PHP :: Bug #47730 :: Crash when errorHandler throws Exception (GCC 4.3 optimizer bug..?)

Bug #47730

Crash when errorHandler throws Exception (GCC 4.3 optimizer bug..?)

Submitted:

2009-03-20 13:04 UTC

Modified:

2009-09-12 14:25 UTC

Votes:	14
Avg. Score:	4.7 ± 0.6
Reproduced:	7 of 8 (87.5%)
Same Version:	6 (85.7%)
Same OS:	5 (71.4%)

From:

berblinger at krumedia dot de

Assigned:

Status:

Not a bug

Package:

Reproducible crash

PHP Version:

5.2.9

OS:

Linux

Private report:

CVE-ID:

None

View Add Comment Developer Edit

[2009-03-20 13:04 UTC] berblinger at krumedia dot de

Description:
------------
Looks like this bug is related to the fixed bug #45805 in PHP version 5.2.8.

php still crashes, when the source of the defective expression is called within a function-call. See reproduce code and comments inside for further details.

Reproduce code:
---------------
<?php
function errorHandler($errno, $errstr, $errfile, $errline){
		throw new Exception('test');	
}
set_error_handler('errorHandler');
error_reporting( E_ALL | E_STRICT);
class Foo{
	private $crashHelper = null;
	public function test(){
		$bar = new Bar;
		/* Crashes */
		//$bar->someFunction($this->crashHelper->notDefined);
		
		/* this works */
		$tmp = $this->crashHelper->notDefined;
		$bar->someFunction($tmp);
	}
}

class Bar{
	public function someFunction($tmp){	}
}

$foo = new Foo;
$foo->test();
?>

Expected result:
----------------
Fatal error: Uncaught exception 'Exception' with message 'test' [...] thrown in /htdocs/test/pub/eerrorHandlerTest.php on line 3

Actual result:
--------------
nothing. php crashes.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports

[2009-03-20 16:52 UTC] berblinger at krumedia dot de

generated backtrace, i hope this will help you finding a proper solution for this bug.

#0  zend_do_fcall_common_helper_SPEC (execute_data=0x7fff88d8dd20, 
tsrm_ls=0x1051090) at /software/php-5.2.9/Zend/zend_vm_execute.h:289
#1  0x0000000000767097 in execute (op_array=0x12abef0, 
tsrm_ls=0x1051090) at /software/php-5.2.9/Zend/zend_vm_execute.h:92
#2  0x000000000073f2e2 in zend_execute_scripts (type=8, 
tsrm_ls=0x1051090, retval=<value optimized out>, file_count=3) at 
/software/php-5.2.9/Zend/zend.c:1134
#3  0x00000000006f20d6 in php_execute_script 
(primary_file=0x7fff88d90400, tsrm_ls=0x1051090) at 
/software/php-5.2.9/main/main.c:2023
#4  0x00000000007bdd37 in main (argc=2, argv=0x7fff88d905e8) at 
/software/php-5.2.9/sapi/cli/php_cli.c:1133

[2009-03-21 00:40 UTC] felipe@php.net

I can't reproduce it on Linux 32-bit.

[2009-03-21 11:03 UTC] berblinger at krumedia dot de

It seems, that this crash is only reproducible under a Linux 64bit environment. I just tried to reproduce it using Vista x64 and PHP 5.2.9, but everything worked fine.

Can i provide any further informations to help you fixing this problem? Please tell me, if there's anything i could do.

[2009-03-21 23:07 UTC] jani@php.net

I can't reproduce it on Linux 64-bit. Can you reproduce this on some 
other machine with same OS?

[2009-03-21 23:08 UTC] jani@php.net

Also, what was the configure line used to compile PHP?

[2009-03-22 12:07 UTC] berblinger at krumedia dot de

Configure Command
'./configure' '--with-apxs2=/usr/bin/apxs2' 
'--with-mysql=/usr/local/mysql' '--enable-soap' '--enable-bcmath' 
'--enable-ftp' '--with-gd' '--with-jpeg-dir=/usr/lib' 
'--with-xpm-dir=/usr/lib' '--with-freetype-dir=/usr/lib' 
'--with-t1lib=/usr/lib' '--with-ttf' '--enable-shmop' '--enable-sockets' 
'--enable-zip' '--with-zlib' '--with-mcrypt' '--enable-mbstring'

The testing environment is running under Debian 5.0, (AMD 64bit core).
I will test if the source will crash on another machine the next week, please be patient. I will provide any results as soon as possible.

