|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2010-08-31 20:43 UTC] paulgao at yeah dot net
Description: ------------ sometimes, PHP was core dump, error message is 'Program terminated with signal 7, Bus error.'. Test script: --------------- I don't know code. Actual result: -------------- gdb backtrace message: #0 0x00000000007e9179 in lex_scan (zendlval=0x7fffe9900bd8) at Zend/zend_language_scanner.l:1635 #1 0x0000000000814517 in zendlex (zendlval=0x7fffe9900bd0) at /root/php-5.3.3/Zend/zend_compile.c:4946 #2 0x00000000007e2700 in zendparse () at /root/php-5.3.3/Zend/zend_language_parser.c:3280 #3 0x00000000007e817c in compile_file (file_handle=0x7fffe9901fc0, type=2) at Zend/zend_language_scanner.l:354 #4 0x00000000004c5bd8 in my_compile_file (h=0x7fffe9901fc0, type=2) at /root/php-5.3.3/ext/apc/apc_main.c:541 #5 0x00000000007e82f3 in compile_filename (type=2, filename=0x4ce0440) at Zend/zend_language_scanner.l:397 #6 0x000000000087ee91 in ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER (execute_data=0x2ac39df370f0) at /root/php-5.3.3/Zend/zend_vm_execute.h:8569 #7 0x000000000085a9f3 in execute (op_array=0x3e1cd80) at /root/php-5.3.3/Zend/zend_vm_execute.h:107 #8 0x000000000082a2d7 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/php-5.3.3/Zend/zend.c:1194 #9 0x00000000007b44cb in php_execute_script (primary_file=0x7fffe9906920) at /root/php-5.3.3/main/main.c:2260 #10 0x000000000091deae in main (argc=3, argv=0x7fffe9906b28) at /root/php-5.3.3/sapi/fpm/fpm/fpm_main.c:1865 PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Oct 27 17:00:01 2025 UTC |
<?php file_put_contents(__DIR__ . '/test.tpl', 'AAA<?php $string = "'. str_repeat('A', mt_rand(1, 256 * 1024)) .'"; ?>BBB' . "\r\n", LOCK_EX); require_once __DIR__ . '/test.tpl'; ?> please use “ab -n 200 -n 20 http://localhost/test.php“ to test it.Same here. Apache doesn't matter, I've get this SIGBUS couple times a day. With APC or xcache different versions,latest - all the same. PHP is stock Debian: PHP 5.3.3-7+squeeze3 with Suhosin-Patch (cli) (built: Jun 28 2011 13:13:26) Using fastcgi SAPI with pretty large PHP application (thousands of files). I'll try to make it reproducible. # gdb /usr/lib/cgi-bin/php5-fcgi ./3002.php5-fcgi.7.9143 [...] Program terminated with signal 7, Bus error. #0 lex_scan (zendlval=0xbfffa2ec) at /build/buildd-php5_5.3.3-7+squeeze3-i386-H_HNTR/php5-5.3.3/Zend/zend_language_scanner.c:940 940 yych = *YYCURSOR; (gdb) l 935 0, 0, 0, 0, 0, 0, 0, 0, 936 }; 937 938 YYDEBUG(0, *YYCURSOR); 939 YYFILL(8); 940 yych = *YYCURSOR; 941 if (yych != '<') goto yy4; 942 YYDEBUG(2, *YYCURSOR); 943 yyaccept = 0; 944 yych = *(YYMARKER = ++YYCURSOR); (gdb) p language_scanner_globals.yy_cursor $1 = (unsigned char *) 0xb77c1000 <Address 0xb77c1000 out of bounds> (gdb) inf target Symbols from "/usr/lib/cgi-bin/php5-fcgi". Local core dump file: `/var/tmp/./3002.php5-fcgi.7.9143', file type elf32-i386. [...] 0xb7759000 - 0xb7781000 is load52 0xb77c1000 - 0xb77c1000 is load53 0xb77c2000 - 0xb77c5000 is load54 [...]Test case: # cat test3.php <?php if ($argv[1] > 0) { while ($argv[1]--) file_put_contents('test.tpl', "<?php #".str_repeat('A', mt_rand(4000, 5000))." ?>\n", LOCK_EX); } else { $p2 = popen("php test3.php 100", "r"); while (1) include 'test.tpl'; } ?