|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2014-02-08 20:25 UTC] phpreq at byom dot de
Description:
------------
Hi,
In my setup (Debian Wheezy 64 Bit, Kernel 3.12, Apache 2.4.7, php 5.5.9, gcc Debian 4.7.2-5)
I let php also parse and execute .js - files as some very few contain php-code to have dynamically created .js files.
Done with: AddType application/x-httpd-php js
Apache segfaults about 5-6 times a day.
Doing a backtrace shows me that only files that end with .js cause the segfault.
The files are typically stock .js-files from a wordpress 3.8.1 installation. Parsing them by php shouldn't be a problem, especially as they don't contain any <? ?>. But it seems there is a problem with the file-buf as seen in gdb's frame 4: error: Cannot access memory at address 0x100000001.
See the output of gdb:
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f653a6948ef in i_create_execute_data_from_op_array (nested=0 '\000', op_array=0x7f6540403148)
at /usr/local/src/php-5.5.9/Zend/zend_execute.c:1631
1631 EX(prev_execute_data) = EG(current_execute_data);
(gdb) bt
#0 0x00007f653a6948ef in i_create_execute_data_from_op_array (nested=0 '\000', op_array=0x7f6540403148)
at /usr/local/src/php-5.5.9/Zend/zend_execute.c:1631
#1 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:388
#2 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:383
#3 0x00007f653a5e7b69 in zend_execute_scripts (type=type@entry=2, retval=0x0, retval@entry=0x2201a60,
file_count=file_count@entry=1) at /usr/local/src/php-5.5.9/Zend/zend.c:1316
#4 0x00007f653a698105 in php_handler (r=0x21f1770)
at /usr/local/src/php-5.5.9/sapi/apache2handler/sapi_apache2.c:669
#5 0x000000000044ee50 in ap_run_handler (r=0x21f1770) at config.c:170
#6 0x000000000044f42b in ap_invoke_handler (r=r@entry=0x21f1770) at config.c:439
#7 0x000000000046354a in ap_process_async_request (r=0x21f1770) at http_request.c:317
#8 0x00000000004637ff in ap_process_request (r=r@entry=0x21f1770) at http_request.c:363
#9 0x000000000045fe05 in ap_process_http_sync_connection (c=0x21e18e0) at http_core.c:190
#10 ap_process_http_connection (c=0x21e18e0) at http_core.c:231
#11 0x0000000000458460 in ap_run_process_connection (c=0x21e18e0) at connection.c:41
#12 0x0000000000458860 in ap_process_connection (c=c@entry=0x21e18e0, csd=<optimized out>) at connection.c:202
#13 0x000000000046986b in child_main (child_num_arg=child_num_arg@entry=2) at prefork.c:704
#14 0x0000000000469a77 in make_child (s=0x1eaf538, slot=2) at prefork.c:800
#15 0x000000000046a842 in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:902
#16 prefork_run (_pconf=<optimized out>, plog=<optimized out>, s=<optimized out>) at prefork.c:1090
#17 0x0000000000435a0e in ap_run_mpm (pconf=0x1e86138, plog=0x1eb3378, s=0x1eaf538) at mpm_common.c:98
#18 0x000000000042f12b in main (argc=3, argv=0x7fff5542e328) at main.c:777
(gdb) bt full
#0 0x00007f653a6948ef in i_create_execute_data_from_op_array (nested=0 '\000', op_array=0x7f6540403148)
at /usr/local/src/php-5.5.9/Zend/zend_execute.c:1631
execute_data = 0x0
CVs_size = 0
Ts_size = <optimized out>
stack_size = <optimized out>
total_size = <optimized out>
call_slots_size = <optimized out>
#1 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:388
No locals.
#2 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:383
No locals.
