0001434: phpunit testcases segmentation fault with PHP 7.1.4, xdebug 2.5.3 on 32-bit architectures

Notes
(0004330) derick (administrator) 2017-05-01 22:01	When you say " From the build directory:", how do I get to that state?

(0004331) nacc (reporter) 2017-05-01 22:08	Yeah, a good question :) If you have an ubuntu system (16.04 or later), you should be able to do: $ pull-lp-source -d phpunit $ autopkgtest -s -U phpunit_5.4.6-1.dsc --apt-pocket=proposed -- autopkgtest-virt-lxd ubuntu-daily:artful/i386 This does presume the 'autopkgtest' package is installed and LXD has been configured. It should drop you to a shell in the container when the tests fail.

(0004332) derick (administrator) 2017-05-01 23:09	Sorry, that's probably too much for me to sort out. Can you tell me how to reproduce this otherwise with a phpunit install (or git clone), and a 32-bit PHP 7 available?

(0004333) nacc (reporter) 2017-05-01 23:37	Ok, I think I got it with the following (this is done in an Ubuntu 17.10 i386 LXD container, but I think it generalizes): apt build-dep phpunit apt source phpunit cd phpunit ./debian/rules build This should fail with two segmentation faults in testcases. One of which can be run from the extracted env as: ./phpunit --colors=never --coverage-text=php://stdout IgnoreCodeCoverageClassTest tests/_files/IgnoreCodeCoverageClassTest.php --whitelist tests/_files/IgnoreCodeCoverageClass.php The upstream version of phpunit in question is 5.4.6.

