php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #61850 A werid abort occurred while restart apache
Submitted: 2012-04-25 13:10 UTC Modified: 2021-06-09 11:30 UTC
From: laruence@php.net Assigned: cmb (profile)
Status: Closed Package: memcached (PECL)
PHP Version: Irrelevant OS:
Private report: No CVE-ID: None
 [2012-04-25 13:10 UTC] laruence@php.net
Description:
------------
I use memcached-2.0.1 PHP 5.2.17 with apache 2.2.2

Apache/2.2.22 (Unix) mod_ssl/2.2.22 OpenSSL/1.0.0e PHP/5.2.17

An abort will occurred while you try to restart httpd by 
$httpd -k restart

error_log shows (plz also note the downmost weird thing): 
[Wed Apr 25 21:04:32 2012] [notice] SIGHUP received.  Attempting to restart
/******/php-5.2.17/Zend/zend_hash.c(808) : ht=0x2318c68 is already destroyed

backtrace:
#0  0x00007f3866d663a5 in __GI_raise (sig=6) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007f3866d69b0b in __GI_abort () at abort.c:92
#2  0x00007f3865f005f0 in _zend_is_inconsistent (ht=0x2318c68, 
file=0x7f38661d1b88 "/home/huixinchen/packages/php-5.2.17/Zend/zend_hash.c", 
    line=808) at /home/huixinchen/packages/php-5.2.17/Zend/zend_hash.c:67
#3  0x00007f3865f02c31 in _zend_hash_merge (target=0x23cd558, source=0x2318c68, 
pCopyConstructor=0x7f3865ef1f18 <zval_add_ref>, tmp=0x0, 
    size=8, overwrite=0, __zend_filename=0x7f38661ce560 
"/home/huixinchen/packages/php-5.2.17/Zend/zend_compile.c", __zend_lineno=2319)
    at /home/huixinchen/packages/php-5.2.17/Zend/zend_hash.c:808
#4  0x00007f3865eda0fa in zend_do_inheritance (ce=0x23cd4e0, 
parent_ce=0x2318bf0)
    at /home/huixinchen/packages/php-5.2.17/Zend/zend_compile.c:2319
#5  0x00007f3865efc950 in zend_register_internal_class_ex 
(class_entry=0x7fff64b8cd40, parent_ce=0x2318bf0, parent_name=0x0)
    at /home/huixinchen/packages/php-5.2.17/Zend/zend_API.c:2035
#6  0x00007f38618fb57a in zm_startup_memcached (type=1, module_number=71) at 
/home/huixinchen/packages/memcached-2.0.1/php_memcached.c:3823
#7  0x00007f3865efaa55 in zend_startup_module_ex (module=0x22614d0) at 
/home/huixinchen/packages/php-5.2.17/Zend/zend_API.c:1472
#8  0x00007f3865f0263e in zend_hash_apply (ht=0x7f38664b00a0, 
apply_func=0x7f3865efa861 <zend_startup_module_ex>)
    at /home/huixinchen/packages/php-5.2.17/Zend/zend_hash.c:674
#9  0x00007f3865efac17 in zend_startup_modules () at 
/home/huixinchen/packages/php-5.2.17/Zend/zend_API.c:1519
#10 0x00007f3865e929b8 in php_module_startup (sf=0x7f38664a77e0, 
additional_modules=0x7f38664a7be0, num_additional_modules=1)
    at /home/huixinchen/packages/php-5.2.17/main/main.c:1855
#11 0x00007f3865f7ec2e in php_apache2_startup (sapi_module=0x7f38664a77e0)
    at /home/huixinchen/packages/php-
5.2.17/sapi/apache2handler/sapi_apache2.c:320
#12 0x00007f3865f7eded in php_apache_server_startup (pconf=0x209f138, 
plog=0x20f1518, ptemp=0x20bd378, s=0x20a9990)
    at /home/huixinchen/packages/php-
5.2.17/sapi/apache2handler/sapi_apache2.c:428
#13 0x0000000000440e01 in ap_run_post_config (pconf=0x209f138, plog=0x20f1518, 
ptemp=0x20bd378, s=0x20a9990) at config.c:94
#14 0x000000000042cb6b in main (argc=3, argv=0x7fff64b8d398) at main.c:742


the weird thing is:  