> # php test3.php Bus error # php test3.php Bus error # php test3.php Bus error # php test3.php PHP Parse error: syntax error, unexpected $end, expecting T_VARIABLE or T_DOLLAR_OPEN_CURLY_BRACES or T_CURLY_OPEN in /var/tmp/test.tpl on line 1 Parse error: syntax error, unexpected $end, expecting T_VARIABLE or T_DOLLAR_OPEN_CURLY_BRACES or T_CURLY_OPEN in /var/tmp/test.tpl on line 1 In my case it's an application (Bitrix) to blame. Ugly code that frequently rewrites cached template in place, instead of creating new and renaming it.I believe I'm running into this exact same error. I'm new to PHP-FPM (v5.3.9) as well as GDB, so here's what I managed to pull from the "core dump" / gdb backtrace log: Core was generated by `php-fpm: pool www '. Program terminated with signal 7, Bus error. #0 lex_scan (zendlval=0x7fffbe65e368) at Zend/zend_language_scanner.l:1801 1801 if (*YYCURSOR == '\'') { AND #0 lex_scan (zendlval=0x7fffbe65e368) at Zend/zend_language_scanner.l:1801 #1 0x000000000076fe90 in zendlex (zendlval=0x7fffbe65e360) at /usr/src/install/php-5.3.9/Zend/zend_compile.c:4975 #2 0x00000000007598ae in zendparse () at /usr/src/install/php-5.3.9/Zend/zend_language_parser.c:3285 #3 0x0000000000765268 in compile_file (file_handle=0x7fffbe65e6e0, type=2) at Zend/zend_language_scanner.l:364 #4 0x00000000005ee40a in phar_compile_file (file_handle=<value optimized out>, type=<value optimized out>) at /usr/src/install/php-5.3.9/ext/phar/phar.c:3393 #5 0x00000000007b88ac in ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER (execute_data=0x31432a8) at /usr/src/install/php-5.3.9/Zend/zend_vm_execute.h:5234 #6 0x00000000007ad538 in execute (op_array=0x32c4900) at /usr/src/install/php-5.3.9/Zend/zend_vm_execute.h:107 #7 0x000000000078806a in zend_execute_scripts (type=8, retval=<value optimized out>, file_count=3) at /usr/src/install/php-5.3.9/Zend/zend.c:1236 #8 0x000000000073686d in php_execute_script (primary_file=<value optimized out>) at /usr/src/install/php-5.3.9/main/main.c:2308 #9 0x0000000000817545 in main (argc=<value optimized out>, argv=<value optimized out>) at /usr/src/install/php-5.3.9/sapi/fpm/fpm/fpm_main.c:1858 I'm running Ubuntu 10.10 (64-bit) -- Any ideas one what could be happening here or ways to address this moving forward?About the only way - disable use of mmap() on PHP code files. Need to patch and recompile. Something like this: --- main/main.c~ 2012-02-08 06:00:52.000000000 +0400 +++ main/main.c 2012-02-08 06:01:28.000000000 +0400 @@ -1229,7 +1229,7 @@ /* can we mmap immeadiately? */ memset(&handle->handle.stream.mmap, 0, sizeof(handle->handle.stream.mmap)); len = php_zend_stream_fsizer(stream TSRMLS_CC); - if (len != 0 + if (0 && len != 0 #if HAVE_MMAP && ((len - 1) % page_size) <= page_size - ZEND_MMAP_AHEAD #endifWe are experiencing the same thing: CentOS5, Nginx 1.1.12, PHP-FPM 5.3.10, (extensions APC 3.1.9 and memcache 2.2.6) Occasional SIGBUS, [26-Apr-2012 17:05:23] WARNING: [pool www] child 2562 exited on signal 7 (SIGBUS - core dumped) after 84.407806 seconds from start gdb core dump and backtrace: Core was generated by `php-fpm:'. Program terminated with signal 7, Bus error. #0 lex_scan (zendlval=0x7fffd5e9fde8) at Zend/zend_language_scanner.c:943 943 if (yych != '<') goto yy4; (gdb) bt #0 lex_scan (zendlval=0x7fffd5e9fde8) at Zend/zend_language_scanner.c:943 #1 0x0000000000591ee0 in zendlex (zendlval=0x7fffd5e9fde0) at /usr/src/debug/php-5.3.10/Zend/zend_compile.c:4975 #2 0x000000000057c6a6 in zendparse () at /usr/src/debug/php-5.3.10/Zend/zend_language_parser.c:3287 #3 0x0000000000587352 in compile_file (file_handle=0x7fffd5ea1360, type=<value optimized out>) at Zend/zend_language_scanner.l:364 #4 0x00007f02feaf344f in my_compile_file (h=0x7fffd5ea1360, type=8) at /usr/src/debug/php-pecl-apc-3.1.9/APC-3.1.9/apc_main.c:543 #5 0x00007f02f8b7f291 in phar_compile_file (file_handle=0x7fffd5ea1360, type=8) at /usr/src/debug/php-5.3.10/ext/phar/phar.c:3393 #6 0x0000000000586bde in compile_filename (type=8, filename=0x2a97418) at Zend/zend_language_scanner.l:407 #7 0x00000000005d8442 in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER ( execute_data=0x294c6a8) at /usr/src/debug/php-5.3.10/Zend/zend_vm_execute.h:22529 #8 0x00000000005d1770 in execute (op_array=0x2a43d58) at /usr/src/debug/php-5.3.10/Zend/zend_vm_execute.h:107 #9 0x00000000005a197a in zend_call_function (fci=0x7fffd5ea16f0, fci_cache=<value optimized out>) at /usr/src/debug/php-5.3.10/Zend/zend_execute_API.c:969 #10 0x00000000004f6e33 in zif_call_user_func (ht=<value optimized out>, return_value=0x2b39d68, return_value_ptr=<value optimized out>, this_ptr=<value optimized out>, return_value_used=<value optimized out>) at /usr/src/debug/php-5.3.10/ext/standard/basic_functions.c:4774 #11 0x00000000005fa0d8 in zend_do_fcall_common_helper_SPEC ( execute_data=<value optimized out>) at /usr/src/debug/php-5.3.10/Zend/zend_vm_execute.h:320 #12 0x00000000005d1770 in execute (op_array=0x2a64df8) at /usr/src/debug/php-5.3.10/Zend/zend_vm_execute.h:107 #13 0x00000000005ab2bd in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-5.3.10/Zend/zend.c:1236 #14 0x0000000000558558 in php_execute_script (primary_file=0x7fffd5ea3ea0) at /usr/src/debug/php-5.3.10/main/main.c:2308 #15 0x000000000063e269 in main (argc=44076704, argv=0x2a08bc0) at /usr/src/debug/php-5.3.10/sapi/fpm/fpm/fpm_main.c:1858This problem is wider than the report says! It's not just Centos 5 and 32bit. Tested with 5.3.19, 5.4.9 and trunk 201212191230 and got bus error. Suggested workaround by disabling mmap seems to work, so problem lies in mmap handling. Real fix/patch would be nice and really appreciated. 5.3.19: Core was generated by `sapi/cli/php test3.php'. Program terminated with signal 7, Bus error. #0 lex_scan (zendlval=<value optimized out>) at Zend/zend_language_scanner.l:1709 1709 switch (*YYCURSOR++) { (gdb) list 1704 } 1705 1706 1707 <ST_IN_SCRIPTING>"#"|"//" { 1708 while (YYCURSOR < YYLIMIT) { 1709 switch (*YYCURSOR++) { 1710 case '\r': 1711 if (*YYCURSOR == '\n') { 1712 YYCURSOR++; 1713 } #0 lex_scan (zendlval=<value optimized out>) at Zend/zend_language_scanner.l:1709 #1 0x0000000000636640 in zendlex (zendlval=0x7fff2476cb90) at /root/php-5.3.19/Zend/zend_compile.c:4975 #2 0x0000000000620e66 in zendparse () at /root/php-5.3.19/Zend/zend_language_parser.c:3285 #3 0x000000000062bb52 in compile_file (file_handle=0x7fff2476ce80, type=<value optimized out>) at Zend/zend_language_scanner.l:364 #4 0x00000000005362d1 in phar_compile_file (file_handle=0x7fff2476ce80, type=2) at /root/php-5.3.19/ext/phar/phar.c:3394 #5 0x000000000062b3de in compile_filename (type=2, filename=0x185ac58) at Zend/zend_language_scanner.l:407 #6 0x000000000067c63e in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER ( execute_data=0x7fe9b5916050) at /root/php-5.3.19/Zend/zend_vm_execute.h:1967 #7 0x0000000000675a30 in execute (op_array=0x184f358) at /root/php-5.3.19/Zend/zend_vm_execute.h:107 #8 0x000000000064f86f in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/php-5.3.19/Zend/zend.c:1259 #9 0x00000000005fcd67 in php_execute_script (primary_file=0x7fff24770780) at /root/php-5.3.19/main/main.c:2316 #10 0x00000000006da002 in main (argc=2, argv=0x7fff24770a18) at /root/php-5.3.19/sapi/cli/php_cli.c:1189 PHP 5.4.9: Core was generated by `sapi/cli/php test3.php'. Program terminated with signal 7, Bus error. #0 lex_scan (zendlval=<value optimized out>) at Zend/zend_language_scanner.l:1904 1904 switch (*YYCURSOR++) { (gdb) list 1899 } 1900 1901 1902 <ST_IN_SCRIPTING>"#"|"//" { 1903 while (YYCURSOR < YYLIMIT) { 1904 switch (*YYCURSOR++) { 1905 case '\r': 1906 if (*YYCURSOR == '\n') { 1907 YYCURSOR++; 1908 } (gdb) bt #0 lex_scan (zendlval=<value optimized out>) at Zend/zend_language_scanner.l:1904 #1 0x000000000063fd90 in zendlex (zendlval=0x7fff4739ebf0) at /root/php-5.4.9/Zend/zend_compile.c:6707 #2 0x0000000000628ba4 in zendparse () at /root/php-5.4.9/Zend/zend_language_parser.c:3430 #3 0x0000000000634d4d in compile_file (file_handle=0x7fff4739ef40, type=<value optimized out>) at Zend/zend_language_scanner.l:582 #4 0x0000000000539ae1 in phar_compile_file (file_handle=0x7fff4739ef40, type=2) at /root/php-5.4.9/ext/phar/phar.c:3388 #5 0x00000000006344ae in compile_filename (type=2, filename=0x7f66ed826d20) at Zend/zend_language_scanner.l:625 #6 0x00000000006acb6b in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER ( execute_data=0x7f66ed7ea060) at /root/php-5.4.9/Zend/zend_vm_execute.h:2608 #7 0x00000000006c98a0 in execute (op_array=0x7f66ed81f938) at /root/php-5.4.9/Zend/zend_vm_execute.h:410 #8 0x00000000006608cd in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/php-5.4.9/Zend/zend.c:1309 #9 0x0000000000603e27 in php_execute_script (primary_file=0x7fff473a2680) at /root/php-5.4.9/main/main.c:2482 #10 0x000000000070aeac in do_cli (argc=2, argv=0x7fff473a2a88) at /root/php-5.4.9/sapi/cli/php_cli.c:988 #11 0x000000000070b608 in main (argc=2, argv=0x7fff473a2a88) at /root/php-5.4.9/sapi/cli/php_cli.c:1364 trunk: Core was generated by `sapi/cli/php test3.php'. Program terminated with signal 7, Bus error. #0 lex_scan (zendlval=<value optimized out>) at Zend/zend_language_scanner.l:1917 1917 switch (*YYCURSOR++) { (gdb) list 1912 } 1913 1914 1915 <ST_IN_SCRIPTING>"#"|"//" { 1916 while (YYCURSOR < YYLIMIT) { 1917 switch (*YYCURSOR++) { 1918 case '\r': 1919 if (*YYCURSOR == '\n') { 1920 YYCURSOR++; 1921 } (gdb) bt #0 lex_scan (zendlval=<value optimized out>) at Zend/zend_language_scanner.l:1917 #1 0x0000000000641c30 in zendlex (zendlval=0x7fff34ca46c0) at /root/php-trunk-201212191230/Zend/zend_compile.c:6881 #2 0x000000000062a713 in zendparse () at /root/php-trunk-201212191230/Zend/zend_language_parser.c:3428 #3 0x0000000000636d75 in compile_file (file_handle=0x7fff34ca4a30, type=<value optimized out>) at Zend/zend_language_scanner.l:585 #4 0x000000000053a921 in phar_compile_file (file_handle=0x7fff34ca4a30, type=2) at /root/php-trunk-201212191230/ext/phar/phar.c:3388 #5 0x000000000063641e in compile_filename (type=2, filename=0x7f6444584978) at Zend/zend_language_scanner.l:628 #6 0x00000000006d48eb in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER ( execute_data=0x7f64445481e0) at /root/php-trunk-201212191230/Zend/zend_vm_execute.h:2695 #7 0x00000000006d4b40 in execute_ex (execute_data=0x7f64445481e0) at /root/php-trunk-201212191230/Zend/zend_vm_execute.h:356 #8 0x00000000006634d9 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/php-trunk-201212191230/Zend/zend.c:1309 #9 0x0000000000605ed9 in php_execute_script (primary_file=0x7fff34ca8180) at /root/php-trunk-201212191230/main/main.c:2468 #10 0x0000000000710d7c in do_cli (argc=2, argv=0x7fff34ca8588) at /root/php-trunk-201212191230/sapi/cli/php_cli.c:988 #11 0x00000000007114d8 in main (argc=2, argv=0x7fff34ca8588) at /root/php-trunk-201212191230/sapi/cli/php_cli.c:1364Oh and here's the backtraces for the production enviroment using PHP 5.3.3, APC 3.1.13 on CentOS 6 (x86_64). Backtrace have two options but still problem seems to be the same: Core was generated by `/usr/bin/php-cgi'. Program terminated with signal 7, Bus error. #0 lex_scan (zendlval=0x7fff2f98cf48) at Zend/zend_language_scanner.c:931 931 if (yych != '<') goto yy4; (gdb) list 926 }; 927 928 YYDEBUG(0, *YYCURSOR); 929 YYFILL(8); 930 yych = *YYCURSOR; 931 if (yych != '<') goto yy4; 932 YYDEBUG(2, *YYCURSOR); 933 yyaccept = 0; 934 yych = *(YYMARKER = ++YYCURSOR); 935 if (yych <= '?') { (gdb) bt #0 lex_scan (zendlval=0x7fff901eca58) at Zend/zend_language_scanner.c:931 #1 0x000000000058deb0 in zendlex (zendlval=0x7fff901eca50) at /usr/src/debug/php-5.3.3/Zend/zend_compile.c:4942 #2 0x00000000005786f7 in zendparse () at /usr/src/debug/php-5.3.3/Zend/zend_language_parser.c:3282 #3 0x0000000000583342 in compile_file (file_handle=0x7fff901edfe0, type=<value optimized out>) at Zend/zend_language_scanner.l:354 #4 0x00007f413988da8f in my_compile_file (h=0x7fff901edfe0, type=2) at /usr/src/debug/php-pecl-apc-3.1.13/APC-3.1.13/apc_main.c:532 #5 0x00007f4134c64721 in phar_compile_file (file_handle=0x7fff901edfe0, type=2) at /usr/src/debug/php-5.3.3/ext/phar/phar.c:3393 #6 0x00000000005d8148 in ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER ( execute_data=0x1263560) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:5179 #7 0x00000000005cc810 in execute (op_array=0x11f5ce0) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:107 #8 0x00000000005a6f4d in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-5.3.3/Zend/zend.c:1194 #9 0x00000000005551b8 in php_execute_script (primary_file=0x7fff901f07b0) at /usr/src/debug/php-5.3.3/main/main.c:2261 #10 0x000000000063081d in main (argc=1, argv=0x7fff901f29c8) at /usr/src/debug/php-5.3.3/sapi/cgi/cgi_main.c:2127 (gdb) bt #0 lex_scan (zendlval=0x7fffa8dc3898) at Zend/zend_language_scanner.c:931 #1 0x000000000058deb0 in zendlex (zendlval=0x7fffa8dc3890) at /usr/src/debug/php-5.3.3/Zend/zend_compile.c:4942 #2 0x00000000005786f7 in zendparse () at /usr/src/debug/php-5.3.3/Zend/zend_language_parser.c:3282 #3 0x0000000000583342 in compile_file (file_handle=0x7fffa8dc5340, type=<value optimized out>) at Zend/zend_language_scanner.l:354 #4 0x00007f55ee3c65b7 in apc_compile_cache_entry (key=0x7fffa8dc5170, h=0x7fffa8dc5340, type=2, t=<value optimized out>, op_array=0x7fffa8dc40b8, cache_entry=0x7fffa8dc40c0) at /usr/src/debug/php-pecl-apc-3.1.13/APC-3.1.13/apc_main.c:398 #5 0x00007f55ee3c6f9b in my_compile_file (h=0x7fffa8dc5340, type=2) at /usr/src/debug/php-pecl-apc-3.1.13/APC-3.1.13/apc_main.c:603 #6 0x00007f55e979d721 in phar_compile_file (file_handle=0x7fffa8dc5340, type=2) at /usr/src/debug/php-5.3.3/ext/phar/phar.c:3393 #7 0x00000000005d8148 in ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER ( execute_data=0x1e26370) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:5179 #8 0x00000000005cc810 in execute (op_array=0x1d187e0) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:107 #9 0x00000000005a6f4d in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-5.3.3/Zend/zend.c:1194 #10 0x00000000005551b8 in php_execute_script (primary_file=0x7fffa8dc7b10) at /usr/src/debug/php-5.3.3/main/main.c:2261 #11 0x000000000063081d in main (argc=1, argv=0x7fffa8dc9d28) at /usr/src/debug/php-5.3.3/sapi/cgi/cgi_main.c:2127Hi, After emailing to php-dev and fixing my code I've got rid of the error. Problem is that I've thought that PHP will handle concurrent stuff so I don't need to. My problem was having code that does something like this: fopen($fp,"file.php"); fputs($fp,"<?php /*code*/ ?