Bug 727292

Summary: crash when running wordpress (and zarafa)
Product: Red Hat Enterprise Linux 6 Reporter: Matěj Cepl <mcepl>
Component: phpAssignee: Joe Orton <jorton>
Status: CLOSED NOTABUG QA Contact: BaseOS QE - Apps <qe-baseos-apps>
Severity: high Docs Contact:
Priority: unspecified    
Version: 6.1CC: milo, redhat-bugzilla
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-01-09 16:51:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
illustration of corrupted wordpress none

Description Matěj Cepl 2011-08-01 18:20:01 UTC
Created attachment 516195 [details]
illustration of corrupted wordpress

Description of problem:
When running wordpress on my RHEL-6 server, I get PHP crashing:

Complete!
[root@luther ~]# gdb httpd
GNU gdb (GDB) Red Hat Enterprise Linux (7.2-48.el6)
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/sbin/httpd...Reading symbols from /usr/lib/debug/usr/sbin/httpd.debug...done.
done.
(gdb) set follow-fork-mode  child
(gdb) run
Starting program: /usr/sbin/httpd 
[Thread debugging using libthread_db enabled]
[New process 25685]
[Thread debugging using libthread_db enabled]
[tcsetpgrp failed in terminal_inferior: Tento proces neexistuje]
[New process 25686]
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7b37750 (LWP 25686)]
_zend_mm_free_int (heap=0x2c3ad0, p=0x5e5450) at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2018
2018		if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
(gdb) thread apply all backtrace

Thread 3 (Thread 0xb7b37750 (LWP 25686)):
#0  _zend_mm_free_int (heap=0x2c3ad0, p=0x5e5450) at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2018
#1  0xb75d5e0e in _zval_dtor_func (zvalue=0x5e407c) at /usr/src/debug/php-5.3.3/Zend/zend_variables.c:44
#2  0xb75c9a1e in _zval_dtor (zval_ptr=0xbfffcf6c) at /usr/src/debug/php-5.3.3/Zend/zend_variables.h:35
#3  _zval_ptr_dtor (zval_ptr=0xbfffcf6c) at /usr/src/debug/php-5.3.3/Zend/zend_execute_API.c:443
#4  0xb75fd2ee in zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST (prop_dim=0, execute_data=0x49ab54) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:10951
#5  0xb75fdafe in execute (op_array=0x4eeff8) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:107
#6  0xb75d6106 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-5.3.3/Zend/zend.c:1194
#7  0xb757cc96 in php_execute_script (primary_file=0xbffff2d4) at /usr/src/debug/php-5.3.3/main/main.c:2260
#8  0xb7665633 in php_handler (r=0x47fa38) at /usr/src/debug/php-5.3.3/sapi/apache2handler/sapi_apache2.c:669
#9  0x00136401 in ap_run_handler (r=0x47fa38) at /usr/src/debug/httpd-2.2.15/server/config.c:158
#10 0x0013a186 in ap_invoke_handler (r=0x47fa38) at /usr/src/debug/httpd-2.2.15/server/config.c:376
#11 0x00146ec8 in ap_process_request (r=0x47fa38) at /usr/src/debug/httpd-2.2.15/modules/http/http_request.c:282
#12 0x001439a8 in ap_process_http_connection (c=0x46d548) at /usr/src/debug/httpd-2.2.15/modules/http/http_core.c:190
#13 0x0013ec91 in ap_run_process_connection (c=0x46d548) at /usr/src/debug/httpd-2.2.15/server/connection.c:43
#14 0x0014c31a in child_main (child_num_arg=<value optimized out>) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:667
#15 0x0014c6ae in make_child (s=<value optimized out>, slot=0) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:763
#16 0x0014cab2 in startup_children (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:781
#17 ap_mpm_run (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:1002
#18 0x00120a32 in main (argc=1, argv=0xbffff804) at /usr/src/debug/httpd-2.2.15/server/main.c:740
(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
_zend_mm_free_int (heap=0x2c3ad0, p=0x5e5450) at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2018
2018		if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
(gdb) thread apply all backtrace

