ID: 43295 User updated by: pioklo at serveradmin dot pl Reported By: pioklo at serveradmin dot pl Status: Open Bug Type: CGI related Operating System: Debian 4.0 kernel 2.6.23.1 PHP Version: 5.2.5 New Comment:
Core was generated by `/usr/local/bin/php-cgi'. Program terminated with signal 11, Segmentation fault. #0 _zend_mm_free_int (heap=0x85fe120, p=<value optimized out>) at /root/root/php-5.2.5/Zend/zend_alloc.c:1944 1944 if (ZEND_MM_IS_FREE_BLOCK(next_block)) { (gdb) bt #0 _zend_mm_free_int (heap=0x85fe120, p=<value optimized out>) at /root/root/php-5.2.5/Zend/zend_alloc.c:1944 #1 0x082b408b in sapi_deactivate () at /root/root/php-5.2.5/main/SAPI.c:445 #2 0x082ac205 in php_request_shutdown (dummy=0x0) at /root/root/php-5.2.5/main/main.c:1494 #3 0x083666b7 in main (argc=1, argv=0xbfdbe404) at /root/root/php-5.2.5/sapi/cgi/cgi_main.c:1972 (gdb) bt full #0 _zend_mm_free_int (heap=0x85fe120, p=<value optimized out>) at /root/root/php-5.2.5/Zend/zend_alloc.c:1944 mm_block = (zend_mm_block *) 0xb7a1d264 next_block = (zend_mm_block *) 0x24033fd4 size = 1818324336 #1 0x082b408b in sapi_deactivate () at /root/root/php-5.2.5/main/SAPI.c:445 No locals. #2 0x082ac205 in php_request_shutdown (dummy=0x0) at /root/root/php-5.2.5/main/main.c:1494 __bailout = {{__jmpbuf = {140495672, 141680200, 0, -1076117416, -1076117616, 137019746}, __mask_was_saved = 0, __saved_mask = {__val = {141694888, 3080939744, 3218849788, 3081418205, 3082261752, 141658448, 8, 9, 392, 4096, 3218849820, 3082256372, 0, 0, 0, 3082256372, 3082261696, 3080679456, 3218849848, 3081444831, 3082261696, 57, 3082256372, 57, 3080679456, 3218849880, 3081459254, 141658456, 3080679456, 57, 141658456, 141680200}}}} report_memleaks = 1 '\001' #3 0x083666b7 in main (argc=1, argv=0xbfdbe404) at /root/root/php-5.2.5/sapi/cgi/cgi_main.c:1972 path_translated = 0x8718958 "/home/admin/domains/poszkole.pl/public_html/beta/gry.php" free_query_string = 0 exit_status = 0 cgi = <value optimized out> c = <value optimized out> i = <value optimized out> len = <value optimized out> file_handle = {type = 2 '\002', filename = 0xb79f7020 "\204jĄˇe/admin/domains/poszkole.pl/public_html/beta/gry.php", opened_path = 0x0, handle = { fd = 141694888, fp = 0x87217a8, stream = {handle = 0x87217a8, reader = 0xbfdbe3b0, closer = 0xb7f3c4f8, fteller = 0x806c723, interactive = 24641422}}, free_filename = 0 '\0'} retval = <value optimized out> s = 0x0 behavior = 1 no_headers = 0 orig_optind = 1 orig_optarg = 0x0 script_file = 0x0 ini_entries_len = <value optimized out> max_requests = 50000 requests = 322 fastcgi = 1 bindpath = 0x0 fcgi_fd = <value optimized out> request = {listen_socket = 0, fd = 7, id = 1, keep = 1, in_len = 0, in_pad = 0, out_hdr = 0x0, out_pos = 0xbfdbc154 "\001\006", out_buf = "\001\006\000\001\r\v\005\000\n\t\t\t\n\t\t</div>\n\t\t<div class=\"block right goog\">\n\t\t\t<script type=\"text/javascript\"><!