View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0001277Xdebugpublic2016-03-02 05:222016-03-04 15:32
Reporterbittercookie Assigned Toderick  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Product Version2.4.0rc4 
Fixed in Version2.4.1 
Summary0001277: Crash when another extension calls call_user_function() with params during RINIT
Description(PHP 5.5.30) When trying to use xdebug and my extension, php during first RINIT without executing anything.

Program received signal SIGSEGV, Segmentation fault.

    /lib/x86_64-linux-gnu/libc.so.6(+0x36eb0) [0x7fc25c258eb0]
    /SpyTest/PHP/Compatibility/PHP_Runtime/PHP/lib/php/extensions/no-debug-non-zts-20121212/xdebug.so(xdebug_hash_extended_find+0x5b) [0x7fc255286e6b]
    /SpyTest/PHP/Compatibility/PHP_Runtime/PHP/lib/php/extensions/no-debug-non-zts-20121212/xdebug.so(+0x1f5ad) [0x7fc2552875ad]
    /SpyTest/PHP/Compatibility/PHP_Runtime/PHP/lib/php/extensions/no-debug-non-zts-20121212/xdebug.so(xdebug_profiler_function_user_end+0x15b) [0x7fc255287acb]
    /SpyTest/PHP/Compatibility/PHP_Runtime/PHP/lib/php/extensions/no-debug-non-zts-20121212/xdebug.so(xdebug_execute_internal+0x308) [0x7fc255277d58]
    php-fpm: pool www(zend_call_function+0xc8d) [0x76815d]
    php-fpm: pool www(call_user_function_ex+0x5f) [0x76821f]
    php-fpm: pool www(call_user_function+0x46) [0x768296]
    ...

the pseudocode in RINIT is:

zval rs_function_name, rs_function_ret;
INIT_ZVAL_STRING(rs_function_name, "register_shutdown_function");
CALL_PARAM rs_param[1];
CALL_PARAM_STRING(rs_param[0], "my_rshutdowncall");
if (call_user_function(EG(function_table), NULL, &rs_function_name, &rs_function_ret, 1, rs_param TSRMLS_CC) == SUCCESS) {
}
DTOR_ZVAL_PTR(&rs_function_name);
DTOR_ZVAL_PTR(&rs_function_ret);
zval_ptr_dtor(&rs_param[0]);
TagsNo tags attached.
Operating SystemCentOS
PHP Version5.5.30-5.5.34

Activities

derick

2016-03-02 11:12

administrator   ~0003538

Please provide working code, I do not have to time to rewrite part of your extension to reproduce a crash.

Besides the working extension code, I'd also need a way how to reproduce this on the command line - likely, your php.ini settings have an influence on this (I am guessing the profiler related ones).

bittercookie

2016-03-03 04:53

reporter  

xdebug-crush-extension.rar (1,938 bytes)

bittercookie

2016-03-03 04:57

reporter   ~0003539

Last edited: 2016-03-03 05:02

 "xdebug-crush-extension.rar" for the bug.

You must add the following configuration

xdebug.profiler_enable=1
xdebug.profiler_output_dir="/tmp"


add a php script to your website:

echo "<?php phpinfo(); ?>" > /var/www/html/info.php

visite info.php in browser

derick

2016-03-04 15:32

administrator   ~0003540

Thanks, with that I could reproduce it. I did need *two* requests though, and not just one. It's fixed on GitHub now and ready for 2.4.1.

Issue History

Date Modified Username Field Change
2016-03-02 05:22 bittercookie New Issue
2016-03-02 11:12 derick Note Added: 0003538
2016-03-02 11:12 derick Assigned To => derick
2016-03-02 11:12 derick Status new => feedback
2016-03-03 04:53 bittercookie File Added: xdebug-crush-extension.rar
2016-03-03 04:57 bittercookie Note Added: 0003539
2016-03-03 04:57 bittercookie Status feedback => assigned
2016-03-03 04:57 bittercookie Note Edited: 0003539
2016-03-03 05:02 bittercookie Note Edited: 0003539
2016-03-04 15:32 derick Note Added: 0003540
2016-03-04 15:32 derick Status assigned => closed
2016-03-04 15:32 derick Resolution open => fixed
2016-03-04 15:32 derick Fixed in Version => 2.4.1
2016-07-31 12:35 derick Category Debug client (console) => debugclient (debugging tool)
2016-07-31 12:35 derick Category debugclient (debugging tool) => (No Category)