(0004336) nacc (reporter) 2017-05-03 17:16	Was able to add debug symbols for PHP: #0 xdebug_set_in_ex (set=0x56afbe60, position=153391744, noisy=1) at ./build-7.1/xdebug_set.c:71 #1 0xf5831eff in xdebug_analyse_branch (opa=opa@entry=0xf5b2d428, position=<optimized out>, position@entry=61, set=set@entry=0x56afbe60, branch_info=0x0) at ./build-7.1/xdebug_code_coverage.c:704 0000002 0xf58320cd in xdebug_analyse_branch (opa=opa@entry=0xf5b2d428, position=54, position@entry=37, set=set@entry=0x56afbe60, branch_info=0x0) at ./build-7.1/xdebug_code_coverage.c:728 0000003 0xf58320cd in xdebug_analyse_branch (opa=opa@entry=0xf5b2d428, position=36, position@entry=25, set=set@entry=0x56afbe60, branch_info=0x0) at ./build-7.1/xdebug_code_coverage.c:728 0000004 0xf58320cd in xdebug_analyse_branch (opa=opa@entry=0xf5b2d428, position=position@entry=24, set=set@entry=0x56afbe60, branch_info=0x0) at ./build-7.1/xdebug_code_coverage.c:728 0000005 0xf58320cd in xdebug_analyse_branch (opa=opa@entry=0xf5b2d428, position=23, position@entry=0, set=set@entry=0x56afbe60, branch_info=0x0) at ./build-7.1/xdebug_code_coverage.c:728 0000006 0xf583373b in xdebug_analyse_oparray (branch_info=<optimized out>, set=0x56afbe60, opa=0xf5b2d428) at ./build-7.1/xdebug_code_coverage.c:786 0000007 prefill_from_oparray (filename=0xee8bf3a8 "/usr/share/php/SebastianBergmann/CodeCoverage/CodeCoverage.php", op_array=0xf5b2d428) at ./build-7.1/xdebug_code_coverage.c:871 0000008 0xf5833968 in prefill_from_function_table (opa=<optimized out>) at ./build-7.1/xdebug_code_coverage.c:913 0000009 prefill_from_class_table (class_entry=0xf5b2c4e8) at ./build-7.1/xdebug_code_coverage.c:949 0000010 xdebug_prefill_code_coverage (op_array=0xf5ad0ae4) at ./build-7.1/xdebug_code_coverage.c:981 0000011 0xf58339e4 in xdebug_code_coverage_start_of_function (op_array=0xf5ad0ae4, function_name=0x56adf1d8 "SebastianBergmann\\CodeCoverage\\Filter->getWhitelist") at ./build-7.1/xdebug_code_coverage.c:994 0000012 0xf582e019 in xdebug_execute_ex (execute_data=0xf5a13900) at ./build-7.1/xdebug.c:1954 0000013 0x567fe148 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1076 0000014 0x567a07e2 in execute_ex (ex=0xf5a13830) at ./Zend/zend_vm_execute.h:429 0000015 0xf582dda6 in xdebug_execute_ex (execute_data=0xf5a13830) at ./build-7.1/xdebug.c:1995 0000016 0x567fe786 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:949 0000017 0x567a07e2 in execute_ex (ex=0xf5a137c0) at ./Zend/zend_vm_execute.h:429 0000018 0xf582dda6 in xdebug_execute_ex (execute_data=0xf5a137c0) at ./build-7.1/xdebug.c:1995 0000019 0x567fe786 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:949 0000020 0x567a07e2 in execute_ex (ex=0xf5a135f0) at ./Zend/zend_vm_execute.h:429 0000021 0xf582dda6 in xdebug_execute_ex (execute_data=0xf5a135f0) at ./build-7.1/xdebug.c:1995 0000022 0x567fe786 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:949 0000023 0x567a07e2 in execute_ex (ex=0xf5a13430) at ./Zend/zend_vm_execute.h:429 0000024 0xf582dda6 in xdebug_execute_ex (execute_data=0xf5a13430) at ./build-7.1/xdebug.c:1995 0000025 0x567fe786 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:949 0000026 0x567a07e2 in execute_ex (ex=0xf5a13320) at ./Zend/zend_vm_execute.h:429 0000027 0xf582dda6 in xdebug_execute_ex (execute_data=0xf5a13320) at ./build-7.1/xdebug.c:1995 0000028 0x567fe786 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:949 0000029 0x567a07e2 in execute_ex (ex=0xf5a131c0) at ./Zend/zend_vm_execute.h:429 0000030 0xf582dda6 in xdebug_execute_ex (execute_data=0xf5a131c0) at ./build-7.1/xdebug.c:1995 0000031 0x567fe148 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1076 0000032 0x567a07e2 in execute_ex (ex=0xf5a130d0) at ./Zend/zend_vm_execute.h:429 0000033 0xf582dda6 in xdebug_execute_ex (execute_data=0xf5a130d0) at ./build-7.1/xdebug.c:1995 0000034 0x567fe148 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1076 #35 0x567a07e2 in execute_ex (ex=0xf5a13060) at ./Zend/zend_vm_execute.h:429 0000036 0xf582dda6 in xdebug_execute_ex (execute_data=0xf5a13060) at ./build-7.1/xdebug.c:1995 0000037 0x567fe786 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:949 0000038 0x567a07e2 in execute_ex (ex=0xf5a13020) at ./Zend/zend_vm_execute.h:429 0000039 0xf582dda6 in xdebug_execute_ex (execute_data=0xf5a13020) at ./build-7.1/xdebug.c:1995 0000040 0x568009b2 in zend_execute (op_array=<optimized out>, return_value=<optimized out>) at ./Zend/zend_vm_execute.h:474 0000041 0x56756f9d in zend_execute_scripts (type=8, retval=0x0, file_count=3) at ./Zend/zend.c:1476 0000042 0x566f2264 in php_execute_script (primary_file=0xffffc3c4) at ./main/main.c:2537 0000043 0x56802e0d in do_cli (argc=8, argv=0x5697d260) at ./sapi/cli/php_cli.c:993 0000044 0x565c37a8 in main (argc=<optimized out>, argv=<optimized out>) at ./sapi/cli/php_cli.c:1381 My suspicion on 32-bit issues is that we successfully pass all tests on amd64, ppc64el and s390x and fail the same tests on armhf and i386.

