View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0002046 | Xdebug | Tracing | public | 2021-11-22 10:30 | 2021-12-01 15:39 |
| Reporter | eater | Assigned To | derick | ||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | closed | Resolution | fixed | ||
| Platform | x86_64 | OS | Void Linux | ||
| Product Version | 3.1.1 | ||||
| Fixed in Version | 3.1.2 | ||||
| Summary | 0002046: Segault on xdebug_get_function_stack inside a Fiber | ||||
| Description | When I call xdebug_get_function_stack inside a Fiber I expect to see the function stack originating from the Fiber entry point instead php segfaults instantly | ||||
| Steps To Reproduce | Run the following on PHP 8.1.0RC6 with xdebug 3.1.1 <?php var_dump(xdebug_get_function_stack()); $f->start(); | ||||
| Additional Information | From preliminary inspection it looks like xdebug tries to retrieve the file of the Fiber (see https://github.com/xdebug/xdebug/blob/3.1.1/src/develop/stack.c#L1069 ) but the closure has no file associated with it as can been seen in PHP's backtrace, thus segfaulting on copying it relevant valgrind/gdb excerpts (full logs in attachments) valgrind: gdb: | ||||
| Tags | No tags attached. | ||||
| Attached Files | valgrind.log (3,556 bytes)
==7983== Memcheck, a memory error detector
==7983== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==7983== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
==7983== Command: php -d xdebug.mode=develop ./test.php
==7983==
/home/eater/test.php:3:
array(1) {
[0] =>
array(4) {
'function' =>
string(6) "{main}"
'file' =>
string(20) "/home/eater/test.php"
'line' =>
int(0)
'params' =>
array(0) {
}
}
}
==7983== Warning: client switching stacks? SP change: 0x1ffeffbfe0 --> 0x6e47fc0
==7983== to suppress, use: --max-stackframe=137306521632 or greater
/home/eater/test.php:5:
array(2) {
[0] =>
array(2) {
'function' =>
string(9) "{closure}"
'args' =>
array(0) {
}
}
[1] =>
array(7) {
'file' =>
string(20) "/home/eater/test.php"
'line' =>
int(9)
'function' =>
string(5) "start"
'class' =>
string(5) "Fiber"
'object' =>
class Fiber#1 (0) {
}
'type' =>
string(2) "->"
'args' =>
array(0) {
}
}
}
==7983== Invalid read of size 1
==7983== at 0x60FDA75: zend_string_copy (zend_string.h:191)
==7983== by 0x60FDA75: zif_xdebug_get_function_stack (stack.c:1069)
==7983== by 0x60D991C: xdebug_execute_internal (base.c:897)
==7983== by 0x5D1B1B: ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1872)
==7983== by 0x5D1B1B: execute_ex (zend_vm_execute.h:54541)
==7983== by 0x60D9081: xdebug_execute_ex (base.c:779)
==7983== by 0x55A7CF: zend_call_function (zend_execute_API.c:896)
==7983== by 0x5FD132: zend_fiber_execute (zend_fibers.c:475)
==7983== by 0x5FDE66: zend_fiber_trampoline (zend_fibers.c:287)
==7983== Address 0x4 is not stack'd, malloc'd or (recently) free'd
==7983==
==7983==
==7983== Process terminating with default action of signal 11 (SIGSEGV)
==7983== Access not within mapped region at address 0x4
==7983== at 0x60FDA75: zend_string_copy (zend_string.h:191)
==7983== by 0x60FDA75: zif_xdebug_get_function_stack (stack.c:1069)
==7983== by 0x60D991C: xdebug_execute_internal (base.c:897)
==7983== by 0x5D1B1B: ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER (zend_vm_execute.h:1872)
==7983== by 0x5D1B1B: execute_ex (zend_vm_execute.h:54541)
==7983== by 0x60D9081: xdebug_execute_ex (base.c:779)
==7983== by 0x55A7CF: zend_call_function (zend_execute_API.c:896)
==7983== by 0x5FD132: zend_fiber_execute (zend_fibers.c:475)
==7983== by 0x5FDE66: zend_fiber_trampoline (zend_fibers.c:287)
==7983== If you believe this happened as a result of a stack
==7983== overflow in your program's main thread (unlikely but
==7983== possible), you can try to increase the size of the
==7983== main thread stack using the --main-stacksize= flag.
==7983== The main thread stack size used in this run was 8388608.
==7983==
==7983== HEAP SUMMARY:
==7983== in use at exit: 3,045,394 bytes in 23,119 blocks
==7983== total heap usage: 25,596 allocs, 2,477 frees, 4,089,403 bytes allocated
==7983==
==7983== LEAK SUMMARY:
==7983== definitely lost: 28,280 bytes in 884 blocks
==7983== indirectly lost: 1,065 bytes in 2 blocks
==7983== possibly lost: 2,133,914 bytes in 17,183 blocks
==7983== still reachable: 882,135 bytes in 5,050 blocks
==7983== suppressed: 0 bytes in 0 blocks
==7983== Rerun with --leak-check=full to see details of leaked memory
==7983==
==7983== For lists of detected and suppressed errors, rerun with: -s
==7983== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
gdb.log (4,209 bytes)
Starting program: /usr/bin/php -d xdebug.mode=develop ./test.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib64/libthread_db.so.1".
/home/eater/test.php:3:
array(1) {
[0] =>
array(4) {
'function' =>
string(6) "{main}"
'file' =>
string(20) "/home/eater/test.php"
'line' =>
int(0)
'params' =>
array(0) {
}
}
}
Program received signal SIGSEGV, Segmentation fault.
zif_xdebug_get_function_stack (execute_data=<optimized out>, return_value=0x5555568acc20) at /builddir/xdebug-3.1.1/src/develop/stack.c:1069
1069 /builddir/xdebug-3.1.1/src/develop/stack.c: No such file or directory.
