php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #47870 array() returns NULL (works in PHP_5_2!)
Submitted: 2009-04-01 23:20 UTC Modified: 2009-04-27 11:46 UTC
From: mbeccati@php.net Assigned:
Status: Closed Package: Arrays related
PHP Version: 5.3CVS-2009-04-01 (CVS) OS: FreeBSD 6.2
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: mbeccati@php.net
New email:
PHP Version: OS:

 

 [2009-04-01 23:20 UTC] mbeccati@php.net
Description:
------------
Again, another bug happening in a unit test of OpenX. The problem always happens in the same test at the same point. What happens is that a simple array() call is returning NULL on my FreeBSD system. The same test generates a segmentation fault when run on our Linux based continuous integration system.

Unfortunately I can't create a self-contained test case, but I can provide access to the system or more data.

I will also attach a backtrace of the core dump (which might even not be happening at the same place as the FreeBSD failure).

Reproduce code:
---------------
$ids = array();
echo 'On FreeBSD: ';
var_dump($ids);

Expected result:
----------------
On FreeBSD: Array ()

Actual result:
--------------
On FreeBSD: NULL

Backtrace (Linux):

Program terminated with signal 11, Segmentation fault.
(gdb) bt full
#0  ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (execute_data=0x2aaaaecf02d8) at /usr/local/src/php-5.3.0RC1/Zend/zend_execute.c:664
        opline = (zend_op *) 0x12eb418
        free_op2 = {var = 0x273c0d0}
        value = (zval *) 0x1
        variable_ptr_ptr = (zval **) 0x2a0e848
#1  0x00000000007242fb in execute (op_array=0x10fdf40) at /usr/local/src/php-5.3.0RC1/Zend/zend_vm_execute.h:104
        ret = <value optimized out>
        execute_data = (zend_execute_data *) 0x2aaaaecf02d8
        nested = 1 '\001'
        original_in_execution = 0 '\0'
#2  0x0000000000701306 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/src/php-5.3.0RC1/Zend/zend.c:1188
        files = {{gp_offset = 40, fp_offset = 73, overflow_arg_area = 0x7fffbdf97f10, reg_save_area = 0x7fffbdf97e20}}
        i = 1
        file_handle = (zend_file_handle *) 0x7fffbdf9a3e0
        orig_op_array = (zend_op_array *) 0x0
        orig_retval_ptr_ptr = (zval **) 0x0
#3  0x00000000006ae155 in php_execute_script (primary_file=0x7fffbdf9a3e0) at /usr/local/src/php-5.3.0RC1/main/main.c:2157
        __orig_bailout = (jmp_buf *) 0x7fffbdf9a1c0
        __bailout = {{__jmpbuf = {15364672, 903771196811129754, 1, 0, 0, 0, 903771196811177402, 903720367174677233}, __mask_was_saved = 0, __saved_mask = {__val = {48, 7, 15372768, 9416, 216135044429,
        17634384, 229440404087961, 48, 7403025, 15235744, 0, 206158430215, 140736380641392, 17634352, 17634352, 140736380641392}}}}
        prepend_file_p = (zend_file_handle *) 0x0
        append_file_p = (zend_file_handle *) 0x8
        prepend_file = {type = ZEND_HANDLE_FILENAME, filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0,
        old_handle = 0x0, old_closer = 0}, reader = 0, fsizer = 0, closer = 0}}, free_filename = 0 '\0'}
        append_file = {type = ZEND_HANDLE_FILENAME, filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0,
        old_handle = 0x0, old_closer = 0}, reader = 0, fsizer = 0, closer = 0}}, free_filename = 0 '\0'}
        old_cwd = 0x7fffbdf97f20 ""
        retval = 0
#4  0x000000000078bcee in main (argc=10, argv=0x7fffbdf9a658) at /usr/local/src/php-5.3.0RC1/sapi/cli/php_cli.c:1159
        __bailout = {{__jmpbuf = {216132590528, 903720367176127146, 0, 140736380642896, 110, 0, 903771196811129834, 903720367173477278}, __mask_was_saved = 0, __saved_mask = {__val = {140736380642608,
        140736380642416, 57, 112, 15369344, 15369328, 216135048496, 216138037600, 81, 140736380641952, 216135037715, 47, 96, 50, 216130423719, 15369344}}}}
        exit_status = 0
        c = <value optimized out>
        file_handle = {type = ZEND_HANDLE_MAPPED, filename = 0x7fffbdf9a935 "run.php", opened_path = 0x0, handle = {fd = 17477016, fp = 0x10aad98, stream = {handle = 0x10aad98, isatty = 0, mmap = {
        len = 5351, pos = 0, map = 0x2aaaaed69000, buf = 0x2aaaaed69000 "", old_handle = 0x10d10b0, old_closer = 0x715dd0 <zend_stream_stdio_closer>}, reader = 0x716390 <zend_stream_stdio_reader>,
      fsizer = 0x7162d0 <zend_stream_stdio_fsizer>, closer = 0x716320 <zend_stream_mmap_closer>}}, free_filename = 0 '\0'}
        behavior = 1
        reflection_what = 0x0
        orig_optind = 1
        orig_optarg = 0x0
        arg_free = 0x7fffbdf9a935 "run.php"
        arg_excp = <value optimized out>
        script_file = 0x7fffbdf9a935 "run.php"
        interactive = 0
        module_started = 1
        request_started = 1
        lineno = 1
        exec_direct = 0x0
        exec_run = 0x0
        exec_begin = 0x0
        exec_end = 0x0
        param_error = <value optimized out>
        hide_argv = 0
        ini_entries_len = <value optimized out>


