Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:45168
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain chiaraquartet.net from 209.85.219.224 cause and error)
Message-ID: <4A734423.2090001@chiaraquartet.net>
Date: Fri, 31 Jul 2009 14:21:07 -0500
User-Agent: Thunderbird 2.0.0.6 (Macintosh/20070807)
MIME-Version: 1.0
To: PHP Developers Mailing List <internals@lists.php.net>, 
 Dmitry Stogov <dmitry@zend.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: serious bug in PHP 6 ZE
From: greg@chiaraquartet.net (Greg Beaver)

Hi,

After quite a while of trying, I've tracked down the problem that is
causing occasional segfaults in run-tests.php in PHP 6.

Basically, here's what happens:

on line 1652, we call system_with_timeout() to run the test, passing in
a CV ($cmd) containing the command line to execute to run the test.  In
the cleanup of the active symbol table when returning from
system_with_timeout(), the refcount of $commandline is not correct, and
so the $cmd zval is efreed.  At some random points, the return value of
the run_test() occupies the same space that $cmd once occupied, gets
efreed, and we crash.

To get a segfault every time, put a simple var_dump($cmd); on line 1653
in run-tests.php and do "make test"

So, it seems that either refcounting is not incrementing enough, or
decrementing too much in PHP 6.

Greg