php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71930 _zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed
Submitted: 2016-03-31 09:29 UTC Modified: 2016-03-31 10:07 UTC
From: mbeccati@php.net Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 7.0Git-2016-03-31 (Git) OS:
Private report: No CVE-ID:
 [2016-03-31 09:29 UTC] mbeccati@php.net
Description:
------------
I've just re-enabled php7 and master daily builds of phpspec and I am getting an assertion failure. This was the first run in a long time, so I can't tell how recent is the commit that's responsible for the failure on both 7.0 and 7.1.

Test script:
---------------
git clone git@github.com:phpspec/phpspec.git
cd phpspec
composer update --prefer-dist
php bin/phpspec run

Expected result:
----------------
no assertion failure

Actual result:
--------------
php: /.../Zend/zend_variables.c:43: _zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff59b3cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb)
(gdb) frame 4
#4  0x0000000000a1dd77 in _zval_dtor_func (p=0x7ffff0adc360, __zend_filename=0x108f700 "/.../Zend/zend_variables.c", __zend_lineno=246)
    at /.../Zend/zend_variables.c:43
43                                      ZEND_ASSERT(GC_REFCOUNT(arr) <= 1);
(gdb) print *arr
$1 = {gc = {refcount = 783, u = {v = {type = 7 '\a', flags = 0 '\000', gc_info = 51251}, type_info = 3358785543}}, u = {v = {flags = 30 '\036', nApplyCount = 0 '\000', nIteratorsCount = 0 '\000', reserve = 0 '\000'}, flags = 30},
  nTableMask = 4294967294, arData = 0x7ffff0cf4908, nNumUsed = 2, nNumOfElements = 2, nTableSize = 8, nInternalPointer = 0, nNextFreeElement = 2, pDestructor = 0xa1e500 <_zval_ptr_dtor_wrapper>}
(gdb)