#3 0x00007f653a5e7b69 in zend_execute_scripts (type=type@entry=2, retval=0x0, retval@entry=0x2201a60,
file_count=file_count@entry=1) at /usr/local/src/php-5.5.9/Zend/zend.c:1316
files = {{gp_offset = 32, fp_offset = 28, overflow_arg_area = 0x7fff5542dba0,
reg_save_area = 0x7fff5542db30}}
i = <optimized out>
file_handle = 0x7fff5542dc00
orig_op_array = 0x0
orig_retval_ptr_ptr = 0x0
orig_interactive = 0
#4 0x00007f653a698105 in php_handler (r=0x21f1770)
at /usr/local/src/php-5.5.9/sapi/apache2handler/sapi_apache2.c:669
zfd = {type = ZEND_HANDLE_FILENAME,
filename = 0x21f2ef0 "/home/www/htdocs/wp-includes/js/jquery/jquery.js",
opened_path = 0x0, handle = {fd = 1067612014, fp = 0x7f653fa2776e <apr_table_unset+158>, stream = {
handle = 0x7f653fa2776e <apr_table_unset+158>, isatty = 35598064, mmap = {len = 36590244,
pos = 35591928, map = 0x6440073f370,
buf = 0x100000001 <error: Cannot access memory at address 0x100000001>, old_handle = 0x1,
old_closer = 0x7180567}, reader = 0x902, fsizer = 0x1, closer = 0x21e18e0}},
free_filename = 0 '\000'}
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {32654544, 6444143732774364179, 35592048, 35526880, 32175416, 0,
-6444483869346667501, -6366886698566065133}, __mask_was_saved = 0, __saved_mask = {__val = {
32257640, 32563064, 35799832, 1, 32563064, 35799840, 0, 35526880, 32175416, 0, 140072810773443, 0,
0, 0, 0, 0}}}}
ctx = 0x21e9c48
conf = 0x1ee6160
brigade = 0x0
bucket = <optimized out>
rv = <optimized out>
parent_req = 0x2201a60
#5 0x000000000044ee50 in ap_run_handler (r=0x21f1770) at config.c:170
pHook = 0x1f244d0
n = 4
rv = 0
#6 0x000000000044f42b in ap_invoke_handler (r=r@entry=0x21f1770) at config.c:439
handler = <optimized out>
p = <optimized out>
result = <optimized out>
old_handler = 0x0
ignore = <optimized out>
#7 0x000000000046354a in ap_process_async_request (r=0x21f1770) at http_request.c:317
c = 0x21e18e0
access_status = 0
#8 0x00000000004637ff in ap_process_request (r=r@entry=0x21f1770) at http_request.c:363
bb = <optimized out>
b = <optimized out>
c = 0x21e18e0
rv = <optimized out>
#9 0x000000000045fe05 in ap_process_http_sync_connection (c=0x21e18e0) at http_core.c:190
r = 0x21f1770
cs = 0x0
csd = 0x21e16f0
mpm_state = 1
#10 ap_process_http_connection (c=0x21e18e0) at http_core.c:231
No locals.
#11 0x0000000000458460 in ap_run_process_connection (c=0x21e18e0) at connection.c:41
pHook = 0x1f2eaa0
n = 1
rv = 0
#12 0x0000000000458860 in ap_process_connection (c=c@entry=0x21e18e0, csd=<optimized out>) at connection.c:202
rc = <optimized out>
#13 0x000000000046986b in child_main (child_num_arg=child_num_arg@entry=2) at prefork.c:704
current_conn = 0x21e18e0
csd = 0x21e16f0
thd = 0x20aff70
osthd = 140072847148864
ptrans = 0x21e1678
allocator = 0x20afb70
status = <optimized out>
i = <optimized out>
lr = <optimized out>
pollset = 0x20b0050
sbh = 0x20b0048
bucket_alloc = 0x21e5698
last_poll_idx = 1
lockfile = <optimized out>
#14 0x0000000000469a77 in make_child (s=0x1eaf538, slot=2) at prefork.c:800
pid = 0
#15 0x000000000046a842 in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:902
i = <optimized out>