--\r\ngoogle_ad_client = \"pub-4042275753879057\";\r\ngoogle_ad_width = 120;\r\ngoogle_ad_height = 600;\r\ngoogle_ad_fo"..., reserved = '\0' <repeats 15 times>, env = {nTableSize = 32, nTableMask = 31, nNumOfElements = 28, nNextFreeElement = 0, pInternalPointer = 0x85fe370, pListHead = 0x85fe370, pListTail = 0x8713000, arBuckets = 0x8721a20, pDestructor = 0x83631a0 <fcgi_free_var>, persistent = 1 '\001', nApplyCount = 0 '\0', bApplyProtection = 1 '\001'}} repeats = 1 ---Type <return> to continue, or q <return> to quit--- benchmark = 0 start = {tv_sec = 134802161, tv_usec = -1208762380} end = {tv_sec = 140313464, tv_usec = -1076108440} status = 0 (gdb) up #1 0x082b408b in sapi_deactivate () at /root/root/php-5.2.5/main/SAPI.c:445 445 efree(SG(sapi_headers).mimetype); (gdb) up #2 0x082ac205 in php_request_shutdown (dummy=Cannot access memory at address 0x8 ) at /root/root/php-5.2.5/main/main.c:1494 1494 sapi_deactivate(TSRMLS_C); (gdb) up #3 0x083666b7 in main (argc=0, argv=0x0) at /root/root/php-5.2.5/sapi/cgi/cgi_main.c:1972 1972 php_request_shutdown((void *) 0); (gdb) Previous Comments: ------------------------------------------------------------------------ [2007-11-14 14:41:21] pioklo at serveradmin dot pl Description: ------------ Hello There ! I have installed lighttpd and php-cgi as backend. i started 1500 process php-cgi trought spawn-cgi from lighttpd Everything is ok but when more connections is coming i mean more than 1k per second i have problem with PHP php proces crashed every 1-2 minutes.. ns78:/tmp/phpcore# ls -la total 68004 drwxr-xr-x 2 apache apache 4096 2007-11-14 12:54 . drwxrwxrwt 6 root root 4096 2007-11-14 14:00 .. -rw------- 1 apache apache 69554176 2007-11-14 15:23 core ns78:/tmp/phpcore# gdb /usr/local/bin/php-cgi core GNU gdb 6.4.90-debian Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i486-linux-gnu"...Using host libthread_db library "/lib/tls/libthread_db.so.1". warning: Can't read pathname for load map: Input/output error. Reading symbols from /lib/tls/libcrypt.so.1...done. Loaded symbols for /lib/tls/libcrypt.so.1 Reading symbols from /lib/tls/librt.so.1...done. Loaded symbols for /lib/tls/librt.so.1 Reading symbols from /usr/local/mysql/lib/mysql/libmysqlclient.so.15...done. Loaded symbols for /usr/local/mysql/lib/mysql/libmysqlclient.so.15 Reading symbols from /usr/lib/libz.so.1...done. Loaded symbols for /usr/lib/libz.so.1 Reading symbols from /usr/local/lib/libiconv.so.2...done. Loaded symbols for /usr/local/lib/libiconv.so.2 Reading symbols from /usr/local/lib/libfreetype.so.6...done. Loaded symbols for /usr/local/lib/libfreetype.so.6 Reading symbols from /usr/local/lib/libpng.so.3...done. Loaded symbols for /usr/local/lib/libpng.so.3 Reading symbols from /lib/tls/libresolv.so.2...done. Loaded symbols for /lib/tls/libresolv.so.2 Reading symbols from /lib/tls/libm.so.6...done. Loaded symbols for /lib/tls/libm.so.6 Reading symbols from /lib/tls/libdl.so.2...done. Loaded symbols for /lib/tls/libdl.so.2 Reading symbols from /lib/tls/libnsl.so.1...done. Loaded symbols for /lib/tls/libnsl.so.1 