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-03-31 10:02 UTC] nikic@php.net
Can you please provide the backtrace for this assertion failure? That would be "bt" in gdb.
 [2016-03-31 10:07 UTC] mbeccati@php.net
#0  0x00007ffff59b3cc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
        resultvar = 0
        pid = 15991
        selftid = 15991
#1  0x00007ffff59b70d8 in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x15b2450, sa_sigaction = 0x15b2450}, sa_mask = {__val = {291552, 1, 140737314276717, 4294967295, 140737313957091, 4294967296, 140737488341696, 4192, 140737240891392, 140737488341808,
              0, 0, 0, 21474836480, 140737354100736, 140737315330096}}, sa_flags = 17364814, sa_restorer = 0x108f830 <__PRETTY_FUNCTION__.8742>}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007ffff59acb86 in __assert_fail_base (fmt=0x7ffff5afd830 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x108f74e "(arr)->gc.refcount <= 1",
    file=file@entry=0x108f700 "/home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c", line=line@entry=43, function=function@entry=0x108f830 <__PRETTY_FUNCTION__.8742> "_zval_dtor_func") at assert.c:92
        str = 0x15b23c0 "php: /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c:43: _zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed.\n"
        total = 4096
#3  0x00007ffff59acc32 in __GI___assert_fail (assertion=0x108f74e "(arr)->gc.refcount <= 1", file=0x108f700 "/home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c", line=43,
    function=0x108f830 <__PRETTY_FUNCTION__.8742> "_zval_dtor_func") at assert.c:101
No locals.
#4  0x0000000000a1dd77 in _zval_dtor_func (p=0x7ffff0adc360, __zend_filename=0x108f700 "/home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c", __zend_lineno=246)
    at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c:43
        arr = 0x7ffff0adc360
        __PRETTY_FUNCTION__ = "_zval_dtor_func"
#5  0x0000000000a1dbe8 in _zval_dtor (zvalue=0x7fffeeb63000, __zend_filename=0x108f700 "/home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c", __zend_lineno=246)
    at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.h:44
No locals.
#6  0x0000000000a1e4d8 in _zval_dtor_wrapper (zvalue=0x7fffeeb63000) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_variables.c:246
No locals.
#7  0x0000000000a1d74e in zend_stack_clean (stack=0x1425c68 <executor_globals+712>, func=0xa1e4b4 <_zval_dtor_wrapper>, free_elements=1 '\001') at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_stack.c:156
        i = 0
#8  0x0000000000a0832a in shutdown_executor () at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend_execute_API.c:298
        zeh = 0x1425c30 <executor_globals+656>
        __orig_bailout = 0x7fffffffe4d0
        __bailout = {{__jmpbuf = {0, 8163182216280542960, 4398192, 140737488348800, 0, 0, 8163182216196656880, -8163183037063491856}, __mask_was_saved = 0, __saved_mask = {__val = {140737196851200, 140737488342576, 10412513, 10252836,
                21125248, 12198296, 18446744073420021696, 140737488342640, 10605271, 0, 139646277132224, 10252836, 21125248, 140737488342656, 21125248, 140737488342656}}}}
        func = 0x7ffff1400000
        ce = 0x0
#9  0x0000000000a2064b in zend_deactivate () at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/Zend/zend.c:967
No locals.
#10 0x000000000098d741 in php_request_shutdown (dummy=0x0) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/main/main.c:1833
        report_memleaks = 1 '\001'
#11 0x0000000000ae2c55 in do_cli (argc=3, argv=0x14299f0) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/sapi/cli/php_cli.c:1141
        c = -1
        file_handle = {handle = {fd = -246976496, fp = 0x7ffff1477010, stream = {handle = 0x7ffff1477010, isatty = 0, mmap = {len = 735, pos = 0, map = 0x7ffff7ff4000, buf = 0x7ffff7ff4013 "-\224\064n-\224\064", old_handle = 0x15a6ee0,
                old_closer = 0xa462a3 <zend_stream_stdio_closer>}, reader = 0xa46274 <zend_stream_stdio_reader>, fsizer = 0xa462d4 <zend_stream_stdio_fsizer>, closer = 0xa463e6 <zend_stream_mmap_closer>}},
          filename = 0x1429a50 "bin/phpspec", opened_path = 0x0, type = ZEND_HANDLE_MAPPED, free_filename = 0 '\000'}
        behavior = 1
        reflection_what = 0x0
        request_started = 1
        exit_status = 0
        php_optarg = 0x0
        orig_optarg = 0x0
        php_optind = 2
        orig_optind = 1
        exec_direct = 0x0
        exec_run = 0x0
        exec_begin = 0x0
        exec_end = 0x0
        arg_free = 0x1429a50 "bin/phpspec"
        arg_excp = 0x14299f8
        script_file = 0x1429a50 "bin/phpspec"
        translated_path = 0x15a7480 "/home/atlassian/bamboo/xml-data/build-dir/PHP-PHPSPEC-PHP70/bin/phpspec"
        interactive = 0
        lineno = 2
        param_error = 0x0
        hide_argv = 0
#12 0x0000000000ae34ca in main (argc=3, argv=0x14299f0) at /home/atlassian/bamboo/xml-data/build-dir/PHP-SRC5-BUIL/sapi/cli/php_cli.c:1344
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {0, 8163182217526251248, 4398192, 140737488348800, 0, 0, 8163182217578680048, -8163182954876629264}, __mask_was_saved = 0, __saved_mask = {__val = {140737488348464, 4131212846, 4301179, 4294967295,
                140737351947607, 140737313821096, 140737354025456, 140733193388033, 140737313801896, 1, 11457293, 140737488348808, 0, 11457216, 4398192, 140737488348800}}}}
        c = -1
        exit_status = 0
        module_started = 1
        sapi_started = 1
        php_optarg = 0x0
        php_optind = 1
        use_extended_info = 0
        ini_path_override = 0x0
        ini_entries = 0x1429cb0 "html_errors=0\nregister_argc_argv=1\nimplicit_flush=1\noutput_buffering=0\nmax_execution_time=0\nmax_input_time=-1\n"
        ini_entries_len = 110
        ini_ignore = 0
        sapi_module = 0x13ffb20 <cli_sapi_module>
 [2016-04-01 14:28 UTC] laruence@php.net
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=5b1bb41c0b125fe9964abaa1d523ce2ba1823cf6
Log: Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)-&gt;gc.refcount &lt;= 1' failed)
 [2016-04-01 14:28 UTC] laruence@php.net
-Status: Open +Status: Closed
 [2016-07-20 11:32 UTC] davey@php.net
Automatic comment on behalf of laruence@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=5b1bb41c0b125fe9964abaa1d523ce2ba1823cf6
Log: Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)-&gt;gc.refcount &lt;= 1' failed)
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Fri Apr 28 08:01:50 2017 UTC