idle_count = <optimized out>
ws = <optimized out>
free_length = <optimized out>
free_slots = {2, 7, 12, 14, 28, 29, 30, 31, 32, 33, 34, 35, 36, 38, 39, 40, 57, 58, 59, 60, 61, 62, 63, 64,
65, 66, 67, 68, 69, 70, 71, 72}
last_non_dead = <optimized out>
total_non_dead = <optimized out>
#16 prefork_run (_pconf=<optimized out>, plog=<optimized out>, s=<optimized out>) at prefork.c:1090
status = 0
pid = {pid = -1, in = 0x7f653aaf582d, out = 0x7f653efa8e60, err = 0x20}
child_slot = <optimized out>
exitwhy = APR_PROC_EXIT
processed_status = <optimized out>
index = <optimized out>
remaining_children_to_start = 0
rv = <optimized out>
#17 0x0000000000435a0e in ap_run_mpm (pconf=0x1e86138, plog=0x1eb3378, s=0x1eaf538) at mpm_common.c:98
pHook = 0x1f2ebc8
n = 0
rv = 0
#18 0x000000000042f12b in main (argc=3, argv=0x7fff5542e328) at main.c:777
c = 0 '\000'
showcompile = 0
showdirectives = 0
confname = 0x46c1f0 "/usr/local/apache/conf/httpd.conf"
def_server_root = 0x46b8f8 "/usr/local/apache/2.4.7"
temp_error_log = <optimized out>
error = <optimized out>
process = 0x1e84218
pconf = 0x1e86138
plog = 0x1eb3378
ptemp = 0x1eb1348
pcommands = 0x1ea8248
opt = 0x1ea8338
rv = <optimized out>
mod = 0x689ac0 <ap_prelinked_modules+32>
opt_arg = 0x1e84128 "\b\001\350\001"
signal_server = <optimized out>
(gdb) frame 1
#1 zend_execute (op_array=0x7f6540403148) at /usr/local/src/php-5.5.9/Zend/zend_vm_execute.h:388
388 zend_execute_ex(i_create_execute_data_from_op_array(op_array, 0 TSRMLS_CC) TSRMLS_CC);
(gdb)
(gdb) frame 4
#4 0x00007f653a698105 in php_handler (r=0x2376c90)
at /usr/local/src/php-5.5.9/sapi/apache2handler/sapi_apache2.c:669
669 zend_execute_scripts(ZEND_INCLUDE TSRMLS_CC, NULL, 1, &zfd);
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Wed Nov 05 00:00:02 2025 UTC |
I have also experienced this. Here's my backtrace: #0 0x00007f034cd0996d in zend_stack_push (stack=stack@entry=0x7f034d4cfca0 <compiler_globals+608>, element=element@entry=0x7f034d4cfc78 <compiler_globals+568>, size=size@entry=40) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_stack.c:42 No locals. #1 0x00007f034ccd530e in compile_file (file_handle=file_handle@entry=0x7fff94794c10, type=2) at Zend/zend_language_scanner.l:586 original_lex_state = {yy_leng = 0, yy_start = 0x0, yy_text = 0x0, yy_cursor = 0x0, yy_marker = 0x0, yy_limit = 0x0, yy_state = 0, state_stack = {top = 0, max = 0, elements = 0x0}, heredoc_label_stack = {top = 0, max = 0, elements = 0x0, top_element = 0x0, persistent = 0 '\000'}, in = 0x0, lineno = 0, filename = 0x0, script_org = 0x0, script_org_size = 0, script_filtered = 0x0, script_filtered_size = 0, input_filter = 0x0, output_filter = 0x0, script_encoding = 0x0} op_array = 0x7f0350d40040 original_active_op_array = 0x0 retval = 0x7f0350d40040 compiler_result = <optimized out> compilation_successful = 0 '\000' retval_znode = {op_type = 1, u = {op = {constant = 1, var = 1, num = 1, hash = 1, opline_num = 1, jmp_addr = 0x1, zv = 0x1, literal = 0x1, ptr = 0x1}, constant = {value = {lval = 1, dval = 4.9406564584124654e-324, str = { val = 0x1 <error: Cannot access memory at address 