Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:87757
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.213.171 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CABBJUpcYRLxYJXAjbyzyjXCgiZox54Eqnzk16n6-tBhqoWCqeA@mail.gmail.com>
References: <CAO3MkaBiX-vDk5xJwwNhvpGRtt_WR2uMSjA31WHcoU6xH0pWAA@mail.gmail.com>
	<CABBJUpcYRLxYJXAjbyzyjXCgiZox54Eqnzk16n6-tBhqoWCqeA@mail.gmail.com>
Date: Fri, 14 Aug 2015 13:09:46 -0500
Message-ID: <CAO3MkaDECpOLk+oocmz+MqG=gtFa7OMuTyhkYCugDQAMwvpMEQ@mail.gmail.com>
To: Xinchen Hui <laruence@php.net>
Cc: "internals@lists.php.net" <internals@lists.php.net>, Dmitry Stogov <dmitry@zend.com>
Content-Type: multipart/alternative; boundary=047d7bea2f986134b7051d495b1b
Subject: Re: [PHP-DEV] Need help finding segfault in php 7
From: neclimdul@gmail.com (James Gilliland)

--047d7bea2f986134b7051d495b1b
Content-Type: text/plain; charset=UTF-8

Man I'm glad you figured that out because even with the test case I can't
figure out what's going on :)

On Fri, Aug 14, 2015 at 12:15 PM, Xinchen Hui <laruence@php.net> wrote:

> Hey:
>
>
> On Thu, Aug 13, 2015 at 8:36 PM, James Gilliland <neclimdul@gmail.com>
> wrote:
> > So I've been trying for a couple days to narrow down this bug:
> > https://bugs.php.net/bug.php?id=70242
> >
> > I can consistently recreate it with a complex test, but I have thus far
> not
> > been able to find a pattern that helps me narrow down to a test script. I
> > thought maybe I could reach out and see if I could get some help
> > understanding what is happening in php and see if that has any clues.
> >
> >
> > Seemingly important facts I've found digging through in gdb.
> > 1) The connection related pointers on the stmt are already freed when the
> > fault happens. It looks like the statement is being freed after the
> > connection and the if (S->H->server) { surrounding the failing code is
> not
> > sufficient to catch this
> > 2) The trace has a spl_iterator in it so it seems like that is holding on
> > to the stmt pointer. There is a IteratorIterator used on a PDO stmt in
> the
> > code. But also in a lot of other non-triggering seemingly identical code
> > and I haven't been able to get this to work.
> > 3) The code in shutdown_executor that is triggering this is the 6th block
> > of cleanups which seems to support 1). It is the block without any
> > documentation which is sort of my luck in this.
> >
> > I'm guessing there is some way I need to trick a object to hold onto a
> > reference through the other cleanups or something or trigger some sort of
> > reference counter quirk but I just can't find it. Any help is
> appreciated.
>
> thanks for the ssh access , I finally get the reason of this bug..
>
> I  get a simple reproduce script and quick fix. all listed in
> https://bugs.php.net/bug.php?id=70272&thanks=1
>
> @dmitry: do you see a better solution ?
>
> thanks
>
>
> --
> Xinchen Hui
> @Laruence
> http://www.laruence.com/
>

--047d7bea2f986134b7051d495b1b--