# Possible bug in zend_mm.c

- Thread: https://externals.io/message/10819
- Original archive: https://news-web.php.net/php.internals/10819
- Started by Alex Leigh on 2004-06-28T14:14:19+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #10819 — Alex Leigh — 2004-06-28T14:14:19+00:00

URL: https://externals.io/message/10819#10819

Hi all.

I have been having some problems with running PHP5 under the Continuity 
webserver, which
I wrote the SAPI module for. 5 has been working well with the apps that 
people
have been rolling out with Continuity so far, but one client has a 
large, complicated application that they
have been trying to test on PHP5 on Solaris. When pages from the app 
are hit it will randomly
crash after about 5 - 10 requests, depending. `phpinfo()` will serve all 
day long without problems. Different
pages (and really, different complicated apps) will produce the crash. 
A common denominator is that
they all use the OCI8 module to talk to Oracle, but I am not sure if 
this is directly related.

It crashes like this on the CVS head and also RC3. I saw that there 
were some changes "recently"
to zend_mm.c so I went back to RC1 and could not reproduce this crash, 
but, there was a different
crash I had that I assume is unrelated and fixed at least by RC3.

I have just started to look at this myself and was wondering if this 
jogs anyones memory or if
anyone has any pointer on where I might begin, I am not very familiar 
with the memory allocator
in PHP. Also, should I open a bug on this?

Crash #1: (more common)


=>[1] zend_mm_remove_from_free_list(heap = 0x12aca0, mm_block = 
0x1e5f8e0), line 163 in "zend_mm.c"
   [2] zend_mm_free(heap = 0x12aca0, p = 0x1e5f988), line 362 in 
"zend_mm.c"
   [3] shutdown_memory_manager(silent = 0, full_shutdown = 0, tsrm_ls = 
0x472d78), line 491 in "zend_alloc.c"
   [4] php_request_shutdown(dummy = (nil)), line 1223 in "main.c"
   [5] capi_module_main(request_context = 0x46cad8, tsrm_ls = 0x472d78), 
line 451 in "capi.c"
   [6] phpFservice(t = 0x10afe0, opts = 0xb7200), line 486 in "capi.c"
   [7] dlFpipeline_exec(payload = 0x10afe0, catid = 4, limit_name = 
0xfef05fb0 "type", limit_value = 0x46ca90 "PHP/5.0.0-dev"), line 316 in 
"dl.c"
   [8] httpFhandler(0x3888510, 0x0, 0xff051a00, 0x0, 0x0, 0x0), at 
0xfef03050
   [9] thrFthread(arg = 0x1cf33d8), line 529 in "thr.c"

mm_block = 0x1e5f8e0
__func__ = "zend_mm_remove_from_free_list"
heap = 0x12aca0
*mm_block = {
     size            = 0
     type            = 0
     prev_size       = 0
     prev_free_block = 0x47
     next_free_block = (nil)
}

=============================================

Crash #2: (less common)

=>[1] zend_mm_alloc(heap = 0x122c90, size = 264U), line 308 in 
"zend_mm.c"
   [2] _emalloc(size = 256U), line 182 in "zend_alloc.c"
   [3] zend_stack_init(stack = 0xf9688), line 28 in "zend_stack.c"
   [4] shutdown_executor(tsrm_ls = 0x30d1d8), line 232 in 
"zend_execute_API.c"
   [5] zend_deactivate(tsrm_ls = 0x30d1d8), line 819 in "zend.c"
   [6] php_request_shutdown(dummy = (nil)), line 1212 in "main.c"
   [7] capi_module_main(request_context = 0x30ca88, tsrm_ls = 0x30d1d8), 
line 451 in "capi.c"
   [8] phpFservice(t = 0x10afe0, opts = 0xb7200), line 486 in "capi.c"
   [9] dlFpipeline_exec(payload = 0x10afe0, catid = 4, limit_name = 
0xfef05fb0 "type", limit_value = 0x30ca58 "PHP/5.0.0-dev"), line 316 in 
"dl.c"
   [10] httpFhandler(0x3c927b8, 0x0, 0xff051a00, 0x0, 0x0, 0x0), at 
0xfef03050
   [11] thrFthread(arg = 0x2e367b0), line 529 in "thr.c"

free_list_bucket = 0xfdf63d3c
index = 35U
best_fit = 0x3179550
p = 0x7000000
true_size = 280U
size = 264U
__func__ = "zend_mm_alloc"
heap = 0x122c90
(dbx) print *free_list_bucket
*free_list_bucket = 0x40000002


--
Alex Leigh - www.configuredlight.com
The difference between theory and reality
is that in theory there is no difference.