0x1>, len = 1355599370}, ht = 0x1, obj = {handle = 1, handlers = 0x7f0350ccce0a}}, refcount__gc = 1, type = 1 '\001', is_ref__gc = 0 '\000'}, op_array = 0x1}, EA = 1352782496} original_in_compilation = 0 '\000' #2 0x00007f034ccfaaea in dtrace_compile_file (file_handle=0x7fff94794c10, type=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/Zend/zend_dtrace.c:40 res = 0x7f0350d41218 #3 0x00007f034cb83cb4 in phar_compile_file (file_handle=<optimized out>, type=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/ext/phar/phar.c:3383 __orig_bailout = 0x7fff94794c90 __bailout = {{__jmpbuf = {139652217134240, 1560366938000916389, 140735684365136, 140735684365328, 139652158519872, 0, -1560319682279440475, -1467874381389299803}, __mask_was_saved = 0, __saved_mask = {__val = {139652217126952, 0, 0, 139652217132542, 139652217128344, 139652217127072, 9, 139652217128728, 139652209727463, 139652219264008, 206158430232, 140735684365152, 140735684364960, 139652217228296, 140735684365056, 80}}}} res = <optimized out> name = 0x0 failed = 0 phar = 0x7f0350cb4028 #4 0x00007f034cd0c56f in zend_execute_scripts (type=type@entry=2, retval=retval@entry=0x0, file_count=file_count@entry=1) at /build/buildd/php5-5.5.9+dfsg/Zend/zend.c:1308 files = {{gp_offset = 32, fp_offset = 32515, overflow_arg_area = 0x7fff94794be0, reg_save_area = 0x7fff94794b70}} i = 0 file_handle = 0x7fff94794c10 orig_op_array = 0x0 orig_retval_ptr_ptr = 0x0 orig_interactive = 0 #5 0x00007f034cdbc4ed in php_handler (r=<optimized out>) at /build/buildd/php5-5.5.9+dfsg/sapi/apache2handler/sapi_apache2.c:669 zfd = {type = ZEND_HANDLE_MAPPED, filename = 0x7f0350cb5ca0 "/var/www/html/site_details_removed/js/stumble.js.php", opened_path = 0x7f0350d401a8 "/var/www/html/site_details_removed/js/stumble.js.php", handle = {fd = 1356071640, fp = 0x7f0350d402d8, stream = {handle = 0x7f0350d402d8, isatty = 0, mmap = {len = 309, pos = 0, map = 0x0, buf = 0x7f0350cb8000 <error: Cannot access memory at address 0x7f0350cb8000>, old_handle = 0x0, old_closer = 0x0}, reader = 0x7f034ccc24d0 <_php_stream_read>, fsizer = 0x7f034cca8cd0 <php_zend_stream_fsizer>, closer = 0x7f034cca8cb0 <php_zend_stream_mmap_closer>}}, free_filename = 0 '\000'} __orig_bailout = 0x0 __bailout = {{__jmpbuf = {139652217127072, 1560366938000654245, 139652217127072, 139652221501312, 0, 139652217270928, -1560319682222817371, -1467873582333755483}, __mask_was_saved = 0, __saved_mask = {__val = {139652218377176, 139652218107936, 139652217229512, 1, 139652218107936, 139652217229520, 139652217270432, 139652221501312, 0, 139652217270928, 139652164910243, 139652217134314, 2, 139652217229520, 139652217127072, 139652217988304}}}} ctx = 0x7f0350cbced8 conf = <optimized out> brigade = 0x7f0350cb6620 bucket = <optimized out> rv = <optimized out> parent_req = 0x7f0350cb90a0 #6 0x00007f0350e9b680 in ap_run_handler (r=0x7f0350cb40a0) at config.c:169 pHook = 0x7f0350d864f8 n = 2 rv = 1356075544 #7 0x00007f0350e9bbc9 in ap_invoke_handler (r=r@entry=0x7f0350cb40a0) at config.c:439 handler = <optimized out> p = <optimized out> result = <optimized out> old_handler = 0x7f0350d98828 "application/x-httpd-php" ignore = <optimized out> #8 0x00007f0350eb116a in ap_process_async_request (r=0x7f0350cb40a0) at http_request.c:317 access_status = 0 #9 0x00007f0350eb1444 in ap_process_request (r=r@entry=0x7f0350cb40a0) at http_request.c:363 bb = <optimized out> b = <optimized out> c = 0x7f0350cd7290 rv = <optimized out> #10 0x00007f0350eadf02 in ap_process_http_sync_connection (c=0x7f0350cd7290) at http_core.c:190 r = 0x7f0350cb40a0 cs = 0x0 csd = 0x7f0350cd70a0 mpm_state = 1 #11 ap_process_http_connection (c=0x7f0350cd7290) at http_core.c:231 No locals. #12 0x00007f0350ea4cc0 in ap_run_process_connection (c=0x7f0350cd7290) at connection.c:41 pHook = 0x7f0350d86a40 n = 0 rv = 1356075544 #13 0x00007f0350ea50a8 in ap_process_connection (c=c@entry=0x7f0350cd7290, csd=<optimized out>) at connection.c:202 rc = <optimized out> #14 0x00007f034d6dc767 in child_main (child_num_arg=child_num_arg@entry=30) at prefork.c:704 current_conn = 0x7f0350cd7290 csd = 0x7f0350cd70a0 thd = 0x7f0350cd90a0 osthd = 139652218701696 ptrans = 0x7f0350cd7028 allocator = 0x7f035186d4b0 status = <optimized out> i = <optimized out> lr = <optimized out> pollset = 0x7f0350cd9158 sbh = 0x7f0350cd9150 bucket_alloc = 0x7f0350cd3028 last_poll_idx = 0 lockfile = <optimized out> #15 0x00007f034d6dc9a6 in make_child (s=0x7f0350e0ade0, slot=30) at prefork.c:800 pid = 0 #16 0x00007f034d6dd60e in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:902 i = <optimized out> idle_count = <optimized out> ws = <optimized out> free_length = <optimized out> free_slots = {28, 30, 34, 35, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65} last_non_dead = <optimized out> total_non_dead = <optimized out> #17 prefork_run (_pconf=<optimized out>, plog=<optimized out>, s=<optimized out>) at prefork.c:1090 status = 0 pid = {pid = -1, in = 0x7f0350ebc048, out = 0xa, err = 0x7f035059aff6} child_slot = <optimized out> exitwhy = APR_PROC_EXIT processed_status = <optimized out> index = <optimized out> remaining_children_to_start = 0 rv = <optimized out> #18 0x00007f0350e8269e in ap_run_mpm (pconf=0x7f0350e32028, plog=0x7f0350e06028, s=0x7f0350e0ade0) at mpm_common.c:96 pHook = 0x7f0350d86da8 n = 0 rv = 1356075544 #19 0x00007f0350e7be36 in main (argc=3, argv=0x7fff94795318) at main.c:777 c = 0 '\000' showcompile = 0 showdirectives = 0 confname = 0x7f0350ebb607 "apache2.conf" def_server_root = 0x7f0350ebb5fa "/etc/apache2" temp_error_log = 0x0 error = <optimized out> process = 0x7f0350e3a118 pconf = 0x7f0350e32028 plog = 0x7f0350e06028 ptemp = 0x7f0350e08028 pcommands = 0x7f0350e10028 opt = 0x7f0350e10118 rv = <optimized out> mod = 0x7f03510dd160 <ap_prelinked_modules+64> opt_arg = 0x7f0350e3a028 "(\340\343P\003\177" signal_server = <optimized out> Additionally, here's the script that is causing the error: <?php header('Content-type: text/javascript'); ?> function bfb_doStumbleShare(url) { window.open( 'http://www.stumbleupon.com/submit?'+ 'url='+url, 'sharer', 'top=' + (screen.height/2 - 160).toString() + ',left=' + (screen.width/2 - 290).toString() + ',toolbar=0,status=0,width=580,height=325' ); }