Reading symbols from /usr/lib/libxml2.so.2...done. Loaded symbols for /usr/lib/libxml2.so.2 Reading symbols from /lib/tls/libc.so.6...done. Loaded symbols for /lib/tls/libc.so.6 Reading symbols from /lib/tls/libpthread.so.0...done. Loaded symbols for /lib/tls/libpthread.so.0 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /usr/local/lib/php/extensions/no-debug-non-zts-20060613/xcache.so...done. Loaded symbols for /usr/local/lib/php/extensions/no-debug-non-zts-20060613/xcache.so Reading symbols from /usr/local/lib/php/extensions/no-debug-non-zts-20060613/fileinfo.so...done. Loaded symbols for /usr/local/lib/php/extensions/no-debug-non-zts-20060613/fileinfo.so Reading symbols from /usr/lib/libmagic.so.1...done. Loaded symbols for /usr/lib/libmagic.so.1 Reading symbols from /lib/tls/libnss_files.so.2...done. Loaded symbols for /lib/tls/libnss_files.so.2 Reading symbols from /lib/tls/libnss_dns.so.2...done. Loaded symbols for /lib/tls/libnss_dns.so.2 Core was generated by `/usr/local/bin/php-cgi'. Program terminated with signal 11, Segmentation fault. #0 0x082e28cc in zend_cleanup_class_data (pce=0x86b0773) at /root/root/php-5.2.5/Zend/zend_opcode.c:153 153 if ((*pce)->type == ZEND_USER_CLASS) { (gdb) bt #0 0x082e28cc in zend_cleanup_class_data (pce=0x86b0773) at /root/root/php-5.2.5/Zend/zend_opcode.c:153 #1 0x082f4b6c in zend_hash_apply (ht=0x85fe3e8, apply_func=0x82e28c0 <zend_cleanup_class_data>) at /root/root/php-5.2.5/Zend/zend_hash.c:673 #2 0x082df3b9 in shutdown_executor () at /root/root/php-5.2.5/Zend/zend_execute_API.c:281 #3 0x082eb18d in zend_deactivate () at /root/root/php-5.2.5/Zend/zend.c:860 #4 0x082ac129 in php_request_shutdown (dummy=0x0) at /root/root/php-5.2.5/main/main.c:1485 #5 0x083666b7 in main (argc=1, argv=0xbfdbe404) at /root/root/php-5.2.5/sapi/cgi/cgi_main.c:1972 (gdb) up #1 0x082f4b6c in zend_hash_apply (ht=0x85fe3e8, apply_func=0x82e28c0 <zend_cleanup_class_data>) at /root/root/php-5.2.5/Zend/zend_hash.c:673 673 int result = apply_func(p->pData TSRMLS_CC); (gdb) print *p $1 = {h = 726206240, nKeyLength = 8, pData = 0x86b0773, pDataPtr = 0x86b4718, pListNext = 0x86b0774, pListLast = 0x86b2fc0, pNext = 0x769, pLast = 0x0, arKey = "l"} (gdb) print (char *)&*p->arKey $2 = 0x86b4ae0 "l\amattr" (gdb) In lighttpd logs: mod_proxy_backend_fastcgi.c.484: (trace) 8192 / 0 -> 8192 mod_proxy_backend_fastcgi.c.487: (error) looks like the fastcgi-backend (/gry.php?co=1&co2=play&idm=1363) terminated before it sent a FIN packet I dont know this is php bug or hardware issue :( Every crash produce different core : ns78:/tmp/phpcore# ls -al total 72196 drwxr-xr-x 2 apache apache 4096 2007-11-14 12:54 . drwxrwxrwt 6 root root 4096 2007-11-14 14:00 .. -rw------- 1 apache apache 73842688 2007-11-14 15:28 core ns78:/tmp/phpcore# gdb /usr/local/bin/php-cgi core GNU gdb 6.4.90-debian Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i486-linux-gnu"...Using host libthread_db library "/lib/tls/libthread_db.so.1". warning: Can't