Thread 3 (Thread 0xb7b37750 (LWP 25686)):
#0  _zend_mm_free_int (heap=0x2c3ad0, p=0x5e5450) at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2018
#1  0xb75d5e0e in _zval_dtor_func (zvalue=0x5e407c) at /usr/src/debug/php-5.3.3/Zend/zend_variables.c:44
#2  0xb75c9a1e in _zval_dtor (zval_ptr=0xbfffcf6c) at /usr/src/debug/php-5.3.3/Zend/zend_variables.h:35
#3  _zval_ptr_dtor (zval_ptr=0xbfffcf6c) at /usr/src/debug/php-5.3.3/Zend/zend_execute_API.c:443
#4  0xb75fd2ee in zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST (prop_dim=0, execute_data=0x49ab54) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:10951
#5  0xb75fdafe in execute (op_array=0x4eeff8) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:107
#6  0xb75d6106 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-5.3.3/Zend/zend.c:1194
#7  0xb757cc96 in php_execute_script (primary_file=0xbffff2d4) at /usr/src/debug/php-5.3.3/main/main.c:2260
#8  0xb7665633 in php_handler (r=0x47fa38) at /usr/src/debug/php-5.3.3/sapi/apache2handler/sapi_apache2.c:669
#9  0x00136401 in ap_run_handler (r=0x47fa38) at /usr/src/debug/httpd-2.2.15/server/config.c:158
#10 0x0013a186 in ap_invoke_handler (r=0x47fa38) at /usr/src/debug/httpd-2.2.15/server/config.c:376
#11 0x00146ec8 in ap_process_request (r=0x47fa38) at /usr/src/debug/httpd-2.2.15/modules/http/http_request.c:282
#12 0x001439a8 in ap_process_http_connection (c=0x46d548) at /usr/src/debug/httpd-2.2.15/modules/http/http_core.c:190
#13 0x0013ec91 in ap_run_process_connection (c=0x46d548) at /usr/src/debug/httpd-2.2.15/server/connection.c:43
#14 0x0014c31a in child_main (child_num_arg=<value optimized out>) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:667
#15 0x0014c6ae in make_child (s=<value optimized out>, slot=0) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:763
#16 0x0014cab2 in startup_children (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:781
#17 ap_mpm_run (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:1002
#18 0x00120a32 in main (argc=1, argv=0xbffff804) at /usr/src/debug/httpd-2.2.15/server/main.c:740
(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
_zend_mm_free_int (heap=0x2c3ad0, p=0x5e5450) at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2018
2018		if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
(gdb) thread apply all backtrace

Thread 3 (Thread 0xb7b37750 (LWP 25686)):
#0  _zend_mm_free_int (heap=0x2c3ad0, p=0x5e5450) at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2018
#1  0xb75d5e0e in _zval_dtor_func (zvalue=0x5e407c) at /usr/src/debug/php-5.3.3/Zend/zend_variables.c:44
#2  0xb75c9a1e in _zval_dtor (zval_ptr=0xbfffcf6c) at /usr/src/debug/php-5.3.3/Zend/zend_variables.h:35
#3  _zval_ptr_dtor (zval_ptr=0xbfffcf6c) at /usr/src/debug/php-5.3.3/Zend/zend_execute_API.c:443
#4  0xb75fd2ee in zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST (prop_dim=0, execute_data=0x49ab54) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:10951
#5  0xb75fdafe in execute (op_array=0x4eeff8) at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:107
#6  0xb75d6106 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php-5.3.3/Zend/zend.c:1194
#7  0xb757cc96 in php_execute_script (primary_file=0xbffff2d4) at /usr/src/debug/php-5.3.3/main/main.c:2260
#8  0xb7665633 in php_handler (r=0x47fa38) at /usr/src/debug/php-5.3.3/sapi/apache2handler/sapi_apache2.c:669
#9  0x00136401 in ap_run_handler (r=0x47fa38) at /usr/src/debug/httpd-2.2.15/server/config.c:158
#10 0x0013a186 in ap_invoke_handler (r=0x47fa38) at /usr/src/debug/httpd-2.2.15/server/config.c:376
#11 0x00146ec8 in ap_process_request (r=0x47fa38) at /usr/src/debug/httpd-2.2.15/modules/http/http_request.c:282
#12 0x001439a8 in ap_process_http_connection (c=0x46d548) at /usr/src/debug/httpd-2.2.15/modules/http/http_core.c:190
#13 0x0013ec91 in ap_run_process_connection (c=0x46d548) at /usr/src/debug/httpd-2.2.15/server/connection.c:43
#14 0x0014c31a in child_main (child_num_arg=<value optimized out>) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:667
#15 0x0014c6ae in make_child (s=<value optimized out>, slot=0) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:763
#16 0x0014cab2 in startup_children (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:781
#17 ap_mpm_run (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0) at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:1002
#18 0x00120a32 in main (argc=1, argv=0xbffff804) at /usr/src/debug/httpd-2.2.15/server/main.c:740
(gdb) 


