ID: 47870
Updated by: mbecc...@php.net
Reported By: mbecc...@php.net
Status: Open
Bug Type: Arrays related
Operating System: FreeBSD 6.2
PHP Version: 5.3CVS-2009-04-01 (CVS)
New Comment:
mat...@phenom-ubuntu:~/OX-trunk/tests$ valgrind --tool=memcheck
--num-callers=30 --log-file=php.log /usr/local/bin/php run.php
--type=unit --level=file --layer=dal --folder=lib/OA/Dal/Maintenance
--file=Priority_getZoneImpressionForecasts.dal.test.php --format=text
--host=test Priority_getZoneImpressionForecasts.dal.test.php
Segmentation fault
mat...@phenom-ubuntu:~/OX-trunk/tests$ cat php.log
==11808== Memcheck, a memory error detector.
==11808== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et
al.
==11808== Using LibVEX rev 1854, a library for dynamic binary
translation.
==11808== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==11808== Using valgrind-3.3.1-Debian, a dynamic binary instrumentation
framework.
==11808== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et
al.
==11808== For more details, rerun with: -v
==11808==
==11808== My PID = 11808, parent PID = 10101. Prog and args are:
==11808== /usr/local/bin/php
==11808== run.php
==11808== --type=unit
==11808== --level=file
==11808== --layer=dal
==11808== --folder=lib/OA/Dal/Maintenance
==11808== --file=Priority_getZoneImpressionForecasts.dal.test.php
==11808== --format=text
==11808== --host=test
==11808== Priority_getZoneImpressionForecasts.dal.test.php
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x7FF79D: _zval_ptr_dtor (zend_execute_API.c:430)
==11808== by 0x824537: zend_hash_clean (zend_hash.c:552)
==11808== by 0x849231: zend_leave_helper_SPEC
(zend_vm_execute.h:208)
==11808== by 0x8DC019: ZEND_RETURN_SPEC_CV_HANDLER
(zend_vm_execute.h:22098)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x7FF861: _zval_ptr_dtor (zend_execute_API.c:441)
==11808== by 0x824537: zend_hash_clean (zend_hash.c:552)
==11808== by 0x849231: zend_leave_helper_SPEC
(zend_vm_execute.h:208)
==11808== by 0x8DC019: ZEND_RETURN_SPEC_CV_HANDLER
(zend_vm_execute.h:22098)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x881939: zend_assign_to_variable (zend_execute.c:664)
==11808== by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27359)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x881991: zend_assign_to_variable (zend_execute.c:669)
==11808== by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27359)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x881A77: zend_assign_to_variable (zend_execute.c:684)
==11808== by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27359)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x881939: zend_assign_to_variable (zend_execute.c:664)
==11808== by 0x8EF8A8: ZEND_ASSIGN_SPEC_CV_TMP_HANDLER
(zend_vm_execute.h:25711)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x881991: zend_assign_to_variable (zend_execute.c:669)
==11808== by 0x8EF8A8: ZEND_ASSIGN_SPEC_CV_TMP_HANDLER
(zend_vm_execute.h:25711)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x881A77: zend_assign_to_variable (zend_execute.c:684)
==11808== by 0x8EF8A8: ZEND_ASSIGN_SPEC_CV_TMP_HANDLER
(zend_vm_execute.h:25711)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x881939: zend_assign_to_variable (zend_execute.c:664)
==11808== by 0x8E6422: ZEND_ASSIGN_SPEC_CV_CONST_HANDLER
(zend_vm_execute.h:24065)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x881991: zend_assign_to_variable (zend_execute.c:669)
==11808== by 0x8E6422: ZEND_ASSIGN_SPEC_CV_CONST_HANDLER
(zend_vm_execute.h:24065)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x881A77: zend_assign_to_variable (zend_execute.c:684)
==11808== by 0x8E6422: ZEND_ASSIGN_SPEC_CV_CONST_HANDLER