read pathname for load map: Input/output error. Reading symbols from /lib/tls/libcrypt.so.1...done. Loaded symbols for /lib/tls/libcrypt.so.1 Reading symbols from /lib/tls/librt.so.1...done. Loaded symbols for /lib/tls/librt.so.1 Reading symbols from /usr/local/mysql/lib/mysql/libmysqlclient.so.15...done. Loaded symbols for /usr/local/mysql/lib/mysql/libmysqlclient.so.15 Reading symbols from /usr/lib/libz.so.1...done. Loaded symbols for /usr/lib/libz.so.1 Reading symbols from /usr/local/lib/libiconv.so.2...done. Loaded symbols for /usr/local/lib/libiconv.so.2 Reading symbols from /usr/local/lib/libfreetype.so.6...done. Loaded symbols for /usr/local/lib/libfreetype.so.6 Reading symbols from /usr/local/lib/libpng.so.3...done. Loaded symbols for /usr/local/lib/libpng.so.3 Reading symbols from /lib/tls/libresolv.so.2...done. Loaded symbols for /lib/tls/libresolv.so.2 Reading symbols from /lib/tls/libm.so.6...done. Loaded symbols for /lib/tls/libm.so.6 Reading symbols from /lib/tls/libdl.so.2...done. Loaded symbols for /lib/tls/libdl.so.2 Reading symbols from /lib/tls/libnsl.so.1...done. Loaded symbols for /lib/tls/libnsl.so.1 Reading symbols from /usr/lib/libxml2.so.2...done. Loaded symbols for /usr/lib/libxml2.so.2 Reading symbols from /lib/tls/libc.so.6...done. Loaded symbols for /lib/tls/libc.so.6 Reading symbols from /lib/tls/libpthread.so.0...done. Loaded symbols for /lib/tls/libpthread.so.0 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /usr/local/lib/php/extensions/no-debug-non-zts-20060613/xcache.so...done. Loaded symbols for /usr/local/lib/php/extensions/no-debug-non-zts-20060613/xcache.so Reading symbols from /usr/local/lib/php/extensions/no-debug-non-zts-20060613/fileinfo.so...done. Loaded symbols for /usr/local/lib/php/extensions/no-debug-non-zts-20060613/fileinfo.so Reading symbols from /usr/lib/libmagic.so.1...done. Loaded symbols for /usr/lib/libmagic.so.1 Reading symbols from /lib/tls/libnss_files.so.2...done. Loaded symbols for /lib/tls/libnss_files.so.2 Reading symbols from /lib/tls/libnss_dns.so.2...done. Loaded symbols for /lib/tls/libnss_dns.so.2 Core was generated by `/usr/local/bin/php-cgi'. Program terminated with signal 11, Segmentation fault. #0 0x082d1f77 in _zend_mm_free_int (heap=0x85fe120, p=<value optimized out>) at /root/root/php-5.2.5/Zend/zend_alloc.c:822 822 if (UNEXPECTED(prev->next_free_block != mm_block) || UNEXPECTED(next->prev_free_block != mm_block)) { (gdb) bt full #0 0x082d1f77 in _zend_mm_free_int (heap=0x85fe120, p=<value optimized out>) at /root/root/php-5.2.5/Zend/zend_alloc.c:822 prev = <value optimized out> next = <value optimized out> mm_block = (zend_mm_block *) 0xb3680110 next_block = (zend_mm_block *) 0xb3680880 size = 1904 #1 0x080fd722 in php_gd_gdImageDestroy (im=0xb7a160d8) at /root/root/php-5.2.5/ext/gd/libgd/gd.c:234 i = 651 #2 0x082f75d2 in list_entry_destructor (ptr=0xb36abf48) at /root/root/php-5.2.5/Zend/zend_list.c:184 ld = (zend_rsrc_list_dtors_entry *) 0x86a5128 #3 