(gdb) bt all
No symbol "all" in current context.
(gdb) bt full
#0 zif_xdebug_get_function_stack (execute_data=<optimized out>, return_value=0x5555568acc20) at /builddir/xdebug-3.1.1/src/develop/stack.c:1069
sent_variables = <optimized out>
fse = 0x5555568ab150
i = 0
j = <optimized out>
frame = 0x5555568b1c80
params = <optimized out>
variadic_opened = 0
#1 0x00007ffff6ade91d in xdebug_execute_internal (current_execute_data=0x5555568acca0, return_value=0x5555568acc20) at /builddir/xdebug-3.1.1/src/base/base.c:897
edata = <optimized out>
fse = 0x5555568ab2f0
function_nr = 6
function_call_traced = <optimized out>
restore_error_handler_situation = 0
tmp_error_cb = 0x0
#2 0x00005555558c9b1c in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /builddir/php-8.1.0RC6/Zend/zend_vm_execute.h:1872
retval = <optimized out>
call = 0x5555568acca0
fbc = 0x55555687df30
ret = <optimized out>
call = <optimized out>
fbc = <optimized out>
ret = <optimized out>
retval = <optimized out>
#3 execute_ex (ex=0x5555568b1768) at /builddir/php-8.1.0RC6/Zend/zend_vm_execute.h:54541
vm_stack_data = {orig_opline = 0x7ffff6b20c80 <xdebug_globals>, orig_execute_data = 0x5555568ab220, hybrid_jit_red_zone = '\000' <repeats 15 times>}
#4 0x00007ffff6ade082 in xdebug_execute_ex (execute_data=0x5555568acbd0) at /builddir/xdebug-3.1.1/src/base/base.c:779
op_array = 0x555556717b88
edata = <optimized out>
fse = 0x5555568acbd0
function_nr = 5
code_coverage_function_name = 0x0
code_coverage_filename = 0x0
code_coverage_init = 0
#5 0x00005555558527d0 in zend_call_function (fci=fci@entry=0x5555568b1e18, fci_cache=fci_cache@entry=0x5555568b1e58) at /builddir/php-8.1.0RC6/Zend/zend_execute_API.c:896
orig_jit_trace_num = 0
i = <optimized out>
call = 0x5555568acbd0
fci_cache_local = {function_handler = 0x770000007b, calling_scope = 0x7c00000072, called_scope = 0x0, object = 0x3ff}
func = 0x555556717b88
call_info = <optimized out>
object_or_called_scope = <optimized out>
orig_fake_scope = 0x0
#6 0x00005555558f5133 in zend_fiber_execute (transfer=0x7ffff62eefb0) at /builddir/php-8.1.0RC6/Zend/zend_fibers.c:475
stack = <optimized out>
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {93825012538800, -6372625461540119318, 0, 0, 0, 0, -6372625461573673750, -947262616570127126}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
fiber = 0x5555568b1d70
error_reporting = 22527
#7 0x00005555558f5e67 in zend_fiber_trampoline (data=...) at /builddir/php-8.1.0RC6/Zend/zend_fibers.c:287
transfer = {context = 0x5555568749a0, value = {value = {lval = 0, dval = 0, counted = 0x0, str = 0x0, arr = 0x0, obj = 0x0, res = 0x0, ref = 0x0, ast = 0x0, zv = 0x0, ptr = 0x0, ce = 0x0, func = 0x0, ww = {w1 = 0, w2 = 0}}, u1 = {type_info = 1, v = {type = 1 '\001', type_flags = 0 '\000', u = {extra = 0}}},
u2 = {next = 0, cache_slot = 0, opline_num = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, property_guard = 0, constant_flags = 0, extra = 0}}, flags = 0 '\000'}
from = <optimized out>
context = 0x5555568b1db0
#8 0x00005555557f876f in make_fcontext () at make_x86_64_sysv_elf_gas.S:71
No locals.
#9 0x0000000000000000 in ?? ()
No symbol table info available.
| ||||
| Operating System | |||||
| PHP Version | 8.1.0-8.1.4 | ||||
|
|
I can indeed reproduce this with Xdebug 3.1.1, but not with the latest code in the xdebug_3_1 branch. I think this is a duplicated of 0002036. If you can try the latest xdebug_3_1 (or master) branch from GitHub to verify, that'd be great. The fix for 0002036 will be in Xdebug 3.1.2, which I am intending to release this week. |
|
|
Indeed works for me on master! thanks :) |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2021-11-22 10:30 | eater | New Issue | |
| 2021-11-22 10:30 | eater | File Added: valgrind.log | |
| 2021-11-22 10:30 | eater | File Added: gdb.log | |
| 2021-11-22 11:00 | derick | Assigned To | => derick |
| 2021-11-22 11:00 | derick | Status | new => feedback |
| 2021-11-22 11:00 | derick | Note Added: 0006160 | |
| 2021-11-22 11:15 | eater | Note Added: 0006161 | |
| 2021-11-22 11:15 | eater | Status | feedback => assigned |
| 2021-11-24 10:19 | derick | Status | assigned => closed |
| 2021-11-24 10:19 | derick | Resolution | open => fixed |
| 2021-11-24 10:19 | derick | Fixed in Version | => 3.1dev |
| 2021-11-24 10:19 | derick | Relationship added | duplicate of 0002036 |
| 2021-12-01 15:39 | derick | Fixed in Version | 3.1dev => 3.1.2 |