(zend_vm_execute.h:24065)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x7FF79D: _zval_ptr_dtor (zend_execute_API.c:430)
==11808== by 0x845F0A: zend_assign_to_variable_reference
(zend_execute.c:410)
==11808== by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27405)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x7FF861: _zval_ptr_dtor (zend_execute_API.c:441)
==11808== by 0x845F0A: zend_assign_to_variable_reference
(zend_execute.c:410)
==11808== by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27405)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x7FF893: _zval_ptr_dtor (zend_gc.h:182)
==11808== by 0x845F0A: zend_assign_to_variable_reference
(zend_execute.c:410)
==11808== by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27405)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x7FF89F: _zval_ptr_dtor (zend_gc.h:182)
==11808== by 0x845F0A: zend_assign_to_variable_reference
(zend_execute.c:410)
==11808== by 0x8FD31A: ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27405)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Conditional jump or move depends on uninitialised value(s)
==11808== at 0x8818D4: zend_assign_to_variable (zend_execute.c:657)
==11808== by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27359)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Use of uninitialised value of size 8
==11808== at 0x881933: zend_assign_to_variable (zend_execute.c:664)
==11808== by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27359)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== Process terminating with default action of signal 11
(SIGSEGV)
==11808== Bad permissions for mapped region at address 0x8000015
==11808== at 0x881933: zend_assign_to_variable (zend_execute.c:664)
==11808== by 0x8FCC90: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER
(zend_vm_execute.h:27359)
==11808== by 0x848774: execute (zend_vm_execute.h:104)
==11808== by 0x814198: zend_execute_scripts (zend.c:1188)
==11808== by 0x768884: php_execute_script (main.c:2157)
==11808== by 0x9125CE: main (php_cli.c:1159)
==11808==
==11808== ERROR SUMMARY: 42 errors from 17 contexts (suppressed: 18
from 2)
==11808== malloc/free: in use at exit: 29,165,534 bytes in 170,630
blocks.
==11808== malloc/free: 1,826,083 allocs, 1,655,453 frees, 157,087,187
bytes allocated.
==11808== For counts of detected errors, rerun with: -v
==11808== searching for pointers to 170,630 not-freed blocks.
==11808== checked 22,615,176 bytes.
==11808==
==11808== LEAK SUMMARY:
==11808== definitely lost: 388 bytes in 14 blocks.
==11808== possibly lost: 0 bytes in 0 blocks.
==11808== still reachable: 29,165,146 bytes in 170,616 blocks.
==11808== suppressed: 0 bytes in 0 blocks.
==11808== Rerun with --leak-check=full to see details of leaked
memory.
Previous Comments:
------------------------------------------------------------------------
[2009-04-01 23:20:38] mbecc...@php.net
Description:
------------
Again, another bug happening in a unit test of OpenX. The problem
always happens in the same test at the same point. What happens is that
a simple array() call is returning NULL on my FreeBSD system. The same
test generates a segmentation fault when run on our Linux based
continuous integration system.
Unfortunately I can't create a self-contained test case, but I can
provide access to the system or more data.
I will also attach a backtrace of the core dump (which might even not
be happening at the same place as the FreeBSD failure).
Reproduce code:
---------------
$ids = array();
echo 'On FreeBSD: ';
var_dump($ids);
Expected result:
----------------
On FreeBSD: Array ()
Actual result:
--------------
On FreeBSD: NULL
Backtrace (Linux):
Program terminated with signal 11, Segmentation fault.
