From: stuart dot herbert at boxuk dot com
Operating system: RHES 3.1
PHP version: 4.3.6
PHP Bug Type: DOM XML related
Bug description: mod_php crash after xslt_process()
Description:
------------
PHP segfaults when shutting down. This appears to be the same symptom as
in bug #26384. I've included a backtrace, and some dumps of what looked
like the key structures.
Hope you can help,
Stu
Actual result:
--------------
#0 0xb70b47db in zend_hash_index_find (ht=0x40, h=0, pData=0x40)
at /root/BoxUK3/build/php-4.3.6/Zend/zend_hash.c:960
#1 0xb6fac42a in node_wrapper_free (node=0x84c7458)
at /root/BoxUK3/build/php-4.3.6/ext/domxml/php_domxml.c:651
#2 0xb6fac53c in node_list_wrapper_dtor (node=0x84c7458, destroyref=1)
at /root/BoxUK3/build/php-4.3.6/ext/domxml/php_domxml.c:698
#3 0xb6fac4c2 in node_list_wrapper_dtor (node=0x84c7418, destroyref=1)
at /root/BoxUK3/build/php-4.3.6/ext/domxml/php_domxml.c:682
#4 0xb6fac4c2 in node_list_wrapper_dtor (node=0x84c73d8, destroyref=1)
at /root/BoxUK3/build/php-4.3.6/ext/domxml/php_domxml.c:682
#5 0xb6fac4c2 in node_list_wrapper_dtor (node=0x84b2778, destroyref=1)
at /root/BoxUK3/build/php-4.3.6/ext/domxml/php_domxml.c:682
#6 0xb6fac4c2 in node_list_wrapper_dtor (node=0x84a68d8, destroyref=1)
at /root/BoxUK3/build/php-4.3.6/ext/domxml/php_domxml.c:682
#7 0xb6f9eaa3 in php_free_xml_doc (rsrc=0x40)
at /root/BoxUK3/build/php-4.3.6/ext/domxml/php_domxml.c:682
#8 0xb70b5242 in list_entry_destructor (ptr=0x850a7f4)
at /root/BoxUK3/build/php-4.3.6/Zend/zend_list.c:177
#9 0xb70b3ce8 in zend_hash_apply_deleter (ht=0xb725cba0, p=0x8511b54)
at /root/BoxUK3/build/php-4.3.6/Zend/zend_hash.c:608
#10 0xb70b3d8c in zend_hash_graceful_reverse_destroy (ht=0xb725cba0)
at /root/BoxUK3/build/php-4.3.6/Zend/zend_hash.c:674
#11 0xb70b540f in zend_destroy_rsrc_list (ht=0x40)
at /root/BoxUK3/build/php-4.3.6/Zend/zend_list.c:233
#12 0xb70a64c9 in shutdown_executor ()
at /root/BoxUK3/build/php-4.3.6/Zend/zend_execute_API.c:213
#13 0xb70ae8f5 in zend_deactivate ()
at /root/BoxUK3/build/php-4.3.6/Zend/zend.c:667
#14 0xb70822f8 in php_request_shutdown (dummy=0x0)
at /root/BoxUK3/build/php-4.3.6/main/main.c:996
#15 0xb70c2590 in php_apache_request_dtor (r=0x8189040)
at
/root/BoxUK3/build/php-4.3.6/sapi/apache2handler/sapi_apache2.c:461
#16 0xb70c288b in php_handler (r=0x8189040)
at
/root/BoxUK3/build/php-4.3.6/sapi/apache2handler/sapi_apache2.c:577
#17 0x080686c5 in ap_run_handler (r=0x8189040) at config.c:195
#18 0x08068cdf in ap_invoke_handler (r=0x8189040) at config.c:401
#19 0x080654a6 in ap_process_request (r=0x8189040) at http_request.c:288
#20 0x08060a8c in ap_process_http_connection (c=0x8182fb8) at
http_core.c:293
#21 0x080722b5 in ap_run_process_connection (c=0x8182fb8) at
connection.c:85
#22 0x08066d11 in child_main (child_num_arg=64) at prefork.c:694
#23 0x08066e64 in make_child (s=0x0, slot=1) at prefork.c:788
#24 0x08066f86 in startup_children (number_to_start=4) at prefork.c:806
#25 0x080677ad in ap_mpm_run (_pconf=0x80a05d0, plog=0x80ca678,
s=0x80a2370)
at prefork.c:1022
#26 0x0806dc4f in main (argc=3, argv=0xbfffb594) at main.c:660
At stack frame #2, I did some printing of the xmlNodePtr node. I don't
know if this is useful or not.
(gdb) print *node->parent->parent
$8 = {_private = 0x864e288, type = XML_ELEMENT_NODE,
name = 0x84c1250 "\030ăd\bicontent", children = 0x84c7418,
last = 0x864e290, parent = 0x84b2778, next = 0x0, prev = 0x84c11d8,
doc = 0x850db48, ns = 0x0, content = 0x0, properties = 0x0, nsDef =
0x0,
psvi = 0x0, line = 0, extra = 0}
(gdb) print *node->parent->parent->parent
$9 = {_private = 0x0, type = XML_ELEMENT_NODE, name = 0x84c1268 "Module",
children = 0x84c11d8, last = 0x84c73d8, parent = 0x84a68d8,
next = 0x84c12a8, prev = 0x84ab0b0, doc = 0x850db48, ns = 0x0,
content = 0x0, properties = 0x84c1218, nsDef = 0x0, psvi = 0x0, line =
0,
extra = 0}
(gdb) print *node->parent->parent->parent->parent
$10 = {_private = 0x0, type = XML_ELEMENT_NODE, name = 0x84a6918
"Modules",
children = 0x84ac800, last = 0x84c12a8, parent = 0x850dc48, next = 0x0,
prev = 0x84b32b8, doc = 0x850db48, ns = 0x0, content = 0x0,
properties = 0x0, nsDef = 0x0, psvi = 0x0, line = 0, extra = 0}
(gdb) print *node->parent->parent->parent->parent->Parent
There is no member named Parent.
(gdb) print *node->parent->parent->parent->parent->parent
$11 = {_private = 0x0, type = XML_ELEMENT_NODE, name = 0x8304bc8
"XmlOutput",
children = 0x81e69f8, last = 0x84a68d8, parent = 0x850db48, next = 0x0,
prev = 0x0, doc = 0x850db48, ns = 0x0, content = 0x0, properties = 0x0,
nsDef = 0x0, psvi = 0x0, line = 0, extra = 0}
And, from stack frame #1, here's a print of zval * wrapper:
(gdb) print *wrapper
$12 = {value = {lval = 800, dval = 1.3580773101702994e-312, str = {
val = 0x320 <Address 0x320 out of bounds>, len = 64}, ht = 0x320,
obj = {ce = 0x320, properties = 0x40}}, type = 112 'p',
is_ref = 23 '\027', refcount = 2136}
--
Edit bug report at http://bugs.php.net/?id=28286&edit=1
--
Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=28286&r=trysnapshot4
Try a CVS snapshot (php5): http://bugs.php.net/fix.php?id=28286&r=trysnapshot5
Fixed in CVS: http://bugs.php.net/fix.php?id=28286&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=28286&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=28286&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=28286&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=28286&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=28286&r=support
Expected behavior: http://bugs.php.net/fix.php?id=28286&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=28286&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=28286&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=28286&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=28286&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=28286&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=28286&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=28286&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=28286&r=float