(0004337) nacc (reporter) 2017-05-03 18:27	Hopefully this is not just noise, but some more debugging info from gdb: (gdb) info registers eax 0x1249250 19173968 ecx 0x0 0 edx 0x56b88e98 1454935704 ebx 0xf5863c08 -175752184 esp 0xffff956c 0xffff956c ebp 0x9249280 0x9249280 esi 0x0 0 edi 0x6e4 1764 eip 0xf583f2c3 0xf583f2c3 <xdebug_set_in_ex+19> eflags 0x210206 [ PF IF RF ID ] cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x63 99 (gdb) disassemble Dump of assembler code for function xdebug_set_in_ex: 0xf583f2b0 <+0>: mov 0x4(%esp),%edx 0xf583f2b4 <+4>: mov 0x8(%esp),%ecx 0xf583f2b8 <+8>: mov 0x4(%edx),%edx 0xf583f2bb <+11>: mov %ecx,%eax 0xf583f2bd <+13>: and $0x7,%ecx 0xf583f2c0 <+16>: shr $0x3,%eax => 0xf583f2c3 <+19>: movzbl (%edx,%eax,1),%eax 0xf583f2c7 <+23>: mov $0x1,%edx 0xf583f2cc <+28>: shl %cl,%edx 0xf583f2ce <+30>: and %edx,%eax 0xf583f2d0 <+32>: ret

(0004338) derick (administrator) 2017-05-03 23:57	The problem is easy to spot: #0 xdebug_set_in_ex (set=0x56afbe60, position=153391744, noisy=1) at ./build-7.1/xdebug_set.c:71 the position of 153391744 is way too high, and likely the bug. The last comment was noise ;-) I really need to reproduce this now locally before I can continue.

(0004339) derick (administrator) 2017-05-04 00:07	And I can - it is important that opcache is also loaded.

(0004340) derick (administrator) 2017-05-05 15:22	Just a note for myself for reproducibility: /dev/php/xdebug-tests/phpunit $ valgrind ./phpunit --colors=never --coverage-text=php://stdout IgnoreCodeCoverageClassTest tests/_files/IgnoreCodeCoverageClassTest.php --whitelist tests/_files/IgnoreCodeCoverageClass.php ==11944== Memcheck, a memory error detector ==11944== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==11944== Using Valgrind-3.12.0 and LibVEX; rerun with -h for copyright info ==11944== Command: ./phpunit --colors=never --coverage-text=php://stdout IgnoreCodeCoverageClassTest tests/_files/IgnoreCodeCoverageClassTest.php --whitelist tests/_files/IgnoreCodeCoverageClass.php ==11944== PHPUnit 5.4.6 by Sebastian Bergmann and contributors. Runtime: PHP 7.1.6-dev with Xdebug 2.5.3 Configuration: /home/derick/dev/php/xdebug-tests/phpunit/phpunit.xml Segmentation fault

(0004342) nacc (reporter) 2017-05-15 23:34	Thank you very much for the fix!

Issue History
Date Modified	Username	Field	Change
2017-05-01 21:55	nacc	New Issue
2017-05-01 22:01	derick	Note Added: 0004330
2017-05-01 22:01	derick	Assigned To	=> derick
2017-05-01 22:01	derick	Status	new => feedback
2017-05-01 22:08	nacc	Note Added: 0004331
2017-05-01 22:08	nacc	Status	feedback => assigned
2017-05-01 23:09	derick	Note Added: 0004332
2017-05-01 23:09	derick	Status	assigned => feedback
2017-05-01 23:37	nacc	Note Added: 0004333
2017-05-01 23:37	nacc	Status	feedback => assigned
2017-05-03 17:16	nacc	Note Added: 0004336
2017-05-03 18:27	nacc	Note Added: 0004337
2017-05-03 23:57	derick	Note Added: 0004338
2017-05-04 00:07	derick	Note Added: 0004339
2017-05-05 15:22	derick	Note Added: 0004340
2017-05-14 22:55	derick	Status	assigned => closed
2017-05-14 22:55	derick	Resolution	open => fixed
2017-05-14 22:55	derick	Fixed in Version	=> 2.5.4
2017-05-15 23:34	nacc	Note Added: 0004342

Relationships