Phalcon 1.3.0 segfault

[viktoras25]

Just tried several times:

Code:

die("OK");

dmesg:

php[12611]: segfault at 55463a ip 00007f5e5843dbbf sp 00007fff190636d0 error 7 in phalcon.so[7f5e583c2000+29e000]
php[20399]: segfault at 55463a ip 00007f6f6ece6bbf sp 00007fffc082d830 error 7 in phalcon.so[7f6f6ec6b000+29e000]
php[20426]: segfault at 55463a ip 00007fc3e27aabbf sp 00007fff9474fa80 error 7 in phalcon.so[7fc3e272f000+29e000]

This code causes php to crash, when Phalcon is enabled. Doesn't crash when disabled. Phalcon installed from /ext.

Here is my installation script:

cd /tmp 
git clone https://github.com/phalcon/cphalcon.git
cd cphalcon/ext
git checkout origin/1.3.0
phpize
./configure
make
sudo make install
sudo restart-all
cd /tmp
rm -rf cphalcon

[ghost]

Does this happen if you run php index.php or smth like this?

[viktoras25]

Yes, in CLI

18.11.2013, â 12:14, Vladimir Kolesnikov [email protected] íàïèñàë(à):

Does this happen if you run php index.php or smth like this?

—
Reply to this email directly or view it on GitHub.

[ghost]

Could you please generate a core dump and get the backtrace?

sudo apt-get install gdb
git clone https://github.com/phalcon/cphalcon.git
cd cphalcon/ext
git checkout origin/1.3.0
phpize
./configure CFLAGS="-O0 -g3"
make -j4
sudo make install
ulimit -c unlimited
sudo service apport stop
php index.php
gdb `which php` core

and at the gdb prompt run

bt
bt full
quit

[viktoras25]

Unfortunately my php isn't compiled in debug mode, therefore all that I see is:

#0  0x00007f28d5664457 in ?? ()
#1  0x00007fff5f4e8d60 in ?? ()
#2  0x0000000000000000 in ?? ()

[viktoras25]

Ok, trying different versions I found that:
b7f69e9 works
next one, 831b230, doesn't.

[viktoras25]

PHP version 5.4.19 if that helps

[ghost]

OK, I will install PHP 5.4.19 and try to reproduce this. Is this stock version of PHP or manually built one?

[viktoras25]

CentOS 6 yum installed stock php

[ghost]

OK, will install a CentOS tonight and check what is wrong.

[ghost]

#0  0x029c38fc in zm_post_zend_deactivate_phalcon () at /root/tmp/cphalcon/ext/phalcon.c:954
954                     INIT_PZVAL(phalcon_globals->z_false);

[ghost]

Related: #1510

[ghost]

diff --git a/ext/phalcon.c b/ext/phalcon.c
index dc33837..5043c85 100644
--- a/ext/phalcon.c
+++ b/ext/phalcon.c
@@ -946,26 +946,26 @@ static ZEND_MODULE_POST_ZEND_DEACTIVATE_D(phalcon)
 #endif

        if (CG(unclean_shutdown)) {
-               zend_phalcon_globals *phalcon_globals = PHALCON_VGLOBAL;
+               zend_phalcon_globals *pg = PHALCON_VGLOBAL;

-               INIT_ZVAL(*phalcon_globals->z_null);
-               Z_ADDREF_P(phalcon_globals->z_null);
+               INIT_ZVAL(*pg->z_null);
+               Z_ADDREF_P(pg->z_null);

-               INIT_PZVAL(phalcon_globals->z_false);
-               Z_ADDREF_P(phalcon_globals->z_false);
-               ZVAL_FALSE(phalcon_globals->z_false);
+               INIT_PZVAL(pg->z_false);
+               Z_ADDREF_P(pg->z_false);
+               ZVAL_FALSE(pg->z_false);

-               INIT_PZVAL(phalcon_globals->z_true);
-               Z_ADDREF_P(phalcon_globals->z_true);
-               ZVAL_TRUE(phalcon_globals->z_true);
+               INIT_PZVAL(pg->z_true);
+               Z_ADDREF_P(pg->z_true);
+               ZVAL_TRUE(pg->z_true);

-               INIT_PZVAL(phalcon_globals->z_zero);
-               Z_ADDREF_P(phalcon_globals->z_zero);
-               ZVAL_LONG(phalcon_globals->z_zero, 0);
+               INIT_PZVAL(pg->z_zero);
+               Z_ADDREF_P(pg->z_zero);
+               ZVAL_LONG(pg->z_zero, 0);

-               INIT_PZVAL(phalcon_globals->z_one);
-               Z_ADDREF_P(phalcon_globals->z_one);
-               ZVAL_LONG(phalcon_globals->z_one, 1);
+               INIT_PZVAL(pg->z_one);
+               Z_ADDREF_P(pg->z_one);
+               ZVAL_LONG(pg->z_one, 1);
        }

        return SUCCESS;

[ghost]

The bug happened due to the way PHALCON_VGLOBAL macro expands for NTS PHP:

#define PHALCON_VGLOBAL &(phalcon_globals)

Thus,

zend_phalcon_globals *phalcon_globals = PHALCON_VGLOBAL;

becomes

zend_phalcon_globals *phalcon_globals = &(phalcon_globals);

Local phalcon_globals shadows the global one resulting in a garbage value and segfault.

[viktoras25]

Thanks!