0x082f5aee in zend_hash_del_key_or_index (ht=0x85fd180, arKey=<value optimized out>, nKeyLength=140759248, h=16, flag=1) at /root/root/php-5.2.5/Zend/zend_hash.c:497 p = (Bucket *) 0xb366af48 #4 0x082f7817 in _zend_list_delete (id=16) at /root/root/php-5.2.5/Zend/zend_list.c:58 le = (zend_rsrc_list_entry *) 0xb36abf48 #5 0x080efa4e in zif_imagedestroy (ht=1, return_value=0xb36ecf7c, return_value_ptr=0x0, this_ptr=0x0, return_value_used=0) at /root/root/php-5.2.5/ext/gd/gd.c:3044 IM = (zval **) 0xb79f7914 #6 0x08309582 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfdb4220) at /root/root/php-5.2.5/Zend/zend_vm_execute.h:200 class_name = <value optimized out> i = 1 p = <value optimized out> arg_count = 0 return_reference = 0 '\0' opline = (zend_op *) 0xb4b0d7b8 original_return_value = <value optimized out> current_scope = (zend_class_entry *) 0x0 current_this = (zval *) 0x0 should_change_scope = 0 '\0' #7 0x083085b8 in execute (op_array=0x8712a18) at /root/root/php-5.2.5/Zend/zend_vm_execute.h:92 execute_data = {opline = 0xb4b0d7b8, function_state = {function_symbol_table = 0xb7a08718, function = 0x863d0d0, reserved = {0xb4aee300, 0xb7a02ed0, 0xbfdb4250, 0x11}}, fbc = 0x0, op_array = 0x8712a18, object = 0x0, Ts = 0xbfdb4120, CVs = 0xbfdb40f0, original_in_execution = 1 '\001', symbol_table = 0xb7a0557c, prev_execute_data = 0xbfdb9e70, old_error_reporting = 0x0} #8 0x08308fe8 in zend_do_fcall_common_helper_SPEC (execute_data=0xbfdb9e70) at /root/root/php-5.2.5/Zend/zend_vm_execute.h:234 opline = (zend_op *) 0xb4aeeaa0 original_return_value = (zval **) 0xbfdb9f04 current_scope = (zend_class_entry *) 0x0 current_this = (zval *) 0x0 should_change_scope = 1 '\001' #9 0x083085b8 in execute (op_array=0xb7a0387c) at /root/root/php-5.2.5/Zend/zend_vm_execute.h:92 execute_data = {opline = 0xb4aeeaa0, function_state = {function_symbol_table = 0xb7a0557c, function = 0x8712a18, reserved = {0x82e225a, 0xb7a03a14, 0xbfdbe300, 0x0}}, fbc = 0x8712a18, op_array = 0xb7a0387c, object = 0x0, Ts = 0xbfdb4470, CVs = 0xbfdb4330, original_in_execution = 0 '\0', symbol_table = 0x85fd0f0, prev_execute_data = 0x0, ---Type <return> to continue, or q <return> to quit--- old_error_reporting = 0xbfdb5fa0} #10 0x082eaf44 in zend_execute_scripts (type=8, retval=<value optimized out>, file_count=3) at /root/root/php-5.2.5/Zend/zend.c:1134 retval2 = (zval *) 0x0 old_exception = (zval *) 0x0 files = 0xbfdb9f34 "" i = 1 file_handle = <value optimized out> orig_op_array = (zend_op_array *) 0x0 orig_retval_ptr_ptr = (zval **) 0x0 local_retval = (zval *) 0x0 #11 0x082ab920 in php_execute_script (primary_file=0xbfdbe300) at /root/root/php-5.2.5/main/main.c:2004 realfile = "\000\000\000\000\001\000\000\000Ĺ\025řż\034U\215ę\204ŻŰżĹXÝ˙\000\232\231Ş\000~8ŞCyŽË!4'\025K%ť\235ĎCţś*ÔV\217pÜ*y{dmSKO/:\220ne\b\237´żľ\215ŞqkŚYŰČ^5\035?Ý\237źcţŞĺvŮHŮd_N8Q\231\235ž(ý3˙[EMAIL PROTECTED]Ź\223J\236¤ĂůZ0qB1˘\216\221Ňs\032(ű(ëżű,U\néc¸\020É#Jx˛šéţW,*ŞŁĐzĚźŮGîŮţ*bŽŕ\205\017Źţ\227?