, SplPriorityQueue), I get a crash.

Reproduce code:
---------------
$heap = new SplMaxHeap();
$heap->insert('a');
$heap->insert('b');
$heap->insert('c');

$heap->rewind();

echo $heap->current();

$heap->next(); //crash

echo $heap->current();


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-03-27 12:56 UTC] johannes@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows (zip):
 
  http://snaps.php.net/win32/php5.3-win32-latest.zip

For Windows (installer):

  http://snaps.php.net/win32/php5.3-win32-installer-latest.msi

I get, as expected, "cb" as a outpout, please make sure your PHP is up to date and describe what "crash" means.
 [2008-03-27 15:22 UTC] l dot alberton at quipo dot it
I'm using the latest snapshot. 

Etienne told me it works with Linux, but I can consistently reproduce this bug on windows (I already experienced it in the 19/03 snapshot and ever since, haven't checked before).


This is the error message in the Apache error.log file:


[notice] Parent: child process exited with status 3221225477 -- Restarting.
[notice] Apache/2.2.4 (Win32) PHP/5.3.0-dev configured -- resuming normal operations
 [2008-03-27 16:58 UTC] l dot alberton at quipo dot it
Entry point   msvcrt!_endthreadex+3a 
Create time   27/03/2008 17.28.46 
Time spent in user mode   0 Days 0:0:0.15 
Time spent in kernel mode   0 Days 0:0:0.31 






Function     Arg 1     Arg 2     Arg 3   Source 
0x00000000     06050040     05a2e398     05f5eea9    
php5ts!execute+21e     05f5ec98     05a2e398     00000000    
php5ts!zend_execute_scripts+107     00000008     05a2e398     00000000    
php5ts!php_execute_script+222     056ffe74     05a2e398     00000005    
php5apache2_2!php_handler+5d0     05a2b560     006db248     05a2b560    
libhttpd!ap_run_handler+21     05a2b560     05a2b560     05a2b560    
libhttpd!ap_invoke_handler+ae     00000000     05a24168     056fff38    
libhttpd!ap_die+24e     05a2b560     00000000     00692170    
libhttpd!ap_get_request_note+1c6c     05a24168     05a24168     05a24168    
libhttpd!ap_run_process_connection+21     05a24168     006ec2c0     056fff80    
libhttpd!ap_process_connection+33     05a24168     0596b330     7c92849f    
libhttpd!ap_regkey_value_remove+c0c     05a24160     7c92849f     00d50648    
msvcrt!_endthreadex+a9     00fff9e8     7c92849f     00d50648    
kernel32!BaseThreadStart+37     77c0a341     00fff9e8     00000000    




In httpd__PID__4704__Date__03_27_2008__Time_05_41_03PM__406__First chance exception 0XC0000005.dmp the module C:\PHP\php5ts.dll has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 247

Module Information 
Image Name: C:\PHP\php5ts.dll   Symbol Type:  PDB 
Base address: 0x00770000   Time Stamp:  Thu Mar 27 13:17:55 2008  
Checksum: 0x00000000   Comments:   
COM DLL: False   Company Name:  The PHP Group 
ISAPIExtension: False   File Description:  PHP Script Interpreter 
ISAPIFilter: False   File Version:  5.3.0-dev 
Managed DLL: False   Internal Name:  PHP Script Interpreter 
VB DLL: False   Legal Copyright:  Copyright ? 1997-2008 The PHP Group 
Loaded Image Name:  php5ts.dll   Legal Trademarks:  PHP 
Mapped Image Name:  C:\PHP\php5ts.dll   Original filename:  php5ts.dll 
Module name:  php5ts   Private Build:   
Single Threaded:  False   Product Name:  PHP 
Module Size:  5,07 MBytes   Product Version:  5.3.0-dev 
Symbol File Name:  C:\PHP\debugpack\php5ts.pdb   Special Build:  &
 [2008-03-27 17:00 UTC] l dot alberton at quipo dot it
BTW: I don't get a crash when running the script from the command line, but Apache crashes when running it in a web browser
 [2008-03-27 18:41 UTC] colder@php.net
Doesn't look in any way related to spl heaps....

Seems like the build is somehow broken
 [2008-03-27 18:47 UTC] l dot alberton at quipo dot it
I have no idea. Nevertheless, that's the way I experienced the crash, and without calling next() everything was fine.
 [2008-03-28 11:30 UTC] l dot alberton at quipo dot it
I think I have a better reproducing script:

=================================

$pqueue = new SplPriorityQueue();
$pqueue->insert('a', 1);
$pqueue->insert('b', 2);

try {
    echo $pqueue->extract();
    echo $pqueue->extract();
    echo $pqueue->extract();
} catch (RuntimeException $e) {
    echo "\nERROR: ".$e->getMessage();
}

=================================

Here, I insert 2 elements in the queue, and try to extract 3 elements.
The last extract() call should trigger a RuntimeException, and this is the case when running the script from the command line. When running it in a web browser, Apache crashes.

HTH
 [2008-03-28 16:06 UTC] colder@php.net
Your build/snapshot appears to be broken, I can't find anyone except you that can reproduce it under windows.

Please try to run the complete test suite so you can see whether you find other crashes....
 [2008-03-29 06:25 UTC] l dot alberton at quipo dot it
It might be the case that the bug isn't in SplHeap::next() after all, that's just the way I experienced it. This might be a dupe of 

http://bugs.php.net/bug.php?id=44226
 [2008-04-02 09:40 UTC] jani@php.net
Same as bug #44226

 [2008-04-17 10:23 UTC] dmitry@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Mon Apr 28 11:01:30 2025 UTC