Bug #71129 [Com]: Segmentation fault on ZTS Embed SAPI

Edit report at https://bugs.php.net/bug.php?id=71129&edit=1

 ID:                 71129
 Comment by:         maroszek at gmx dot net
 Reported by:        maroszek at gmx dot net
 Summary:            Segmentation fault on ZTS Embed SAPI
 Status:             Feedback
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   OS X 11.11
 PHP Version:        7.0.0
 Block user comment: N
 Private report:     N

 New Comment:

It seems to fix the segfault for Debian :)
But unfortunately this does not fix the problem on OS X. 

If you look at the error message:
<b>Fatal error</b>:  Maximum execution time of 30 seconds exceeded in <b>Unknown</b> on line <b>0</b><br />

This does seems more like a timing/signaling bug, doesn't it? The timeout should never be hit...

Do you have any chance to test this issue on OS X? Can i be of any further assistance?


Previous Comments:
------------------------------------------------------------------------
[2015-12-18 13:27:45] [email protected]

Thanks for the update. Yeah, now it works. Please check whether this fixes the issue on your side

diff --git a/Zend/zend.c b/Zend/zend.c
index ec520b8..e122b04 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -467,7 +467,7 @@ static void auto_global_copy_ctor(zval *zv) /* {{{ */
        zend_auto_global *old_ag = (zend_auto_global *) Z_PTR_P(zv);
        zend_auto_global *new_ag = pemalloc(sizeof(zend_auto_global), 1);

-       new_ag->name = old_ag->name;
+       new_ag->name = zend_string_dup(old_ag->name, 0);
        new_ag->auto_global_callback = old_ag->auto_global_callback;
        new_ag->jit = old_ag->jit;


It namely didn't crash on my side, but after some debugging valgrind showed issues. This seems pretty matching with the recent bug #71115.

Thanks.

------------------------------------------------------------------------
[2015-12-18 12:04:33] maroszek at gmx dot net

Hi! Thanks for verifying! For Debian you need to change it a bit.

This should work:
g++ crash.cpp -Imain -ITSRM -IZend -I. --std=c++11 -Llibs -lphp7 -lxml2 -lresolv -ldl -pthread

------------------------------------------------------------------------
[2015-12-18 11:41:53] [email protected]

Thanks for the report. Currently the code you posted does not compile with gcc, what i have is 

g++ crash.cpp -Imain -ITSRM -IZend -I. --std=c++11 -Llibs -lphp7 -lxml2 -lresolv
crash.cpp:95:1: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
 };
 ^
crash.cpp:95:1: warning: deprecated conversion from string constant to 'char*' [-Wwrite-strings]
/usr/bin/ld: libs/libphp7.a(zend_API.o): undefined reference to symbol 'dlclose@@GLIBC_2.2.5'
//lib/x86_64-linux-gnu/libdl.so.2: error adding symbols: DSO missing from command line
collect2: error: ld returned 1 exit status

Same parameters as yours, Jessie 64-bit. PHP compiled with the options you gave. Could you please check?

Thanks.

------------------------------------------------------------------------
[2015-12-18 07:20:49] maroszek at gmx dot net

Can i provide any more details? Can you reproduce the example?

Thank you for your effort and time!

------------------------------------------------------------------------
[2015-12-15 19:41:23] maroszek at gmx dot net

I reproduced the problem under Debian 8 aswell.

uname -a 
Linux debian 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt11-1+deb8u5 (2015-10-09) x86_64 GNU/Linux

g++ --version
> g++ (Debian 4.9.2-10) 4.9.2

Here is the output from gdb:
Program received signal SIGSEGV, Segmentation fault.
zend_mm_free_heap (ptr=0xecaff0, heap=0x7fffec000040)
    at /home/user/Downloads/php-7.0.0/Zend/zend_alloc.c:1400
1400			ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");

Backtrace:
#0  zend_mm_free_heap (ptr=0xecaff0, heap=0x7fffec000040)
    at /home/user/Downloads/php-7.0.0/Zend/zend_alloc.c:1400
#1  _efree (ptr=0xecaff0)
    at /home/user/Downloads/php-7.0.0/Zend/zend_alloc.c:2458
#2  0x0000000000489d65 in zend_string_release (s=<optimized out>)
    at /home/user/Downloads/php-7.0.0/Zend/zend_string.h:271
#3  _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, 
    idx=<optimized out>, ht=<optimized out>)
    at /home/user/Downloads/php-7.0.0/Zend/zend_hash.c:986
#4  _zend_hash_del_el (p=0x7fffec056100, idx=0, ht=0x7fffd4024370)
    at /home/user/Downloads/php-7.0.0/Zend/zend_hash.c:1016
#5  zend_hash_graceful_reverse_destroy (ht=0x7fffd4024370)
    at /home/user/Downloads/php-7.0.0/Zend/zend_hash.c:1468
#6  0x0000000000468995 in shutdown_executor ()
    at /home/user/Downloads/php-7.0.0/Zend/zend_execute_API.c:277
#7  0x0000000000478798 in zend_deactivate ()
    at /home/user/Downloads/php-7.0.0/Zend/zend.c:967
#8  0x0000000000419239 in php_request_shutdown (dummy=<optimized out>)
    at /home/user/Downloads/php-7.0.0/main/main.c:1810
#9  0x0000000000415893 in main::{lambda()#1}::operator()() const ()

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=71129


--
Edit this bug report at https://bugs.php.net/bug.php?id=71129&edit=1