(gdb) bt full
#0 ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (execute_data=0x2aaaaecf02d8) at
/usr/local/src/php-5.3.0RC1/Zend/zend_execute.c:664
opline = (zend_op *) 0x12eb418
free_op2 = {var = 0x273c0d0}
value = (zval *) 0x1
variable_ptr_ptr = (zval **) 0x2a0e848
#1 0x00000000007242fb in execute (op_array=0x10fdf40) at
/usr/local/src/php-5.3.0RC1/Zend/zend_vm_execute.h:104
ret = <value optimized out>
execute_data = (zend_execute_data *) 0x2aaaaecf02d8
nested = 1 '\001'
original_in_execution = 0 '\0'
#2 0x0000000000701306 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at /usr/local/src/php-5.3.0RC1/Zend/zend.c:1188
files = {{gp_offset = 40, fp_offset = 73, overflow_arg_area =
0x7fffbdf97f10, reg_save_area = 0x7fffbdf97e20}}
i = 1
file_handle = (zend_file_handle *) 0x7fffbdf9a3e0
orig_op_array = (zend_op_array *) 0x0
orig_retval_ptr_ptr = (zval **) 0x0
#3 0x00000000006ae155 in php_execute_script
(primary_file=0x7fffbdf9a3e0) at
/usr/local/src/php-5.3.0RC1/main/main.c:2157
__orig_bailout = (jmp_buf *) 0x7fffbdf9a1c0
__bailout = {{__jmpbuf = {15364672, 903771196811129754, 1, 0,
0, 0, 903771196811177402, 903720367174677233}, __mask_was_saved = 0,
__saved_mask = {__val = {48, 7, 15372768, 9416, 216135044429,
17634384, 229440404087961, 48, 7403025, 15235744, 0,
206158430215, 140736380641392, 17634352, 17634352, 140736380641392}}}}
prepend_file_p = (zend_file_handle *) 0x0
append_file_p = (zend_file_handle *) 0x8
prepend_file = {type = ZEND_HANDLE_FILENAME, filename = 0x0,
opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0,
isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0,
old_handle = 0x0, old_closer = 0}, reader = 0, fsizer = 0,
closer = 0}}, free_filename = 0 '\0'}
append_file = {type = ZEND_HANDLE_FILENAME, filename = 0x0,
opened_path = 0x0, handle = {fd = 0, fp = 0x0, stream = {handle = 0x0,
isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0,
old_handle = 0x0, old_closer = 0}, reader = 0, fsizer = 0,
closer = 0}}, free_filename = 0 '\0'}
old_cwd = 0x7fffbdf97f20 ""
retval = 0
#4 0x000000000078bcee in main (argc=10, argv=0x7fffbdf9a658) at
/usr/local/src/php-5.3.0RC1/sapi/cli/php_cli.c:1159
__bailout = {{__jmpbuf = {216132590528, 903720367176127146, 0,
140736380642896, 110, 0, 903771196811129834, 903720367173477278},
__mask_was_saved = 0, __saved_mask = {__val = {140736380642608,
140736380642416, 57, 112, 15369344, 15369328, 216135048496,
216138037600, 81, 140736380641952, 216135037715, 47, 96, 50,
216130423719, 15369344}}}}
exit_status = 0
c = <value optimized out>
file_handle = {type = ZEND_HANDLE_MAPPED, filename =
0x7fffbdf9a935 "run.php", opened_path = 0x0, handle = {fd = 17477016, fp
= 0x10aad98, stream = {handle = 0x10aad98, isatty = 0, mmap = {
len = 5351, pos = 0, map = 0x2aaaaed69000, buf = 0x2aaaaed69000
"", old_handle = 0x10d10b0, old_closer = 0x715dd0
<zend_stream_stdio_closer>}, reader = 0x716390
<zend_stream_stdio_reader>,
fsizer = 0x7162d0 <zend_stream_stdio_fsizer>, closer = 0x716320
<zend_stream_mmap_closer>}}, free_filename = 0 '\0'}
behavior = 1
reflection_what = 0x0
orig_optind = 1
orig_optarg = 0x0
arg_free = 0x7fffbdf9a935 "run.php"
arg_excp = <value optimized out>
script_file = 0x7fffbdf9a935 "run.php"
interactive = 0
module_started = 1
request_started = 1
lineno = 1
exec_direct = 0x0
exec_run = 0x0
exec_begin = 0x0
exec_end = 0x0
param_error = <value optimized out>
hide_argv = 0
ini_entries_len = <value optimized out>
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=47870&edit=1