I get similar crashes reported with zarafa, but this backtrace is from wordpress.

Version-Release number of selected component (if applicable):
wordpress-3.2.1-1.el6.noarch
php-5.3.3-3.el6.i686
httpd-2.2.15-9.el6.i686

How reproducible:
100% (after a moment of using wordpress, I get crash everytime, steps below are the most effective ones)

Steps to Reproduce:
1.login to wordpress 
2.go to posts
3.
  
Actual results:
page doesn't draw completely

Expected results:
there should be a list of posts

Additional info:

Comment 2 RHEL Program Management 2011-08-01 18:48:36 UTC
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.

Comment 4 Matěj Cepl 2011-08-02 14:43:32 UTC
With 

export MALLOC_CHECK_=2
export USE_ZEND_ALLOC=0
gdb httpd

(sorry I found this easier than trying to connect gdb to five processes at once; probably my lack of understanding of gdb) I got this:

Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb7b37750 (LWP 4918)]
0xb7fdf416 in __kernel_vsyscall ()
(gdb) thread apply all backtrace

Thread 3 (Thread 0xb7b37750 (LWP 4918)):
#0  0xb7fdf416 in __kernel_vsyscall ()
#1  0xb7bbbd71 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0xb7bbd64a in abort () at abort.c:92
#3  0xb7c00073 in malloc_printerr (action=<value optimized out>, 
    str=0x6 <Address 0x6 out of bounds>, ptr=0x5d8fe0) at malloc.c:6288
#4  0xb7c04b60 in __libc_free (mem=0x5d8fe0) at malloc.c:3699
#5  0xb75b7ff3 in _efree (ptr=0x5d8fe0)
    at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2348
#6  0xb75c9a28 in _zval_ptr_dtor (zval_ptr=0xbfffcf4c)
    at /usr/src/debug/php-5.3.3/Zend/zend_execute_API.c:444
#7  0xb75fd2ee in zend_isset_isempty_dim_prop_obj_handler_SPEC_VAR_CONST (
    prop_dim=0, execute_data=0xb237a39c)
    at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:10951
#8  0xb75fdafe in execute (op_array=0x4b2a00)
    at /usr/src/debug/php-5.3.3/Zend/zend_vm_execute.h:107
#9  0xb75d6106 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /usr/src/debug/php-5.3.3/Zend/zend.c:1194
#10 0xb757cc96 in php_execute_script (primary_file=0xbffff2b4)
    at /usr/src/debug/php-5.3.3/main/main.c:2260
#11 0xb7665633 in php_handler (r=0x479e88)
    at /usr/src/debug/php-5.3.3/sapi/apache2handler/sapi_apache2.c:669
#12 0x00136401 in ap_run_handler (r=0x479e88)
    at /usr/src/debug/httpd-2.2.15/server/config.c:158
#13 0x0013a186 in ap_invoke_handler (r=0x479e88)
    at /usr/src/debug/httpd-2.2.15/server/config.c:376
#14 0x00146ec8 in ap_process_request (r=0x479e88)
    at /usr/src/debug/httpd-2.2.15/modules/http/http_request.c:282
#15 0x001439a8 in ap_process_http_connection (c=0x453a00)
    at /usr/src/debug/httpd-2.2.15/modules/http/http_core.c:190
#16 0x0013ec91 in ap_run_process_connection (c=0x453a00)
    at /usr/src/debug/httpd-2.2.15/server/connection.c:43
#17 0x0014c31a in child_main (child_num_arg=<value optimized out>)
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:667
#18 0x0014c6ae in make_child (s=<value optimized out>, slot=0)
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:763
#19 0x0014cab2 in startup_children (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0)
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:781
#20 ap_mpm_run (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0)
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:1002
#21 0x00120a32 in main (argc=1, argv=0xbffff7e4)
    at /usr/src/debug/httpd-2.2.15/server/main.c:740
(gdb)