[2009-03-23 11:58 UTC] berblinger at krumedia dot de

i just tested the Segmentation Fault error on another machine with similar hardware and OS, the result was the same. 
-> Segmentation fault caused.

# cat debian_version
5.0
# uname -a
Linux testserver.local 2.6.26-1-amd64 #1 SMP Sat Jan 10 17:57:00 UTC 2009 
x86_64 GNU/Linux

# php -v
PHP 5.2.9 (cli) (built: Mar 10 2009 04:26:53)
Copyright (c) 1997-2009 The PHP Group

Both servers are configured exactly with the same configure command.

[2009-03-23 15:27 UTC] scottmac@php.net

I can't reproduce this with 5.2.9 / 5.2.10-dev, can you try a build with everything disabled. Also make sure all third party modules are disabled like XCache.

./configure --disable-all

# uname -a
Linux whisky 2.6.18-xen #1 SMP Tue Feb 12 06:40:50 UTC 2008 x86_64 GNU/Linux

# file sapi/cli/php
sapi/cli/php: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.8, not stripped

# sapi/cli/php -v
PHP 5.2.9 (cli) (built: Mar 23 2009 14:13:12) (DEBUG)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2009 Zend Technologies

[2009-03-23 15:51 UTC] tombt081981 at hotmail dot com

I first just disabled XCache

=> still seg fault , so XCache can't be the reason

Then i re-compiled with ./configure --disable-all

=> still seg fault


# php -i
System => myhostname 2.6.26-1-amd64 #1 SMP Sat Jan 10 17:57:00 UTC 2009 x86_64
Build Date => Mar 23 2009 16:43:14
Configure Command =>  './configure'  '--disable-all'
Server API => Command Line Interface
Virtual Directory Support => disabled
Configuration File (php.ini) Path => /usr/local/lib
Loaded Configuration File => /usr/local/lib/php-cli.ini
Scan this dir for additional .ini files => (none)
additional .ini files parsed => (none)
PHP API => 20041225
PHP Extension => 20060613
Zend Extension => 220060519
Debug Build => no
Thread Safety => disabled
Zend Memory Manager => enabled
IPv6 Support => enabled
Registered PHP Streams => php, file, data, http, ftp
Registered Stream Socket Transports => tcp, udp, unix, udg
Registered Stream Filters => string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed

#...

[2009-03-25 11:32 UTC] berblinger at krumedia dot de

This segfault is also caused when any 3rd party modules are disabled.
As already said, we got several servers with very similar hardware and OS ( including configuration ) and each of them makes PHP crash with this snippet.

We recently upgraded from PHP 5.2.6 to PHP 5.2.9 and since this upgrade we noticed this segfault.

Can i provide any other informations for you to help you fixing this bug?

[2009-03-25 11:41 UTC] scottmac@php.net

Can you do

./configure --disable-all --enable-debug

And run the script through valgrind as well as through gdb.

If that fails then getting access to an account on the server might be the easiest solution.

[2009-03-25 14:03 UTC] tombt081981 at hotmail dot com

This information might help:

I got the bug with php 5.2.9 and(!) php 5.2.6 after(!) an upgrade to Bebian lenny 5.0. Before (debian 4) it worked fine, so this got to do something with Debian 5 and not especially with php 5.2.9.

[2009-03-26 16:04 UTC] berblinger at krumedia dot de

I could manage to get you an account on a newly set up server, configured with nothing else that debian 5.0, PHP 5.2.9 and no other third party php extention for a maximum of 2 days on the upcoming friday.

We just got two new servers at our computer center. Please tell me if you can take a look at the weekend (friday till sunday maximum) and how i should provide the account informations to you. Thanks in advance.

[2009-03-26 16:17 UTC] scottmac@php.net

You can just drop me an email with the details.

My public key is at http://whisky.macvicar.net/scott-public-key.txt

[2009-03-31 16:19 UTC] mk at krumedia dot de

Scott, do you have any results or patches, already?

[2009-03-31 17:16 UTC] scottmac@php.net

This is a bug in the GCC 4.3 optimizer, A -O1 build works fine but a -O2 fails.

Gentoo have an open bug for this http://bugs.gentoo.org/234177

The test that fails is Zend/tests/bug31177.phpt

Maybe someone else with a better understanding of the optimizer can look at this.

[2009-09-12 14:25 UTC] jani@php.net

Works fine with GCC 4.1.2 even with -O3. Since optimizer bugs in 
compilers are not bugs in PHP -> bogus.

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Thu May 09 05:01:31 2024 UTC