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-04-02 00:36 UTC] mbeccati@php.net
matteo@phenom-ubuntu:~/OX-trunk/tests$ valgrind --tool=memcheck --num-callers=30 --log-file=php.log /usr/local/bin/php run.php --type=unit --level=file --layer=dal --folder=lib/OA/Dal/Maintenance --file=Priority_getZoneImpressionForecasts.dal.test.php --format=text --host=test Priority_getZoneImpressionForecasts.dal.test.php
Segmentation fault
matteo@phenom-ubuntu:~/OX-trunk/tests$ cat php.log
==11808== Memcheck, a memory error detector.
==11808== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==11808== Using LibVEX rev 1854, a library for dynamic binary translation.
==11808== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==11808== Using valgrind-3.3.1-Debian, a dynamic binary instrumentation framework.
==11808== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==11808== For more details, rerun with: -v
==11808== 
==11808== My PID = 11808, parent PID = 10101.  Prog and args are:
==11808==    /usr/local/bin/php
==11808==    run.php
==11808==    --type=unit
==11808==    --level=file
==11808==    --layer=dal
==11808==    --folder=lib/OA/Dal/Maintenance
==11808==    --file=Priority_getZoneImpressionForecasts.dal.test.php
==11808==    --format=text
==11808==    --host=test
==11808==    Priority_getZoneImpressionForecasts.dal.test.php
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF79D: _zval_ptr_dtor (zend_execute_API.c:430)
==11808==    by 0x824537: zend_hash_clean (zend_hash.c:552)
==11808==    by 0x849231: zend_leave_helper_SPEC (zend_vm_execute.h:208)
==11808==    by 0x8DC019: ZEND_RETURN_SPEC_CV_HANDLER (zend_vm_execute.h:22098)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF861: _zval_ptr_dtor (zend_execute_API.c:441)
==11808==    by 0x824537: zend_hash_clean (zend_hash.c:552)
==11808==    by 0x849231: zend_leave_helper_SPEC (zend_vm_execute.h:208)
==11808==    by 0x8DC019: ZEND_RETURN_SPEC_CV_HANDLER (zend_vm_execute.h:22098)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881939: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881991: zend_assign_to_variable (zend_execute.c:669)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881A77: zend_assign_to_variable (zend_execute.c:684)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881939: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8EF8A8: ZEND_ASSIGN_SPEC_CV_TMP_HANDLER (zend_vm_execute.h:25711)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881991: zend_assign_to_variable (zend_execute.c:669)
==11808==    by 0x8EF8A8: ZEND_ASSIGN_SPEC_CV_TMP_HANDLER (zend_vm_execute.h:25711)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881A77: zend_assign_to_variable (zend_execute.c:684)
==11808==    by 0x8EF8A8: ZEND_ASSIGN_SPEC_CV_TMP_HANDLER (zend_vm_execute.h:25711)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881939: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8E6422: ZEND_ASSIGN_SPEC_CV_CONST_HANDLER (zend_vm_execute.h:24065)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881991: zend_assign_to_variable (zend_execute.c:669)
==11808==    by 0x8E6422: ZEND_ASSIGN_SPEC_CV_CONST_HANDLER (zend_vm_execute.h:24065)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x881A77: zend_assign_to_variable (zend_execute.c:684)
