Bug #71129 [ReO]: Segmentation fault on ZTS Embed SAPI

Edit report at https://bugs.php.net/bug.php?id=71129&edit=1

 ID:                 71129
 User updated by:    maroszek at gmx dot net
 Reported by:        maroszek at gmx dot net
 Summary:            Segmentation fault on ZTS Embed SAPI
 Status:             Re-Opened
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   OS X 11.11
 PHP Version:        7.0.0
 Block user comment: N
 Private report:     N

 New Comment:

I have seen that you have reverted the patch. Did you have any more information why it fails on OS X?

But I think my segfault does not relate to the other mentioned bug, because this one was already present in PHP 5.x. (AFAIK the other bug depends on the new PHP7 zend_strings ref count...)

My current theory:
Some timer does not behave corretly and falsely detects a script timeout. (the original bug) This leads to an invalid cleanup or a double free/double cleanup. 

Unfortunately valgrind under OS X does not detect any issues... drd/helgrind detects some issues, but i haven't validated those yet and as some of them are present in linux aswell so they might be just more false positives.


Previous Comments:
------------------------------------------------------------------------
[2015-12-21 11:11:20] [email protected]

Automatic comment on behalf of ab
Revision: http://git.php.net/?p=php-src.git;a=commit;h=53bfb6618d13083b769014cbdcb845f787a7cf28
Log: Revert "Partially fix bug #71129"

------------------------------------------------------------------------
[2015-12-20 14:35:54] [email protected]

@maroszek thanks for the check, a patch is now commited. I'm setting the status onto feedback as you have yet more issues.

Unfortunately I've no Mac to test it. But how it sounds like, the crash and the timeout issues are two separate things. As from your code, the requests should not be hanging but just running through, so no timeouts are expected. Though, as you've already said, Mac will use another threading library, so maybe it could condition the issue, but just a guess. You probably should debug through and check which request are not running through and why. Maybe there's a way to reproduce this on Linux as well. 

So set this to feedback, but i'd rather suggest to indeed close this one and to open another ticket for the exact timeout issue you experience. Please feel free to do so if you think it's ok.

Thanks.

------------------------------------------------------------------------
[2015-12-20 14:27:37] [email protected]

Automatic comment on behalf of ab
Revision: http://git.php.net/?p=php-src.git;a=commit;h=4c55669caa96f6202c2047a7baf6c5d5894d5fa7
Log: Partially fix bug #71129

------------------------------------------------------------------------
[2015-12-18 15:05:45] maroszek at gmx dot net

It seems to fix the segfault for Debian :)
But unfortunately this does not fix the problem on OS X. 

If you look at the error message:
<b>Fatal error</b>:  Maximum execution time of 30 seconds exceeded in <b>Unknown</b> on line <b>0</b><br />

This does seems more like a timing/signaling bug, doesn't it? The timeout should never be hit...

Do you have any chance to test this issue on OS X? Can i be of any further assistance?

------------------------------------------------------------------------
[2015-12-18 13:27:45] [email protected]

Thanks for the update. Yeah, now it works. Please check whether this fixes the issue on your side

diff --git a/Zend/zend.c b/Zend/zend.c
index ec520b8..e122b04 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -467,7 +467,7 @@ static void auto_global_copy_ctor(zval *zv) /* {{{ */
        zend_auto_global *old_ag = (zend_auto_global *) Z_PTR_P(zv);
        zend_auto_global *new_ag = pemalloc(sizeof(zend_auto_global), 1);

-       new_ag->name = old_ag->name;
+       new_ag->name = zend_string_dup(old_ag->name, 0);
        new_ag->auto_global_callback = old_ag->auto_global_callback;
        new_ag->jit = old_ag->jit;


It namely didn't crash on my side, but after some debugging valgrind showed issues. This seems pretty matching with the recent bug #71115.

Thanks.

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=71129


--
Edit this bug report at https://bugs.php.net/bug.php?id=71129&edit=1