>"); fclose($fp); And also in other parts of code to have: include("file.php"); Which caused sometimes the include have a broken file. I still think that crashing to broken file is not acceptable behavior, but I've understood that you can crash PHP by coding something wrong and PHP doesn't protect you or crash nicely. Which can be problem in hosted environment if not running basic PHP-CGI for every request. I think include/require documentation should have warning box saying something that you have to handle concurrent stuff and/or PHP can crash to broken PHP files without nice error. I think that might helped me. For the fix in my code was to change my writing to file: fopen($fp,"file.php.tmp.".getmypid()); fputs($fp,"<?php /*code*/ ?>"); fclose($fp); rename("file.php.tmp.".getmypid(),"file.php"); Pretty easy fix if you know that you have to do it or expect PHP to crash to broken files. Of course I can't say anything about the other crashes, but as the backtraces seem similar and the example code to used to crash PHP has similar problem might that help.I am still encountering this bug with PHP 5.5.9, using php5-fpm without opcache/APC. Backtrace: #0 lex_scan (zendlval=zendlval@entry=0x7fffefa33e58) at Zend/zend_language_scanner.c:2271 #1 0x00000000006d7772 in zendlex (zendlval=zendlval@entry=0x7fffefa33e50) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_compile.c:6749 #2 0x00000000006b2766 in zendparse () at /build/buildd/php5-5.5.9+dfsg/Zend/zend_language_parser.c:3438 #3 0x00000000006b7d18 in compile_file (file_handle=file_handle@entry=0x7fffefa36330, type=8) at Zend/zend_language_scanner.l:588 #4 0x00000000006dd4ea in dtrace_compile_file (file_handle=0x7fffefa36330, type=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_dtrace.c:40 #5 0x0000000000566674 in phar_compile_file (file_handle=<optimized out>, type=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/ext/phar/phar.c:3379 #6 0x000000000079cb9d in ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER (execute_data=0x7fc1d68e6688) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_vm_execute.h:7994 #7 0x00000000007173e8 in execute_ex (execute_data=0x7fc1d68e6688) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_vm_execute.h:363 #8 0x00000000006dd559 in dtrace_execute_ex (execute_data=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_dtrace.c:73 #9 0x000000000079d1bf in ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER (execute_data=0x7fc1d68e60f8) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_vm_execute.h:2748 #10 0x00000000007173e8 in execute_ex (execute_data=0x7fc1d68e60f8) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_vm_execute.h:363 #11 0x00000000006dd559 in dtrace_execute_ex (execute_data=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_dtrace.c:73 #12 0x00000000006eefe0 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /build/buildd/php5-5.5.9+dfsg/Zend/zend.c:1316 #13 0x000000000068eec5 in php_execute_script (primary_file=primary_file@entry=0x7fffefa38ad0) at /build/buildd/php5-5.5.9+dfsg/main/main.c:2506 #14 0x0000000000463b00 in main (argc=<optimized out>, argv=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/sapi/fpm/fpm/fpm_main.c:1933 