php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #74497 Segfault occurs when releasing memory
Submitted: 2017-04-25 13:03 UTC Modified: 2017-05-21 04:22 UTC
Votes:1
Avg. Score:4.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: mdeallas at gmail dot com Assigned:
Status: No Feedback Package: Reproducible crash
PHP Version: 7.0.18 OS:
Private report: No CVE-ID: None
View Developer Edit
 [2017-04-25 13:03 UTC] mdeallas at gmail dot com 
Description:
------------
Hello,

I have a problem with the garbage collector which I cannot reproduce with a simple code. In brief, my script creates multiple objects (for 256M it is ~10k) based on a piece of data, binds them together and removes them (unset & null) if there is not enough memory available. Once the memory is cleaned up, it takes another portion of the data and does so until it reaches the data limit. The following stack trace is from the old version (7.0.11) but the problem also appears on the current version:

#0  0x0000555555cb1795 in zend_gc_collect_cycles () at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_gc.c:1078
#1  0x0000555555caf799 in gc_possible_root (ref=0x7fffe2c54180) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_gc.c:243
#2  0x0000555555c54b63 in gc_check_possible_root (z=0x7fffeb306430) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_gc.h:136
#3  0x0000555555c54c6b in i_zval_ptr_dtor (zval_ptr=0x7fffeb306430, __zend_filename=0x555556279000 "/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/ext/standard/var_unserializer.c", __zend_lineno=160)
    at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_variables.h:60
#4  0x0000555555c56c5b in _zval_ptr_dtor (zval_ptr=0x7fffeb306430, __zend_filename=0x555556279000 "/var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/ext/standard/var_unserializer.c", __zend_lineno=160)
    at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_execute_API.c:533
#5  0x0000555555af47f9 in var_destroy (var_hashx=0x7fffffffa700) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/ext/standard/var_unserializer.c:160
#6  0x0000555555ae2d5c in zif_unserialize (execute_data=0x7fffef817f00, return_value=0x7fffef817ef0) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/ext/standard/var.c:1087
#7  0x0000555555ce083a in ZEND_DO_ICALL_SPEC_HANDLER () at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_vm_execute.h:586
#8  0x0000555555ce0191 in execute_ex (ex=0x7fffef814030) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_vm_execute.h:414
#9  0x0000555555ce02db in zend_execute (op_array=0x7fffef864100, return_value=0x0) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend_vm_execute.h:458
#10 0x0000555555c73a2e in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/Zend/zend.c:1427
#11 0x0000555555bcce1d in php_execute_script (primary_file=0x7fffffffce60) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/main/main.c:2494
#12 0x0000555555d5472d in do_cli (argc=3, argv=0x555556664fd0) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/sapi/cli/php_cli.c:974
#13 0x0000555555d558fb in main (argc=3, argv=0x555556664fd0) at /var/tmp/portage/dev-lang/php-7.0.11-r2/work/sapis-build/cli/sapi/cli/php_cli.c:1344


And gdc output:

[0x7fffe947de00] rc=1 addr=6643 grey object(AAA)#13571 ->black
[0x7fffe947c0c0] rc=1 addr=6802 grey array(0) ->black
[0x7fffe947ac00] rc=2 addr=6845 grey object(BBB)#13572 ->black
[0x7fffe8e54200] rc=1 addr=9854 white object(AAA)#15515 ->black
[0x7fffe8e38ea0] rc=1 addr=9839 white array(32) ->black
[0x7fffe8e56400] rc=1 addr=0 white string ->black

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-05-08 09:50 UTC] laruence@php.net
-Status: Open +Status: Feedback
 [2017-05-08 09:50 UTC] laruence@php.net 
Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.
 [2017-05-21 04:22 UTC] php-bugs at lists dot php dot net 
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri May 09 08:01:35 2025 UTC