Bug 902741

Summary: [abrt] php-cli-5.4.11-1.fc18: gc_zval_possible_root: Process /usr/bin/php was killed by signal 11 (SIGSEGV)
Product: [Fedora] Fedora Reporter: Christof Damian <christof>
Component: phpAssignee: Joe Orton <jorton>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 18CC: fedora, jorton, jsmith.fedora, rcollet, rpm
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
Whiteboard: abrt_hash:23b8bf721dafe9a96615b377566e3894e9d8ba62
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-16 15:45:06 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: build_ids
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: smolt_data
none
File: var_log_messages
none
backtrace with most pecl extensions disabled
none
Tested with php-5.4.11-1.fc18.0.1.x86_64.rpm none

Description Christof Damian 2013-01-22 11:25:31 UTC
Description of problem:
Running phpunit on our testsuite 

Version-Release number of selected component:
php-cli-5.4.11-1.fc18

Additional info:
backtrace_rating: 4
cmdline:        php /home/christof.damian/workspace/splendia-web/bin/phpunit --configuration /home/christof.damian/workspace/splendia-web/splendia/tests/phpunit-nologging.xml
crash_function: gc_zval_possible_root
executable:     /usr/bin/php
kernel:         3.7.2-201.fc18.x86_64
remote_result:  NOTFOUND
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 gc_zval_possible_root at /usr/src/debug/php-5.4.11/Zend/zend_gc.c:143
 #1 zend_hash_destroy at /usr/src/debug/php-5.4.11/Zend/zend_hash.c:560
 #2 _zval_dtor_func at /usr/src/debug/php-5.4.11/Zend/zend_variables.c:45
 #3 _zval_dtor at /usr/src/debug/php-5.4.11/Zend/zend_variables.h:35
 #4 _zval_ptr_dtor at /usr/src/debug/php-5.4.11/Zend/zend_execute_API.c:438
 #6 destroy_zend_class at /usr/src/debug/php-5.4.11/Zend/zend_opcode.c:278
 #7 zend_hash_apply_deleter at /usr/src/debug/php-5.4.11/Zend/zend_hash.c:650
 #8 zend_hash_reverse_apply at /usr/src/debug/php-5.4.11/Zend/zend_hash.c:804
 #9 shutdown_executor at /usr/src/debug/php-5.4.11/Zend/zend_execute_API.c:305
 #10 zend_deactivate at /usr/src/debug/php-5.4.11/Zend/zend.c:938

Potential duplicate: bug 886841

Comment 1 Christof Damian 2013-01-22 11:25:42 UTC
Created attachment 685073 [details]
File: backtrace

Comment 2 Christof Damian 2013-01-22 11:25:45 UTC
Created attachment 685074 [details]
File: build_ids

Comment 3 Christof Damian 2013-01-22 11:25:47 UTC
Created attachment 685075 [details]
File: cgroup

Comment 4 Christof Damian 2013-01-22 11:25:49 UTC
Created attachment 685076 [details]
File: core_backtrace

Comment 5 Christof Damian 2013-01-22 11:25:51 UTC
Created attachment 685077 [details]
File: dso_list

Comment 6 Christof Damian 2013-01-22 11:25:53 UTC
Created attachment 685078 [details]
File: environ

Comment 7 Christof Damian 2013-01-22 11:25:56 UTC
Created attachment 685079 [details]
File: limits

Comment 8 Christof Damian 2013-01-22 11:25:58 UTC
Created attachment 685081 [details]
File: maps

Comment 9 Christof Damian 2013-01-22 11:26:00 UTC
Created attachment 685083 [details]
File: open_fds

Comment 10 Christof Damian 2013-01-22 11:26:03 UTC
Created attachment 685085 [details]
File: proc_pid_status

Comment 11 Christof Damian 2013-01-22 11:26:06 UTC
Created attachment 685087 [details]
File: smolt_data

Comment 12 Christof Damian 2013-01-22 11:26:09 UTC
Created attachment 685089 [details]
File: var_log_messages

Comment 13 Remi Collet 2013-01-22 12:20:43 UTC
*** Bug 902706 has been marked as a duplicate of this bug. ***

Comment 14 Remi Collet 2013-01-23 08:41:43 UTC
@Christof: can you confirm if this segfault occurs in previous version (<= 5.4.9)

I suspect a regression introduced in 5.4.10, with the fix for upstream bug #63635 (Segfault in gc_collect_cycles).

