|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #26945 dl() defining classes, segfault shutdown-sequence
Submitted: 2004-01-17 10:22 UTC Modified: 2004-02-11 12:05 UTC
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: mep_eisen at web dot de Assigned:
Status: Wont fix Package: Reproducible crash
PHP Version: 5CVS OS: Linux
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2004-01-17 10:22 UTC] mep_eisen at web dot de
I got a segfault writing my own extension. Searching for any solutions I found a post in php.internals from Ilia Alshanetsky <> at 2004/01/09 06:11.

If you load an extension using function dl() and leave some undeleted objects at the end of script, php seems to crash. (see code from Ilia below...)

To reproduce the problem you need to compile the extension as shared object. I used the client sapi executable "php" of php5.0.0b3 and php5-200401171030.

Reproduce code:
this code crashes
$a = new date();

this code does not crash
$a = new date();
$a = null;

Expected result:
The global objects should be destroyed before there class definitions are unloaded.

Actual result:
segfault in
        ZEND_OBJ_HT_P(zvalue)->del_ref(zavlue TSRMLS_CC);

seems that the class definitions an extension defines are lost (the extension is unloaded) before the created variables are destroyed. object_handlers table is destroyed. If you set your object to null inside php script or if you destroy all public variables inside module shutdown sequence it works fine...

works fine.

code block from php_request_shutdown() (main.c:1216)

        if (PG(modules_activated)) {
                zend_deactivate_modules(TSRMLS_C);   // modules are unloaded
        zend_deactivate(TSRMLS_C); // variables are destroyed inside here

(gdb) frame 7
#7  0x081a53ba in main (argc=2, argv=0xbffff374) at /home/mepeisen/projects/php/php-5.0.0b3/sapi/cli/php_cli.c:1013
(gdb) frame 6
#6  0x0813e920 in php_request_shutdown (dummy=0x0) at /home/mepeisen/projects/php/php-5.0.0b3/main/main.c:1246
(gdb) frame 5
#5  0x08173510 in zend_deactivate () at /home/mepeisen/projects/php/php-5.0.0b3/Zend/zend.c:810
(gdb) frame 4
#4  0x0816a64e in shutdown_executor () at /home/mepeisen/projects/php/php-5.0.0b3/Zend/zend_execute_API.c:210
(gdb) frame 3
#3  0x0817a019 in zend_hash_graceful_reverse_destroy (ht=0x81f7e30) at /home/mepeisen/projects/php/php-5.0.0b3/Zend/zend_hash.c:634
(gdb) frame 2
#2  0x08179f59 in zend_hash_apply_deleter (ht=0x81f7e30, p=0x40384be4) at /home/mepeisen/projects/php/php-5.0.0b3/Zend/zend_hash.c:568
(gdb) frame 1
#1  0x0816a9a9 in _zval_ptr_dtor (zval_ptr=0x40384bf0) at /home/mepeisen/projects/php/php-5.0.0b3/Zend/zend_execute_API.c:354
(gdb) frame 0
#0  0x08172138 in _zval_dtor (zvalue=0x40383d7c) at /home/mepeisen/projects/php/php-5.0.0b3/Zend/zend_variables.c:61


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2004-01-27 07:08 UTC] mep_eisen at web dot de
what about it? Does anyone care about this crash?
 [2004-02-04 20:57 UTC]
<Zeev> dl() is evil, don't use it.

(not direct quote, but close enough :)

 [2004-02-11 12:05 UTC]
And now dl() is deprecated and declared unmaintained too.
Just use extension= in php.ini.
(see also discussion on

PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Mon Feb 26 07:01:28 2024 UTC