(gdb) f 4
#4  0x00007f3865eda0fa in zend_do_inheritance (ce=0x23cd4e0, 
parent_ce=0x2318bf0)
    at /home/huixinchen/packages/php-5.2.17/Zend/zend_compile.c:2319
2319		zend_hash_merge(&ce->default_properties, &parent_ce-
>default_properties, zval_property_ctor(parent_ce, ce), NULL, sizeof(zval *), 
0);
(gdb) p *parent_ce
$1 = {type = -128 '\200', name = 0x231aef0 "", name_length = 16, parent = 
0x221b850, refcount = 0, constants_updated = 0 '\000', 
  ce_flags = 0, function_table = {nTableSize = 16, nTableMask = 15, 
nNumOfElements = 9, nNextFreeElement = 0, pInternalPointer = 0x2319700, 
    pListHead = 0x2319700, pListTail = 0x231a180, arBuckets = 0x231a2d0, 
pDestructor = 0x7f3865ee82f4 <zend_function_dtor>, 
    persistent = 1 '\001', nApplyCount = 0 '\000', bApplyProtection = 0 '\000', 
inconsistent = 2}, default_properties = {nTableSize = 8, 
    nTableMask = 7, nNumOfElements = 6, nNextFreeElement = 0, pInternalPointer = 
0x2319050, pListHead = 0x2319050, pListTail = 0x2319240, 
    arBuckets = 0x2317800, pDestructor = 0x7f3865ef223f 
<_zval_internal_ptr_dtor_wrapper>, persistent = 1 '\001', nApplyCount = 0 
'\000', 
    bApplyProtection = 0 '\000', inconsistent = 2}, properties_info = 
{nTableSize = 8, nTableMask = 7, nNumOfElements = 6, 
    nNextFreeElement = 0, pInternalPointer = 0x23192a0, pListHead = 0x23192a0, 
pListTail = 0x2319640, arBuckets = 0x2318eb0, 
    pDestructor = 0x7f3865ed288a <zend_destroy_property_info_internal>, 
persistent = 1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 2}, default_static_members = 
{nTableSize = 8, nTableMask = 7, nNumOfElements = 0, 
    nNextFreeElement = 0, pInternalPointer = 0x0, pListHead = 0x0, pListTail = 
0x0, arBuckets = 0x2318f00, 
    pDestructor = 0x7f3865ef223f <_zval_internal_ptr_dtor_wrapper>, persistent = 
1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 2}, static_members = 0x0, 
constants_table = {nTableSize = 8, nTableMask = 7, 
    nNumOfElements = 0, nNextFreeElement = 0, pInternalPointer = 0x0, pListHead 
= 0x0, pListTail = 0x0, arBuckets = 0x2318f50, 
    pDestructor = 0x7f3865ef223f <_zval_internal_ptr_dtor_wrapper>, persistent = 
1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 2}, builtin_functions = 0x0, 
constructor = 0x221be50, destructor = 0x0, clone = 0x221bd00, 
  __get = 0x0, __set = 0x0, __unset = 0x0, __isset = 0x0, __call = 0x0, 
__tostring = 0x221c780, serialize_func = 0x0, 
  unserialize_func = 0x0, iterator_funcs = {funcs = 0x0, zf_new_iterator = 
0x230c710, zf_valid = 0x7fff64b8cf60, 
    zf_current = 0x7f3865efeb75, zf_key = 0x1, zf_next = 0x0, zf_rewind = 0x0}, 
  create_object = 0x7f3865f10cc4 <zend_default_exception_new>, get_iterator = 0, 
interface_gets_implemented = 0, serialize = 0, 
  unserialize = 0, interfaces = 0x0, num_interfaces = 0, filename = 0x8 <Address 
0x8 out of bounds>, line_start = 36554016, line_end = 0, 
  doc_comment = 0x0, doc_comment_len = 0, module = 0x440}
(gdb) p *spl_ce_RuntimeException
$2 = {type = 1 '\001', name = 0x2354d50 "RuntimeException", name_length = 16, 
parent = 0x2212c70, refcount = 1, 
  constants_updated = 0 '\000', ce_flags = 0, function_table = {nTableSize = 16, 
nTableMask = 15, nNumOfElements = 9, nNextFreeElement = 0, 
    pInternalPointer = 0x2355880, pListHead = 0x2355880, pListTail = 0x2356300, 
arBuckets = 0x2356450, 
    pDestructor = 0x7f3865ee82f4 <zend_function_dtor>, persistent = 1 '\001', 
nApplyCount = 0 '\000', bApplyProtection = 0 '\000', 
    inconsistent = 0}, default_properties = {nTableSize = 8, nTableMask = 7, 
nNumOfElements = 6, nNextFreeElement = 0, 
    pInternalPointer = 0x23551d0, pListHead = 0x23551d0, pListTail = 0x23553c0, 
arBuckets = 0x2353980, 
    pDestructor = 0x7f3865ef223f <_zval_internal_ptr_dtor_wrapper>, persistent = 
1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 0}, properties_info = 
{nTableSize = 8, nTableMask = 7, nNumOfElements = 6, 
    nNextFreeElement = 0, pInternalPointer = 0x2355420, pListHead = 0x2355420, 
pListTail = 0x23557c0, arBuckets = 0x2355030, 
    pDestructor = 0x7f3865ed288a <zend_destroy_property_info_internal>, 