To avoid any mistake, can you also reproduce it without most extension currently enabled (not required by unit test) disable (especially: apc and xdebug) ?

Comment 15 Christof Damian 2013-01-24 09:52:08 UTC
Created attachment 686607 [details]
backtrace with most pecl extensions disabled

Comment 16 Christof Damian 2013-01-24 09:53:06 UTC
I also tried various combinations with apc and xdebug enabled / disabled. They all crash eventually.

Comment 17 Remi Collet 2013-01-28 13:00:10 UTC
Can you please give a try to this scratch build:
http://koji.fedoraproject.org/koji/taskinfo?taskID=4908461

This is exactly version 5.4.11 + patch for PHP bug 63535 reverted.

Notice : please download the RPM asap, as scratch build resuts are not kept online for a long time.

Comment 18 Christof Damian 2013-01-29 09:58:48 UTC
Created attachment 689730 [details]
Tested with php-5.4.11-1.fc18.0.1.x86_64.rpm

Comment 19 Remi Collet 2013-01-29 10:37:25 UTC
Thanks for the test.

So obviously this is not related to the fix.

Could you please report this upstream, to have is managed by a gc expert (above my current skill) ?

Or do you prefer I report it ?

Comment 20 Christof Damian 2013-01-29 14:33:56 UTC
If you could do it that would be nice. The PHP bug tracker is a bit to hostile for my taste. 

The whole thing is also really difficult to reproduce. Sometimes it takes eight tries until it crashes.

Comment 21 Remi Collet 2013-01-31 11:27:21 UTC
Reported upstream as https://bugs.php.net/64111

A simple reproducer will be welcome (probably not simple to find)

for gc issue, waiting for a real fix, some workaround could "reduce" crash:
- increase memory_limit (to avoid gc run)
- disable gc (zend.enable_gc), warning, this can requires much more memory

Comment 22 Christof Damian 2013-01-31 16:46:54 UTC
I have tried with enable_gc = Off and I still get crashes in a gc related function (top of the backtrace):

gc_remove_zval_from_buffer
_zval_ptr_dtor
zend_hash_destroy
zend_object_std_dtor
zend_objects_free_object_storage
zend_objects_store_del_ref_by_handle_ex
zend_objects_store_del_ref
_zval_ptr_dtor
zend_hash_destroy
_zval_dtor_func
_zval_ptr_dtor
zend_object_std_dtor
zend_objects_free_object_storage
zend_objects_store_del_ref_by_handle_ex
zend_objects_store_del_ref

I am also not running out of memory even with gc disabled. As far as I can remember this has started with phpunit 3.7 .

Comment 23 Remi Collet 2013-04-16 08:25:41 UTC
@Christof: the bug was reported against 5.4.11, does the crash still occurs with latest PHP (5.4.14 from testing) ?

Can you provide a new backtrace, and, if possible, a coredump ?

Comment 24 Christof Damian 2013-04-16 11:16:31 UTC
(In reply to comment #23)
> @Christof: the bug was reported against 5.4.11, does the crash still occurs
> with latest PHP (5.4.14 from testing) ?
> 
> Can you provide a new backtrace, and, if possible, a coredump ?

I haven't seen it for a while, though that might be due to me disabling some extensions. I will try to trigger it.

Comment 25 Christof Damian 2013-04-16 15:45:06 UTC
(In reply to comment #24)
> (In reply to comment #23)
> > @Christof: the bug was reported against 5.4.11, does the crash still occurs
> > with latest PHP (5.4.14 from testing) ?
> > 
> > Can you provide a new backtrace, and, if possible, a coredump ?
> 
> I haven't seen it for a while, though that might be due to me disabling some
> extensions. I will try to trigger it.

I can't reproduce it with 5.4.13, even with apc & xdebug enabled.