==11808==    by 0x8E6422: ZEND_ASSIGN_SPEC_CV_CONST_HANDLER (zend_vm_execute.h:24065)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF79D: _zval_ptr_dtor (zend_execute_API.c:430)
==11808==    by 0x845F0A: zend_assign_to_variable_reference (zend_execute.c:410)
==11808==    by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27405)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF861: _zval_ptr_dtor (zend_execute_API.c:441)
==11808==    by 0x845F0A: zend_assign_to_variable_reference (zend_execute.c:410)
==11808==    by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27405)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF893: _zval_ptr_dtor (zend_gc.h:182)
==11808==    by 0x845F0A: zend_assign_to_variable_reference (zend_execute.c:410)
==11808==    by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27405)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x7FF89F: _zval_ptr_dtor (zend_gc.h:182)
==11808==    by 0x845F0A: zend_assign_to_variable_reference (zend_execute.c:410)
==11808==    by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27405)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Conditional jump or move depends on uninitialised value(s)
==11808==    at 0x8818D4: zend_assign_to_variable (zend_execute.c:657)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Use of uninitialised value of size 8
==11808==    at 0x881933: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== Process terminating with default action of signal 11 (SIGSEGV)
==11808==  Bad permissions for mapped region at address 0x8000015
==11808==    at 0x881933: zend_assign_to_variable (zend_execute.c:664)
==11808==    by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:27359)
==11808==    by 0x848774: execute (zend_vm_execute.h:104)
==11808==    by 0x814198: zend_execute_scripts (zend.c:1188)
==11808==    by 0x768884: php_execute_script (main.c:2157)
==11808==    by 0x9125CE: main (php_cli.c:1159)
==11808== 
==11808== ERROR SUMMARY: 42 errors from 17 contexts (suppressed: 18 from 2)
==11808== malloc/free: in use at exit: 29,165,534 bytes in 170,630 blocks.
==11808== malloc/free: 1,826,083 allocs, 1,655,453 frees, 157,087,187 bytes allocated.
==11808== For counts of detected errors, rerun with: -v
==11808== searching for pointers to 170,630 not-freed blocks.
==11808== checked 22,615,176 bytes.
==11808== 
==11808== LEAK SUMMARY:
==11808==    definitely lost: 388 bytes in 14 blocks.
==11808==      possibly lost: 0 bytes in 0 blocks.
==11808==    still reachable: 29,165,146 bytes in 170,616 blocks.
==11808==         suppressed: 0 bytes in 0 blocks.
==11808== Rerun with --leak-check=full to see details of leaked memory.

 [2009-04-02 09:11 UTC] mbeccati@php.net
I've tried to reduce the affected test to a smaller test case with no luck. As soon as I remove something from it. It suddenly starts to pass with no segfault.
 [2009-04-06 12:59 UTC] jani@php.net
Can you reproduce this with PHP_5_2 branch?
 [2009-04-06 13:05 UTC] mbeccati@php.net
Nope. Latest 5.1 and 5.2 work perfectly fine.
 [2009-04-26 15:43 UTC] jani@php.net
Try latest CVS just in case that GCC optimizer bugfix was the cause for 
this bug as well.
 [2009-04-27 11:46 UTC] mbeccati@php.net
Retested with latest CVS. Looks like the GCC optimizer bugfix also fixed this issue. Well done!
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed May 14 03:01:27 2025 UTC