persistent = 1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 0}, default_static_members = 
{nTableSize = 8, nTableMask = 7, nNumOfElements = 0, 
    nNextFreeElement = 0, pInternalPointer = 0x0, pListHead = 0x0, pListTail = 
0x0, arBuckets = 0x2355080, 
    pDestructor = 0x7f3865ef223f <_zval_internal_ptr_dtor_wrapper>, persistent = 
1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 0}, static_members = 0x0, 
constants_table = {nTableSize = 8, nTableMask = 7, 
    nNumOfElements = 0, nNextFreeElement = 0, pInternalPointer = 0x0, pListHead 
= 0x0, pListTail = 0x0, arBuckets = 0x23550d0, 
    pDestructor = 0x7f3865ef223f <_zval_internal_ptr_dtor_wrapper>, persistent = 
1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 0}, builtin_functions = 0x0, 
constructor = 0x2213270, destructor = 0x0, clone = 0x2213120, 
  __get = 0x0, __set = 0x0, __unset = 0x0, __isset = 0x0, __call = 0x0, 
__tostring = 0x2213ba0, serialize_func = 0x0, 
  unserialize_func = 0x0, iterator_funcs = {funcs = 0x0, zf_new_iterator = 
0x2348880, zf_valid = 0x7fff64b8cf60, 
    zf_current = 0x7f3865efeb75, zf_key = 0x1, zf_next = 0x0, zf_rewind = 0x0}, 
  create_object = 0x7f3865f10cc4 <zend_default_exception_new>, get_iterator = 0, 
interface_gets_implemented = 0, serialize = 0, 
  unserialize = 0, interfaces = 0x0, num_interfaces = 0, filename = 0x8 <Address 
0x8 out of bounds>, line_start = 36536528, line_end = 0, 
  doc_comment = 0x0, doc_comment_len = 0, module = 0x217c8b0}
(gdb) p *default_exception_ce
$3 = {type = 1 '\001', name = 0x22127c0 "Exception", name_length = 9, parent = 
0x0, refcount = 1, constants_updated = 0 '\000', 
  ce_flags = 0, function_table = {nTableSize = 16, nTableMask = 15, 
nNumOfElements = 9, nNextFreeElement = 0, pInternalPointer = 0x22130c0, 
    pListHead = 0x22130c0, pListTail = 0x2213b40, arBuckets = 0x2213c90, 
pDestructor = 0x7f3865ee82f4 <zend_function_dtor>, 
    persistent = 1 '\001', nApplyCount = 0 '\000', bApplyProtection = 0 '\000', 
inconsistent = 0}, default_properties = {nTableSize = 8, 
    nTableMask = 7, nNumOfElements = 6, nNextFreeElement = 0, pInternalPointer = 
0x2213dc0, pListHead = 0x2213dc0, pListTail = 0x2214430, 
    arBuckets = 0x2212f30, pDestructor = 0x7f3865ef223f 
<_zval_internal_ptr_dtor_wrapper>, persistent = 1 '\001', nApplyCount = 0 
'\000', 
    bApplyProtection = 0 '\000', inconsistent = 0}, properties_info = 
{nTableSize = 8, nTableMask = 7, nNumOfElements = 6, 
    nNextFreeElement = 0, pInternalPointer = 0x2213e20, pListHead = 0x2213e20, 
pListTail = 0x2214490, arBuckets = 0x2212f80, 
    pDestructor = 0x7f3865ed288a <zend_destroy_property_info_internal>, 
persistent = 1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 0}, default_static_members = 
{nTableSize = 8, nTableMask = 7, nNumOfElements = 0, 
    nNextFreeElement = 0, pInternalPointer = 0x0, pListHead = 0x0, pListTail = 
0x0, arBuckets = 0x2212fd0, 
    pDestructor = 0x7f3865ef223f <_zval_internal_ptr_dtor_wrapper>, persistent = 
1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 0}, static_members = 0x0, 
constants_table = {nTableSize = 8, nTableMask = 7, 
    nNumOfElements = 0, nNextFreeElement = 0, pInternalPointer = 0x0, pListHead 
= 0x0, pListTail = 0x0, arBuckets = 0x2213020, 
    pDestructor = 0x7f3865ef223f <_zval_internal_ptr_dtor_wrapper>, persistent = 
1 '\001', nApplyCount = 0 '\000', 
    bApplyProtection = 0 '\000', inconsistent = 0}, builtin_functions = 
0x7f38664a7320, constructor = 0x2213270, destructor = 0x0, 
  clone = 0x2213120, __get = 0x0, __set = 0x0, __unset = 0x0, __isset = 0x0, 
__call = 0x0, __tostring = 0x2213ba0, serialize_func = 0x0, 
  unserialize_func = 0x0, iterator_funcs = {funcs = 0x0, zf_new_iterator = 
0x20f1518, zf_valid = 0x20bd378, zf_current = 0x7fff64b8d020, 
    zf_key = 0x14020bd378, zf_next = 0x0, zf_rewind = 0x2210400}, create_object 
= 0x7f3865f10cc4 <zend_default_exception_new>, 
  get_iterator = 0, interface_gets_implemented = 0, serialize = 0, unserialize = 
0, interfaces = 0x0, num_interfaces = 0, 
  filename = 0x8 <Address 0x8 out of bounds>, line_start = 1713062899, line_end 
= 32568, doc_comment = 0x0, doc_comment_len = 0, 
  module = 0x0}


