php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #44546 crash with SplHeap::next()
Submitted: 2008-03-27 10:56 UTC Modified: 2008-04-17 10:23 UTC
From: l dot alberton at quipo dot it Assigned: dmitry (profile)
Status: Closed Package: SPL related
PHP Version: 5.3CVS-2008-03-27 (snap) OS: Windows
Private report: No CVE-ID: None
 [2008-03-27 10:56 UTC] l dot alberton at quipo dot it
Description:
------------
I was trying the latest SPL features, but every time I call the next() method of a SplHeap object (SplMaxHeap, SplMinHeap, SplPriorityQueue), I get a crash.

Reproduce code:
---------------
$heap = new SplMaxHeap();
$heap->insert('a');
$heap->insert('b');
$heap->insert('c');

$heap->rewind();

echo $heap->current();

$heap->next(); //crash

echo $heap->current();


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2008-03-27 12:56 UTC] johannes@php.net
Please try using this CVS snapshot:

  http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows (zip):
 
  http://snaps.php.net/win32/php5.3-win32-latest.zip

For Windows (installer):

  http://snaps.php.net/win32/php5.3-win32-installer-latest.msi

I get, as expected, "cb" as a outpout, please make sure your PHP is up to date and describe what "crash" means.
 [2008-03-27 15:22 UTC] l dot alberton at quipo dot it
I'm using the latest snapshot. 

Etienne told me it works with Linux, but I can consistently reproduce this bug on windows (I already experienced it in the 19/03 snapshot and ever since, haven't checked before).


This is the error message in the Apache error.log file:


[notice] Parent: child process exited with status 3221225477 -- Restarting.
[notice] Apache/2.2.4 (Win32) PHP/5.3.0-dev configured -- resuming normal operations
 [2008-03-27 16:58 UTC] l dot alberton at quipo dot it
Entry point   msvcrt!_endthreadex+3a 
Create time   27/03/2008 17.28.46 
Time spent in user mode   0 Days 0:0:0.15 
Time spent in kernel mode   0 Days 0:0:0.31 






Function     Arg 1     Arg 2     Arg 3   Source 
0x00000000     06050040     05a2e398     05f5eea9    
php5ts!execute+21e     05f5ec98     05a2e398     00000000    
php5ts!zend_execute_scripts+107     00000008     05a2e398     00000000    
php5ts!php_execute_script+222     056ffe74     05a2e398     00000005    
php5apache2_2!php_handler+5d0     05a2b560     006db248     05a2b560    
libhttpd!ap_run_handler+21     05a2b560     05a2b560     05a2b560    
libhttpd!ap_invoke_handler+ae     00000000     05a24168     056fff38    
libhttpd!ap_die+24e     05a2b560     00000000     00692170    
libhttpd!ap_get_request_note+1c6c     05a24168     05a24168     05a24168    
libhttpd!ap_run_process_connection+21     05a24168     006ec2c0     056fff80    
libhttpd!ap_process_connection+33     05a24168     0596b330     7c92849f    
libhttpd!ap_regkey_value_remove+c0c     05a24160     7c92849f     00d50648    
msvcrt!_endthreadex+a9     00fff9e8     7c92849f     00d50648    
kernel32!BaseThreadStart+37     77c0a341     00fff9e8     00000000    




In httpd__PID__4704__Date__03_27_2008__Time_05_41_03PM__406__First chance exception 0XC0000005.dmp the module C:\PHP\php5ts.dll has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000000 on thread 247

Module Information 
Image Name: C:\PHP\php5ts.dll   Symbol Type:  PDB 
Base address: 0x00770000   Time Stamp:  Thu Mar 27 13:17:55 2008  
Checksum: 0x00000000   Comments:   
COM DLL: False   Company Name:  The PHP Group 
ISAPIExtension: False   File Description:  PHP Script Interpreter 
ISAPIFilter: False   File Version:  5.3.0-dev 
Managed DLL: False   Internal Name:  PHP Script Interpreter 
VB DLL: False   Legal Copyright:  Copyright ? 1997-2008 The PHP Group 
Loaded Image Name:  php5ts.dll   Legal Trademarks:  PHP 
Mapped Image Name:  C:\PHP\php5ts.dll   Original filename:  php5ts.dll 
Module name:  php5ts   Private Build:   
Single Threaded:  False   Product Name:  PHP 
Module Size:  5,07 MBytes   Product Version:  5.3.0-dev 
Symbol File Name:  C:\PHP\debugpack\php5ts.pdb   Special Build:  &
 [2008-03-27 17:00 UTC] l dot alberton at quipo dot it
BTW: I don't get a crash when running the script from the command line, but Apache crashes when running it in a web browser
 [2008-03-27 18:41 UTC] colder@php.net
Doesn't look in any way related to spl heaps....

Seems like the build is somehow broken
 [2008-03-27 18:47 UTC] l dot alberton at quipo dot it
I have no idea. Nevertheless, that's the way I experienced the crash, and without calling next() everything was fine.
 [2008-03-28 11:30 UTC] l dot alberton at quipo dot it
I think I have a better reproducing script:

=================================

$pqueue = new SplPriorityQueue();
$pqueue->insert('a', 1);
$pqueue->insert('b', 2);

try {
    echo $pqueue->extract();
    echo $pqueue->extract();
    echo $pqueue->extract();
} catch (RuntimeException $e) {
    echo "\nERROR: ".$e->getMessage();
}

=================================

Here, I insert 2 elements in the queue, and try to extract 3 elements.
The last extract() call should trigger a RuntimeException, and this is the case when running the script from the command line. When running it in a web browser, Apache crashes.

HTH
 [2008-03-28 16:06 UTC] colder@php.net
Your build/snapshot appears to be broken, I can't find anyone except you that can reproduce it under windows.

Please try to run the complete test suite so you can see whether you find other crashes....
 [2008-03-29 06:25 UTC] l dot alberton at quipo dot it
It might be the case that the bug isn't in SplHeap::next() after all, that's just the way I experienced it. This might be a dupe of 

http://bugs.php.net/bug.php?id=44226
 [2008-04-02 09:40 UTC] jani@php.net
Same as bug #44226

 [2008-04-17 10:23 UTC] dmitry@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Apr 28 02:01:30 2024 UTC