Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:10271
Return-Path: <andi@zend.com>
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Delivered-To: mailing list internals@lists.php.net
Received: (qmail 2452 invoked by uid 1010); 5 Jun 2004 21:45:13 -0000
Delivered-To: ezmlm-scan-internals@lists.php.net
Delivered-To: ezmlm-internals@lists.php.net
Received: (qmail 2066 invoked from network); 5 Jun 2004 21:45:09 -0000
Received: from unknown (HELO mail.zend.com) (192.117.235.230)
  by pb1.pair.com with SMTP; 5 Jun 2004 21:45:09 -0000
Received: (qmail 11897 invoked from network); 5 Jun 2004 21:45:03 -0000
Received: from guardian.zend.office (HELO AndiNotebook.zend.com) (10.1.1.4)
  by int.zend.com with SMTP; 5 Jun 2004 21:45:03 -0000
Message-ID: <5.1.0.14.2.20040606003504.03222810@127.0.0.1>
X-Sender: andi@127.0.0.1 (Unverified)
X-Mailer: QUALCOMM Windows Eudora Version 5.1
Date: Sun, 06 Jun 2004 00:35:51 +0300
To: Stefan Esser <sesser@php.net>,internals@lists.php.net
In-Reply-To: <40C1ED88.3000508@php.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"; format=flowed
Subject: Re: [PHP-DEV] Zend Engine 2 - ZTS Bugs Round 2
From: andi@zend.com (Andi Gutmans)
References: <40C1ED88.3000508@php.net>

Do you have a short reproducing script?
Do you think it's a problem with the memory management or does it just seem 
to be a bug which is appearing due to the changes?
Thanks,
Andi

At 05:58 PM 6/5/2004 +0200, Stefan Esser wrote:
>Hi,
>
>I have added a backtrace of a crash that occurs when a class function is 
>destructed in ZTS.
>It seems I only saw this because of Hardened-PHP using globals. Since Andi 
>disabled ZEND_MM on
>Win32 the same kind of errors should be seen on any Windows PHP 
>installation (I guess).
>
>Between 4 and 2. The tsrm_ls value changes. This happens because 
>zend_hash_del_key_or_index calls
>the destructor (in this case destroy_zend_function) with only one 
>parameter. It does NOT call it with
>a valid tsrm_ls value. So it is filled with stack crap.
>
>Stefan
>
>#0  0x0814a899 in zend_llist_apply_with_argument (l=0x81e2440, 
>func=0x814ad2c <zend_extension_op_array_dtor_handler>, arg=0x826c288,
>    tsrm_ls=0x401be9dc) at 
> /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_llist.c:322
>        l = (zend_llist *) 0x81e2440
>        arg = (void *) 0x826c288
>        tsrm_ls = (void ***) 0x401be9dc
>        element = (zend_llist_element *) 0x4024d890
>#1  0x0814b1a4 in destroy_op_array (op_array=0x826c288, tsrm_ls=0x401be9dc)
>    at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_opcode.c:232
>        op_array = (zend_op_array *) 0x826c288
>        opline = (zend_op *) 0x4024d890
>        end = (zend_op *) 0x4024d890
>        i = 1076156560
>#2  0x0814ae9a in destroy_zend_function (function=0x826c288, 
>tsrm_ls=0x401be9dc)
>    at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_opcode.c:103
>        function = (zend_function *) 0x118
>#3  0x081587dc in zend_hash_del_key_or_index (ht=0x81e6580, 
>arKey=0x826ff30 "", nKeyLength=90, h=0, flag=0)
>    at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_hash.c:485
>        h = 280
>        nIndex = 37
>        p = (Bucket *) 0x826ff10
>#4  0x08158d37 in zend_hash_reverse_apply (ht=0x81e6580, 
>apply_func=0x8146f08 <is_not_internal_function>, tsrm_ls=0x81e2db0)
>    at /XXX/hardened-php/php5/php-5.0.0RC3RC2/Zend/zend_hash.c:733
>        result = 1
>        ht = (HashTable *) 0x81e6580
>        p = (Bucket *) 0x826fde8
>        q = (Bucket *) 0x3
>
>--
>PHP Internals - PHP Runtime Development Mailing List
>To unsubscribe, visit: http://www.php.net/unsub.php