Bug #71129 [ReO->Fbk]: Segmentation fault on ZTS Embed SAPI

Edit report at https://bugs.php.net/bug.php?id=71129&edit=1

 ID:                 71129
 Updated by:         [email protected]
 Reported by:        maroszek at gmx dot net
 Summary:            Segmentation fault on ZTS Embed SAPI
-Status:             Re-Opened
+Status:             Feedback
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   OS X 10.11
 PHP Version:        7.0.0
 Block user comment: N
 Private report:     N

 New Comment:

Please try using this snapshot:

  http://snaps.php.net/php-trunk-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

See also #74011.


Previous Comments:
------------------------------------------------------------------------
[2017-01-20 21:50:53] ejrx7753 at gmail dot com

@maroszek

Your gist includes signal_startup (https://gist.github.com/paresy/b4babb919a86e9764bc4) and you give a negative result (no confirmation of the test that I posted either), but on https://bugs.php.net/bug.php?id=71041 you confirm that the signal_startup is the issue. Did you forget to post some details?

Concerning your post there, it seems to me that running php_embed_init is an acceptable solution instead of sapi_startup. I don't see yet any deficiency with it.

------------------------------------------------------------------------
[2017-01-20 14:17:09] maroszek at gmx dot net

@ab:  I've somehow missed that you already proposed a patch. After applying it everything looks fine on my linux box. Any chance to get this merged?

Thank!

------------------------------------------------------------------------
[2017-01-20 14:09:44] maroszek at gmx dot net

I forgot to mention that this issue is also available on Linux (Ubuntu 16.04)

------------------------------------------------------------------------
[2017-01-20 14:08:19] maroszek at gmx dot net

I updated the code for PHP 7.1.1. The issue remains.

Gist: https://gist.github.com/paresy/b4babb919a86e9764bc4
Needed fix: https://bugs.php.net/bug.php?id=71041
Build: g++ crash.cpp -Imain -ITSRM -IZend -I. --std=c++11 -Llibs -lphp7 -lxml2 -lresolv -ldl -pthread -fpermissive
Run: ./a.out

Crash:
(gdb) bt
#0  zend_mm_free_heap (ptr=0xf3c080, heap=0x7fffe9600040)
    at /home/user/Downloads/php-7.1.1/Zend/zend_alloc.c:1374
#1  _efree (ptr=0xf3c080)
    at /home/user/Downloads/php-7.1.1/Zend/zend_alloc.c:2433
#2  0x0000000000490405 in zend_string_release (s=<optimized out>)
    at /home/user/Downloads/php-7.1.1/Zend/zend_string.h:272
#3  _zend_hash_del_el_ex (prev=<optimized out>, p=<optimized out>, 
    idx=<optimized out>, ht=<optimized out>)
    at /home/user/Downloads/php-7.1.1/Zend/zend_hash.c:992
#4  _zend_hash_del_el (p=0x7fffe9656120, idx=1, ht=0x7fffc8025140)
    at /home/user/Downloads/php-7.1.1/Zend/zend_hash.c:1021
#5  zend_hash_graceful_reverse_destroy (ht=0x7fffc8025140)
    at /home/user/Downloads/php-7.1.1/Zend/zend_hash.c:1477
#6  0x000000000046c1f5 in shutdown_executor ()
    at /home/user/Downloads/php-7.1.1/Zend/zend_execute_API.c:279
#7  0x000000000047daab in zend_deactivate ()
    at /home/user/Downloads/php-7.1.1/Zend/zend.c:997
#8  0x0000000000417fe9 in php_request_shutdown (dummy=<optimized out>)
    at /home/user/Downloads/php-7.1.1/main/main.c:1877
#9  0x0000000000414364 in main::{lambda()#1}::operator()() const ()
#10 0x000000000041548c in void std::_Bind_simple<main::{lambda()#1} ()>::_M_invoke<>(std::_Index_tuple<>) ()
#11 0x00000000004153e2 in std::_Bind_simple<main::{lambda()#1} ()>::operator()() ()
#12 0x0000000000415372 in std::thread::_Impl<std::_Bind_simple<main::{lambda()#1} ()> >::_M_run() ()
#13 0x00007ffff7331930 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#14 0x00007ffff6b406ba in start_thread (arg=0x7fffeb7fe700)
    at pthread_create.c:333

Thanks for any hints on the issue!

------------------------------------------------------------------------
[2017-01-16 23:01:25] ejrx7753 at gmail dot com

Adding the lines

    php_embed_module.ub_write = php_embed_ub_write;
    php_embed_module.flush = php_embed_flush;

after

php_embed_init

works so long as nothing is done with the output. Uncommenting "std::cout << str;" inside of php_embed_ub_write causes a segmentation fault "pointer being freed was not allocated" reliably inside the shutdown executor.

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=71129


--
Edit this bug report at https://bugs.php.net/bug.php?id=71129&edit=1