Comment 5 Matěj Cepl 2011-08-02 15:27:13 UTC
This one is from running zarafa (httpd -X is awesome):

Program received signal SIGABRT, Aborted.
0xb7fdf416 in __kernel_vsyscall ()
(gdb) thread apply all backtrace

Thread 1 (Thread 0xb7b37750 (LWP 5666)):
#0  0xb7fdf416 in __kernel_vsyscall ()
#1  0xb7bbbd71 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0xb7bbd64a in abort () at abort.c:92
#3  0xb7c00073 in malloc_printerr (action=<value optimized out>, 
    str=0x6 <Address 0x6 out of bounds>, ptr=0x5a465f) at malloc.c:6288
#4  0xb7c04b60 in __libc_free (mem=0x5a465f) at malloc.c:3699
#5  0xb4c6ce32 in operator delete (ptr=0x5a465f)
    at ../../../../libstdc++-v3/libsupc++/del_op.cc:44
#6  0xb4c6ce8e in operator delete[] (ptr=0x5a465f)
    at ../../../../libstdc++-v3/libsupc++/del_opv.cc:32
#7  0xb5fb1b17 in MAPIFreeBuffer (lpBuffer=0x5bc788) at mapix.cpp:2653
#8  0xb5fc4d57 in ECMemTable::HrClear (this=0x619f88) at ECMemTable.cpp:563
#9  0xb5fc5861 in ECMemTable::~ECMemTable (this=0x619f88, 
    __in_chrg=<value optimized out>) at ECMemTable.cpp:118
#10 0xb5fc5913 in ECMemTable::~ECMemTable (this=0x619f88, 
    __in_chrg=<value optimized out>) at ECMemTable.cpp:124
#11 0xb5fdd00e in ECUnknown::Suicide (this=0x619f88) at ECUnknown.cpp:184
#12 0xb5fdd13d in ECUnknown::Release (this=0x619f88) at ECUnknown.cpp:104
#13 0xb2536996 in ECMessage::~ECMessage (this=0x58c390, 
    __in_chrg=<value optimized out>) at ECMessage.cpp:158
#14 0xb25ab9ff in ECArchiveAwareMessage::~ECArchiveAwareMessage (
    this=0x58c390, __in_chrg=<value optimized out>)
    at ECArchiveAwareMessage.cpp:117
#15 0xb25abab3 in ECArchiveAwareMessage::~ECArchiveAwareMessage (
    this=0x58c390, __in_chrg=<value optimized out>)
    at ECArchiveAwareMessage.cpp:117
#16 0xb5fdd00e in ECUnknown::Suicide (this=0x58c390) at ECUnknown.cpp:184
#17 0xb5fdd13d in ECUnknown::Release (this=0x58c390) at ECUnknown.cpp:104
#18 0xb2533a3c in ECMessage::xMessage::Release (this=0x58c468)
    at ECMessage.cpp:2920
#19 0xb6029bd8 in _php_free_mapi_object (rsrc=0x5d6728) at main.cpp:641
#20 0xb75e6034 in list_entry_destructor (ptr=0x5d6728)
    at /usr/src/debug/php-5.3.3/Zend/zend_list.c:184
#21 0xb75e2c61 in zend_hash_apply_deleter (ht=0xb7744fa4, p=0x4f64b8)
    at /usr/src/debug/php-5.3.3/Zend/zend_hash.c:611
#22 0xb75e2f27 in zend_hash_graceful_reverse_destroy (ht=0xb7744fa4)
    at /usr/src/debug/php-5.3.3/Zend/zend_hash.c:646
#23 0xb75e5eae in zend_destroy_rsrc_list (ht=0xb7744fa4)
    at /usr/src/debug/php-5.3.3/Zend/zend_list.c:240
#24 0xb75d6b67 in zend_deactivate ()
    at /usr/src/debug/php-5.3.3/Zend/zend.c:896
#25 0xb757d8e8 in php_request_shutdown (dummy=0x0)
    at /usr/src/debug/php-5.3.3/main/main.c:1633
#26 0xb7665574 in php_apache_request_dtor (r=0x479eb8)
    at /usr/src/debug/php-5.3.3/sapi/apache2handler/sapi_apache2.c:509
#27 php_handler (r=0x479eb8)
    at /usr/src/debug/php-5.3.3/sapi/apache2handler/sapi_apache2.c:681
---Type <return> to continue, or q <return> to quit---
#28 0x00136401 in ap_run_handler (r=0x479eb8)
    at /usr/src/debug/httpd-2.2.15/server/config.c:158
#29 0x0013a186 in ap_invoke_handler (r=0x479eb8)
    at /usr/src/debug/httpd-2.2.15/server/config.c:376
#30 0x00146ec8 in ap_process_request (r=0x479eb8)
    at /usr/src/debug/httpd-2.2.15/modules/http/http_request.c:282
#31 0x001439a8 in ap_process_http_connection (c=0x453a30)
    at /usr/src/debug/httpd-2.2.15/modules/http/http_core.c:190
#32 0x0013ec91 in ap_run_process_connection (c=0x453a30)
    at /usr/src/debug/httpd-2.2.15/server/connection.c:43
#33 0x0014c31a in child_main (child_num_arg=<value optimized out>)
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:667
#34 0x0014c659 in make_child (s=<value optimized out>, slot=0)
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:707
#35 0x0014ce1f in ap_mpm_run (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0)
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:983
#36 0x00120a32 in main (argc=2, argv=0xbffff7d4)
    at /usr/src/debug/httpd-2.2.15/server/main.c:740
(gdb)