Line 2271 is this switch statement: YYDEBUG(121, *YYCURSOR); YYFILL(16); yych = *YYCURSOR; YYDEBUG(-1, yych); 2271 switch (yych) { case 0x00: case 0x01: case 0x02: case 0x03: This bug is marked duplicate, but all of the references bugs also appear to be marked duplicate. The error does not happen on every request, but occurs several ten or so times a day on our webserver. The file being compiled is "/var/www/include/include.php", which is included on every request, so there does not appear to be anything special about the requests that are failing (usually it is just a GET request for a static page that's parsed through PHP).I can repro using the script provided by paulgao <?php file_put_contents(__DIR__ . '/test.tpl', 'AAA<?php $string = "'. str_repeat('A', mt_rand(1, 256 * 1024)) .'"; ?>BBB' . "\r\n"); require_once __DIR__ . '/test.tpl'; together with for ((n=0;n<100;n++)); do sapi/cli/php test.php & done A few of the PHP processes will trigger a SIGBUS. The issue here seems pretty clear. We are mmap()ing the file. While the file is mapped, it is modified, resulting in an effective ftruncate(). Here is what the man page for ftruncate() has to say on the topic: > If the effect of ftruncate() is to decrease the size of a shared memory object or memory mapped file and whole pages beyond the new end were previously mapped, then the whole pages beyond the new end shall be discarded. > > If the Memory Protection option is supported, references to discarded pages shall result in the generation of a SIGBUS signal; otherwise, the result of such references is undefined. This is precisely what we are observing here. I don't think there is any good way of fixing this short of dropping the mmap() and reading the file into memory instead (which we already do in the fallback code).If I run two copies of the script below at once it happens pretty much instantly. It's also reproducible under php7.1.5: <?php while(true) { file_put_contents(__DIR__ . '/test.tpl', 'AAA<?php $string = "'. str_repeat('A', mt_rand(1, 256 * 1024)) .'"; ?>BBB' . "\r\n"); require __DIR__ . '/test.tpl'; } * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=10, address=0x102a79000) * frame #0: 0x000000010037243f php`lex_scan + 996 frame #1: 0x0000000100388317 php`zendlex + 71 frame #2: 0x000000010036d737 php`zendparse + 207 frame #3: 0x0000000100371710 php`zend_compile + 103 frame #4: 0x0000000100371656 php`compile_file + 55 frame #5: 0x0000000100225d59 php`phar_compile_file + 267 frame #6: 0x00000001012b16c3 xdebug.so`xdebug_compile_file + 12 frame #7: 0x0000000100371899 php`compile_filename + 147 frame #8: 0x00000001004342da php`zend_include_or_eval + 260 frame #9: 0x00000001003fafe0 php`ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER + 40 frame #10: 0x00000001003e2569 php`execute_ex + 56 frame #11: 0x00000001012b1e7e xdebug.so`xdebug_execute_ex + 1927 frame #12: 0x00000001003e27c7 php`zend_execute + 537 frame #13: 0x00000001003a7415 php`zend_execute_scripts + 285 frame #14: 0x000000010034fded php`php_execute_script + 611 frame #15: 0x000000010043d3f1 php`do_cli + 3698 frame #16: 0x000000010043c3f4 php`main + 1195 frame #17: 0x00007fffbd01c515 libdyld.dylib`start + 1 frame #18: 0x00007fffbd01c515 libdyld.dylib`start + 1This patch seems to help in my case. diff -ruN php-5.6.30/Zend/zend_language_scanner.c php-5.6.30.patched/Zend/zend_language_scanner.c --- php-5.6.30/Zend/zend_language_scanner.c 2017-01-18 19:17:47.000000000 -0500 +++ php-5.6.30.patched/Zend/zend_language_scanner.c 2017-06-21 13:18:53.000000000 -0400 @@ -125,6 +125,14 @@ BEGIN_EXTERN_C() +#ifndef _WIN32 +static sigjmp_buf sigbus_jmpbuf; +static void sigbus_handler (int sig, siginfo_t *siginfo, void *ptr) +{ + siglongjmp(sigbus_jmpbuf, 1); +} +#endif + static size_t encoding_filter_script_to_internal(unsigned char **to, size_t *to_length, const unsigned char *from, size_t from_length TSRMLS_DC) { const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding(TSRMLS_C); @@ -580,6 +588,36 @@ } compilation_successful=0; } else { +#ifndef _WIN32 + struct sigaction sigbus_signal; + struct sigaction old_sigbus_signal; + + memset(&sigbus_signal, 0, sizeof(sigbus_signal)); + memset(&old_sigbus_signal, 0, sizeof(old_sigbus_signal)); + sigbus_signal.sa_sigaction = sigbus_handler; + sigbus_signal.sa_flags = SA_SIGINFO; +#endif + +#if defined(ZEND_SIGNALS) && !defined(_WIN32) + zend_try { zend_sigaction(SIGBUS, &sigbus_signal, &old_sigbus_signal TSRMLS_CC); } zend_end_try(); +#elif !defined(_WIN32) + sigaction(SIGBUS, &sigbus_signal, &old_sigbus_signal); +#endif + +#ifndef _WIN32 + if (sigsetjmp(sigbus_jmpbuf, 1)) { + if (file_handle->type != ZEND_HANDLE_STREAM) { + file_handle->type = ZEND_HANDLE_STREAM; + } + } +#endif + init_op_array(op_array, ZEND_USER_FUNCTION, INITIAL_OP_ARRAY_SIZE TSRMLS_CC); CG(in_compilation) = 1; CG(active_op_array) = op_array; @@ -592,6 +630,13 @@ zend_bailout(); } compilation_successful=1; + +#if defined(ZEND_SIGNALS) && !defined(_WIN32) + zend_try { zend_sigaction(SIGBUS, &old_sigbus_signal, 0 TSRMLS_CC); } zend_end_try(); +#elif !defined(_WIN32) + sigaction(SIGBUS, &old_sigbus_signal, 0); +#endif + } if (retval) { diff -ruN php-5.6.30/Zend/zend_language_scanner.l php-5.6.30.patched/Zend/zend_language_scanner.l --- php-5.6.30/Zend/zend_language_scanner.l 2017-01-18 19:17:47.000000000 -0500 +++ php-5.6.30.patched/Zend/zend_language_scanner.l 2017-06-21 13:18:38.000000000 -0400 @@ -123,6 +123,14 @@ BEGIN_EXTERN_C() +#ifndef _WIN32 +static sigjmp_buf sigbus_jmpbuf; +static void sigbus_handler (int sig, siginfo_t *siginfo, void *ptr) +{ + siglongjmp(sigbus_jmpbuf, 1); +} +#endif + static size_t encoding_filter_script_to_internal(unsigned char **to, size_t *to_length, const unsigned char *from, size_t from_length TSRMLS_DC) { const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding(TSRMLS_C); @@ -578,6 +586,34 @@ } compilation_successful=0; } else { +#ifndef _WIN32 + struct sigaction sigbus_signal; + struct sigaction old_sigbus_signal; + + memset(&sigbus_signal, 0, sizeof(sigbus_signal)); + memset(&old_sigbus_signal, 0, sizeof(old_sigbus_signal)); + sigbus_signal.sa_sigaction = sigbus_handler; + sigbus_signal.sa_flags = SA_SIGINFO; +#endif + +#if defined(ZEND_SIGNALS) && !defined(_WIN32) + zend_try { zend_sigaction(SIGBUS, &sigbus_signal, &old_sigbus_signal TSRMLS_CC); } zend_end_try(); +#elif !defined(_WIN32) + sigaction(SIGBUS, &sigbus_signal, &old_sigbus_signal); +#endif + +#ifndef _WIN32 + if (sigsetjmp(sigbus_jmpbuf, 1)) { + file_handle->type = ZEND_HANDLE_STREAM; + } +#endif + init_op_array(op_array, ZEND_USER_FUNCTION, INITIAL_OP_ARRAY_SIZE TSRMLS_CC); CG(in_compilation) = 1; CG(active_op_array) = op_array; @@ -590,6 +626,12 @@ zend_bailout(); } compilation_successful=1; + +#if defined(ZEND_SIGNALS) && !defined(_WIN32) + zend_try { zend_sigaction(SIGBUS, &old_sigbus_signal, 0 TSRMLS_CC); } zend_end_try(); +#elif !defined(_WIN32) + sigaction(SIGBUS, &old_sigbus_signal, 0); +#endif } if (retval) {