˛ŃňĹ\\8Ĺ\b\202\0267K_÷oĹLU`\2221şD"... prepend_file_p = (zend_file_handle *) 0x0 append_file_p = <value optimized out> prepend_file = {type = 0 '\0', filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = { handle = 0x0, reader = 0, closer = 0, fteller = 0, interactive = 0}}, free_filename = 0 '\0'} append_file = {type = 0 '\0', filename = 0x0, opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = { handle = 0x0, reader = 0, closer = 0, fteller = 0, interactive = 0}}, free_filename = 0 '\0'} old_cwd = 0xbfdb9f40 "" retval = 0 #12 0x08366f4f in main (argc=1, argv=0xbfdbe404) at /root/root/php-5.2.5/sapi/cgi/cgi_main.c:1909 l = <value optimized out> path_translated_len = 0 path_translated = <value optimized out> free_query_string = 0 exit_status = 0 cgi = <value optimized out> c = <value optimized out> i = <value optimized out> len = <value optimized out> file_handle = {type = 2 '\002', filename = 0xb79f7020 "/home/admin/domains/poszkole.pl/public_html/beta/galerie.php", opened_path = 0x0, handle = { fd = 141686200, fp = 0x871f5b8, stream = {handle = 0x871f5b8, reader = 0xbfdbe3b0, closer = 0xb7f3c4f8, fteller = 0x806c723, interactive = 24641422}}, free_filename = 0 '\0'} retval = <value optimized out> s = 0x87218d8 "136005" behavior = 1 no_headers = 0 orig_optind = 1 orig_optarg = 0x0 script_file = 0x0 ini_entries_len = 0 max_requests = 50000 ---Type <return> to continue, or q <return> to quit--- requests = 427 fastcgi = 1 bindpath = 0x0 fcgi_fd = <value optimized out> request = {listen_socket = 0, fd = 7, id = 1, keep = 1, in_len = 0, in_pad = 0, out_hdr = 0x0, out_pos = 0xbfdbc154 "\001\003", out_buf = "\001\003\000\001\000\b\000\000\000\000\000\000\000v class=\"bord\"></div>\r\n\t\t\t\t\t\t\t</div>\r\n\t\t\t\t\t\t</div>\r\n\t\t\t\t\r\n\t\t\t\t\t\t<div class=\"middle\">\r\n\t\t\t\t\t\t\t<ul>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t</ul>\r\n\t\t\t\t\t\t</div>\r\n\t\t\t\t\r\n\t\t\t\t\t\t<div class=\"bottom\">\r\n\t\t\t\t\t\t\t<div clas"..., reserved = '\0' <repeats 15 times>, env = {nTableSize = 64, nTableMask = 63, nNumOfElements = 33, nNextFreeElement = 0, pInternalPointer = 0x8721da0, pListHead = 0x8721da0, pListTail = 0x871dd70, arBuckets = 0x87210c0, pDestructor = 0x83631a0 <fcgi_free_var>, persistent = 1 '\001', nApplyCount = 0 '\0', bApplyProtection = 1 '\001'}} repeats = 1 benchmark = 0 start = {tv_sec = 134802161, tv_usec = -1208762380} end = {tv_sec = 140313464, tv_usec = -1076108440} status = 0 (gdb) My config for php ./configure --enable-fastcgi \ --enable-discard-path \ --enable-force-cgi-redirect \ --with-gd --with-gettext \ --with-jpeg-dir=/usr/local/lib \ --with-mysql=/usr/local/mysql --with-pear --with-png-dir=/usr/local/lib \ --with-zlib \ --enable-ftp --enable-shared --enable-magic-quotes --enable-sockets \ --enable-mbstring \ --enable-exif \ --with-ttf --with-freetype-dir --enable-gd-native-ttf \ --with-iconv=/usr/local Regards, Piotr Kloc ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=43295&edit=1