Comment 6 Matěj Cepl 2011-08-02 15:56:16 UTC
Uncovering comment 5 so milo can see it (I thought adding him to CC is enough).

Comment 7 Matěj Cepl 2011-08-16 15:29:28 UTC
Just to note that with recompiled php-5.3.6-4.el6.i686 (from F16 package) both wordpress and zimbra are working just fine.

Comment 8 Matěj Cepl 2011-08-16 21:10:26 UTC
(In reply to comment #7)
> Just to note that with recompiled php-5.3.6-4.el6.i686 (from F16 package) both
> wordpress and zimbra are working just fine.

That was too early praise. This is when subscribing from identi.ca to my local status.net account (with php-5.3.6-4.el6.i686):


Program received signal SIGSEGV, Segmentation fault.
0xb75e4804 in zend_hash_find (ht=0x760914, arKey=0xb2d37464 "REQUEST_URI", 
    nKeyLength=12, pData=0xbfffcdfc)
    at /usr/src/debug/php-5.3.6/Zend/zend_hash.c:883
883		p = ht->arBuckets[nIndex];
Missing separate debuginfos, use: debuginfo-install php-eaccelerator-0.9.6.1-1.el6.i686 t1lib-5.1.2-6.el6.i686
(gdb) thread apply all backtrace