as you can see, the spl_ce_RuntimeException and default_exception_ce all seems 
right, but the parent_ce, which should be equal to anyone of the two, seems 
wrong... 

PHP_MEMCACHED_API
zend_class_entry *php_memc_get_exception_base(int root TSRMLS_DC)
{
#if HAVE_SPL
    if (!root) {
        if (!spl_ce_RuntimeException) {
            zend_class_entry **pce;

            if (zend_hash_find(CG(class_table), "runtimeexception",
                               sizeof("RuntimeException"), (void **) &pce) == 
SUCCESS) {
                spl_ce_RuntimeException = *pce;
                return *pce;
            }
        } else {
            return spl_ce_RuntimeException;
        }
    }
#endif
#if (PHP_MAJOR_VERSION == 5) && (PHP_MINOR_VERSION < 2)
    return zend_exception_get_default();
#else
    return zend_exception_get_default(TSRMLS_C);
#endif
}

Expected result:
----------------
apache restart successfully

Actual result:
--------------
apache restart failed

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-04-25 13:30 UTC] laruence@php.net
plz note that, I edit the IS_CONSISTENT marco added a call to abort to make it 
coredump..  

and also you should also add the parse_parameters_none to php_memcache.h (since 
there is no such macro in php5.2)
 [2021-06-09 11:30 UTC] cmb@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: cmb
 [2021-06-09 11:30 UTC] cmb@php.net
The memcached bug tracker is now on Github[1].  If this is still
an issue with the current memcached version, please report there.

[1] <https://github.com/php-memcached-dev/php-memcached/issues>
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Dec 22 06:01:30 2024 UTC