Bug #71129 [Opn->Fbk]: Segmentation fault on ZTS Embed SAPI

Edit report at https://bugs.php.net/bug.php?id=71129&edit=1

 ID:                 71129
 Updated by:         [email protected]
 Reported by:        maroszek at gmx dot net
 Summary:            Segmentation fault on ZTS Embed SAPI
-Status:             Open
+Status:             Feedback
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   OS X 11.11
 PHP Version:        7.0.0
 Block user comment: N
 Private report:     N

 New Comment:

Thanks for the report. Currently the code you posted does not compile with gcc, what i have is 

g++ crash.cpp -Imain -ITSRM -IZend -I. --std=c++11 -Llibs -lphp7 -lxml2 -lresolv
crash.cpp:95:1: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
 };
 ^
crash.cpp:95:1: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
/usr/bin/ld: libs/libphp7.a(zend_API.o): undefined reference to symbol 'dlclose@@GLIBC_2.2.5'
//lib/x86_64-linux-gnu/libdl.so.2: error adding symbols: DSO missing from command line
collect2: error: ld returned 1 exit status

Same parameters as yours, Jessie 64-bit. PHP compiled with the options you gave. Could you please check?

Thanks.


Previous Comments:
------------------------------------------------------------------------
[2015-12-18 07:20:49] maroszek at gmx dot net

Can i provide any more details? Can you reproduce the example?

Thank you for your effort and time!

------------------------------------------------------------------------
[2015-12-15 19:41:23] maroszek at gmx dot net

I reproduced the problem under Debian 8 aswell.

uname -a 
Linux debian 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u5 (2015-10-09) x86_64 GNU/Linux

g++ --version
> g++ (Debian 4.9.2-10) 4.9.2

Here is the output from gdb:
Program received signal SIGSEGV, Segmentation fault.
zend_mm_free_heap (ptr=0xecaff0, heap=0x7fffec000040)
    at /home/user/Downloads/php-7.0.0/Zend/zend_alloc.c:1400
1400			ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");

Backtrace:
#0  zend_mm_free_heap (ptr=0xecaff0, heap=0x7fffec000040)
    at /home/user/Downloads/php-7.0.0/Zend/zend_alloc.c:1400
#1  _efree (ptr=0xecaff0)
    at /home/user/Downloads/php-7.0.0/Zend/zend_alloc.c:2458
#2  0x0000000000489d65 in zend_string_release (s=<optimized out>)
    at /home/user/Downloads/php-7.0.0/Zend/zend_string.h:271
#3  _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, 
    idx=<optimized out>, ht=<optimized out>)
    at /home/user/Downloads/php-7.0.0/Zend/zend_hash.c:986
#4  _zend_hash_del_el (p=0x7fffec056100, idx=0, ht=0x7fffd4024370)
    at /home/user/Downloads/php-7.0.0/Zend/zend_hash.c:1016
#5  zend_hash_graceful_reverse_destroy (ht=0x7fffd4024370)
    at /home/user/Downloads/php-7.0.0/Zend/zend_hash.c:1468
#6  0x0000000000468995 in shutdown_executor ()
    at /home/user/Downloads/php-7.0.0/Zend/zend_execute_API.c:277
#7  0x0000000000478798 in zend_deactivate ()
    at /home/user/Downloads/php-7.0.0/Zend/zend.c:967
#8  0x0000000000419239 in php_request_shutdown (dummy=<optimized out>)
    at /home/user/Downloads/php-7.0.0/main/main.c:1810
#9  0x0000000000415893 in main::{lambda()#1}::operator()() const ()

------------------------------------------------------------------------
[2015-12-15 15:46:49] maroszek at gmx dot net

Description:
------------
PHP 7 is current stable
PHP 7 is build as a static library

./configure '--disable-fpm' '--disable-cgi' '--disable-cli' '--enable-embed=static' '--enable-maintainer-zts' '--without-iconv'

g++ --version
> Apple LLVM version 7.0.2 (clang-700.1.81)
> Target: x86_64-apple-darwin15.2.0
> Thread model: posix

I build a simple example to demonstrate the threading problem. 
On OS X the example crashes within a second. 

Sourcecode: https://gist.github.com/paresy/b4babb919a86e9764bc4

Copy crash.cpp into your php7 folder.
Compile with: g++ crash.cpp -Imain -Itsrm -Izend -I. --std=c++11 -Llibs -lphp7 -lxml2 -lresolv

empty.php:
<?

Start it. It should crash. :-)

PS: PHP 5.5 and probably 5.6 is affected as well.

Expected result:
----------------
No crash. Endless loop doing the work. 

Actual result:
--------------
Segmentation fault: 11

and a lot of warnings which make no real sense:
<b>Fatal error</b>:  Maximum execution time of 30 seconds exceeded in <b>Unknown</b> on line <b>0</b><br />


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=71129&edit=1