Thread 1 (Thread 0xb7b37750 (LWP 30299)):
#0  0xb75e4804 in zend_hash_find (ht=0x760914, arKey=0xb2d37464 "REQUEST_URI", 
    nKeyLength=12, pData=0xbfffcdfc)
    at /usr/src/debug/php-5.3.6/Zend/zend_hash.c:883
#1  0xb7644f75 in zend_symtable_find (result=0x563d30, 
    container_ptr=<value optimized out>, dim=0xb2d35ef0, dim_is_tmp_var=0, 
    type=0) at /usr/src/debug/php-5.3.6/Zend/zend_hash.h:360
#2  zend_fetch_dimension_address_inner (result=0x563d30, 
    container_ptr=<value optimized out>, dim=0xb2d35ef0, dim_is_tmp_var=0, 
    type=0) at /usr/src/debug/php-5.3.6/Zend/zend_execute.c:805
#3  zend_fetch_dimension_address_read (result=0x563d30, 
    container_ptr=<value optimized out>, dim=0xb2d35ef0, dim_is_tmp_var=0, 
    type=0) at /usr/src/debug/php-5.3.6/Zend/zend_execute.c:1031
#4  0xb7646842 in ZEND_FETCH_DIM_R_SPEC_VAR_CONST_HANDLER (
    execute_data=0x563c90)
    at /usr/src/debug/php-5.3.6/Zend/zend_vm_execute.h:9865
#5  0xb75fe4be in execute (op_array=0x7e4b3c)
    at /usr/src/debug/php-5.3.6/Zend/zend_vm_execute.h:107
#6  0xb75d66a6 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /usr/src/debug/php-5.3.6/Zend/zend.c:1194
#7  0xb757c906 in php_execute_script (primary_file=0xbffff1b4)
    at /usr/src/debug/php-5.3.6/main/main.c:2268
#8  0xb76662f3 in php_handler (r=0x499d30)
    at /usr/src/debug/php-5.3.6/sapi/apache2handler/sapi_apache2.c:669
#9  0x00136401 in ap_run_handler (r=0x499d30)
    at /usr/src/debug/httpd-2.2.15/server/config.c:158
#10 0x0013a186 in ap_invoke_handler (r=0x499d30)
    at /usr/src/debug/httpd-2.2.15/server/config.c:376
#11 0x00146d14 in ap_internal_redirect (
    new_uri=0x499d00 "/index.php?p=api/statuses/user_timeline/2.atom", 
    r=0x497fb0) at /usr/src/debug/httpd-2.2.15/modules/http/http_request.c:502
#12 0xb77ac319 in handler_redirect (r=0x497fb0)
    at /usr/src/debug/httpd-2.2.15/modules/mappers/mod_rewrite.c:4829
#13 0x00136401 in ap_run_handler (r=0x497fb0)
    at /usr/src/debug/httpd-2.2.15/server/config.c:158
#14 0x0013a186 in ap_invoke_handler (r=0x497fb0)
    at /usr/src/debug/httpd-2.2.15/server/config.c:376
#15 0x00146ec8 in ap_process_request (r=0x497fb0)
    at /usr/src/debug/httpd-2.2.15/modules/http/http_request.c:282
#16 0x001439a8 in ap_process_http_connection (c=0x485ac0)
    at /usr/src/debug/httpd-2.2.15/modules/http/http_core.c:190
#17 0x0013ec91 in ap_run_process_connection (c=0x485ac0)
    at /usr/src/debug/httpd-2.2.15/server/connection.c:43
#18 0x0014c31a in child_main (child_num_arg=<value optimized out>)
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:667
#19 0x0014c659 in make_child (s=<value optimized out>, slot=0)
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:707
#20 0x0014ce1f in ap_mpm_run (_pconf=0x16c0b8, plog=0x19a170, s=0x16dfb0)
---Type <return> to continue, or q <return> to quit---
    at /usr/src/debug/httpd-2.2.15/server/mpm/prefork/prefork.c:983
#21 0x00120a32 in main (argc=2, argv=0xbffff7f4)
    at /usr/src/debug/httpd-2.2.15/server/main.c:740
(gdb)

Comment 9 Joe Orton 2011-08-17 07:36:16 UTC
Is eAccelerator configured/enabled?  Is this reproducible with it removed?

php-eaccelerator-0.9.6.1-1.el6.i686

Comment 10 Matěj Cepl 2011-08-18 10:20:18 UTC
Right, thank you. That was it. Somebody suggested php-eaccelerator for status.net and I haven't understood correctly that PHP program needs to have a special for php-eaccelerator to work correctly.

So, yes, it is partially PEBKAC but still php shouldn't crash, should it?

Comment 11 Joe Orton 2012-01-09 16:51:04 UTC
"shouldn't crash" - yes, but it's an eAccelerator bug if it causes PHP to crash.