From: cosborne at gmail dot com Operating system: Windows Server 2K3 PHP version: 5.1.4 PHP Bug Type: IIS related Bug description: Worker process crash on recycle/shutdown (With cause)
Description: ------------ The IIS worker process (W3WP.exe) crashes with an access violation when the application pool is recycled or IIS is shutdown/restarted. A number of people have reported this bug, or related bugs, so technically this is a duplicate report, but as I believe I've determined the root cause, I believe it warrants a new report, since the others are in various states, and with various, spurious or conflicting "fixes" and "causes". Bugs almost certainly related to this include: #36853 #38111 #37575 Reproduce code: --------------- Load any PHP script hosted on an IIS server, and either wait for the worker process to be recycled after the specified idle period, or restart IIS. The IIS worker process (W3WP.exe) will fault. The fault may be "silent", causing an event to be logged. Expected result: ---------------- The worker process should exit gracefully. Actual result: -------------- As part of the PHP shutdown process, xmlGetGlobalState is called, as shown in the following stack trace: ChildEBP RetAddr 0007f9b8 01a2d4b4 php5ts!xmlGetGlobalState+0x65 0007f9bc 01a34175 php5ts!__xmlLastError+0x14 0007f9c0 01a457d6 php5ts!xmlResetLastError+0x5 0007f9c4 01a06b63 php5ts!xmlCleanupParser+0x36 0007f9c8 01a06e95 php5ts!php_libxml_shutdown+0x13 [ext\libxml\libxml.c @ 558] 0007f9cc 018472fc php5ts!zm_shutdown_libxml+0x5 [ext\libxml\libxml.c @ 634] 0007f9e4 018dc234 php5ts!module_destructor+0x4c [Zend\zend_API.c @ 1811] 0007f9fc 018dc303 php5ts!zend_hash_apply_deleter+0x24 [Zend\zend_hash.c @ 576] 0007fa0c 018421ee php5ts!zend_hash_graceful_reverse_destroy+0x13 [Zend\zend_hash.c @ 643] 0007fa24 018fbf3a php5ts!zend_shutdown+0x2e [Zend\zend.c @ 730] 0007fa3c 018fbeef php5ts!php_module_shutdown+0x3a [main\main.c @ 1615] 0007fa4c 01832550 php5ts!php_module_shutdown_wrapper+0xf [main\main.c @ 1584] ... 0007fa54 0183268d php5isapi!DllMain+0x70 0007fa74 7c82257a php5isapi!DllMain+0x1ad 0007fa94 7c818145 ntdll!LdrpCallInitRoutine+0x14 0007fba8 77e67b95 ntdll!LdrUnloadDll+0x40e 0007fbbc 5a32843a kernel32!FreeLibrary+0x41 0007fbcc 5a3275a5 w3isapi!ISAPI_DLL::Unload+0x38 0007fbd4 5a327642 w3isapi!ISAPI_DLL::~ISAPI_DLL+0x10 0007fbe0 5a324087 w3isapi!ISAPI_DLL::`scalar deleting destructor'+0xd xmlGetGlobalState creates a thread that runs xmlGlobalStateCleanupHelper, which simply waits for the calling thread to exit, then frees the global state. Herein lies the problem. Since the thread on which xmlGlobalStateCleanupHelper is in the process of unloading the php5isapi.dll module (as shown in the stack trace), and hence also unloading php5ts.dll, when this thread finally terminates, and the xmlGetGlobalStateCleanupHelper thread resumes an access violation occurs since the module has been unloaded and the memory is no longer allocated. -- Edit bug report at http://bugs.php.net/?id=38190&edit=1 -- Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=38190&r=trysnapshot44 Try a CVS snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=38190&r=trysnapshot52 Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=38190&r=trysnapshot60 Fixed in CVS: http://bugs.php.net/fix.php?id=38190&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=38190&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=38190&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=38190&r=needscript Try newer version: http://bugs.php.net/fix.php?id=38190&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=38190&r=support Expected behavior: http://bugs.php.net/fix.php?id=38190&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=38190&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=38190&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=38190&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=38190&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=38190&r=dst IIS Stability: http://bugs.php.net/fix.php?id=38190&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=38190&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=38190&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=38190&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=38190&r=mysqlcfg
