Skip to content

Segfault in memory allocator during compilation during autoloading #11659

Closed as not planned

Description

@danog

Description

PHP config: https://paste.daniil.it/config

This is happening in a pcntl_forked process (as for the other segfaults I submitted recently).

I can DM a full coredump if needed.

ref: compressed_coredump-php.78197.1688713825

backtrace:

(gdb) backtrace
#0  zend_mm_alloc_small (bin_num=11, heap=0x7f2ccac00040) at ./Zend/zend_alloc.c:1313
#1  zend_mm_alloc_heap (size=<optimized out>, heap=0x7f2ccac00040) at ./Zend/zend_alloc.c:1384
#2  _zend_mm_alloc (heap=0x7f2ccac00040, size=<optimized out>) at ./Zend/zend_alloc.c:2382
#3  0x000055731201f5c3 in lookup_cv (name=name@entry=0x5573143c8020) at ./Zend/zend_compile.c:503
#4  0x0000557312029e53 in zend_compile_params (fallback_return_type=<optimized out>, return_type_ast=<optimized out>, ast=<optimized out>) at ./Zend/zend_compile.c:6776
#5  zend_compile_func_decl (result=<optimized out>, ast=<optimized out>, toplevel=<optimized out>) at ./Zend/zend_compile.c:7403
#6  0x000055731202b495 in zend_compile_expr_inner (ast=0x7f2cbdc2be20, result=0x7ffcb463a380) at ./Zend/zend_compile.c:10333
#7  zend_compile_expr (result=0x7ffcb463a380, ast=0x7f2cbdc2be20) at ./Zend/zend_compile.c:10350
#8  0x00005573120312ec in zend_compile_args (may_have_extra_named_args=<optimized out>, fbc=0x0, ast=<optimized out>) at ./Zend/zend_compile.c:3612
#9  zend_compile_call_common (result=0x7ffcb463a6a0, args_ast=0x7f2cbdc2be70, fbc=0x0, lineno=807) at ./Zend/zend_compile.c:3715
#10 0x000055731202ee44 in zend_compile_ns_call (name_node=0x7ffcb463a440, lineno=807, args_ast=0x7f2cbdc2be70, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:3758
#11 zend_compile_call (type=<optimized out>, ast=0x7f2cbdc2c160, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:4461
#12 zend_compile_var_inner (by_ref=<optimized out>, type=<optimized out>, ast=0x7f2cbdc2c160, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:10369
#13 zend_compile_var (result=0x7ffcb463a6a0, ast=0x7f2cbdc2c160, type=<optimized out>, by_ref=<optimized out>) at ./Zend/zend_compile.c:10395
#14 0x000055731202c29d in zend_compile_expr_inner (ast=0x7f2cbdc2c160, result=0x7ffcb463a6a0) at ./Zend/zend_compile.c:10230
#15 zend_compile_expr (result=0x7ffcb463a6a0, ast=0x7f2cbdc2c160) at ./Zend/zend_compile.c:10350
#16 0x000055731202d314 in zend_compile_assign (ast=0x7f2cbdc2c178, ast=0x7f2cbdc2c178, result=0x7ffcb463a7d0) at ./Zend/zend_compile.c:3220
#17 zend_compile_expr_inner (ast=0x7f2cbdc2c178, result=0x7ffcb463a7d0) at ./Zend/zend_compile.c:10233
#18 zend_compile_expr (result=0x7ffcb463a7d0, ast=0x7f2cbdc2c178) at ./Zend/zend_compile.c:10350
#19 0x0000557312026cc0 in zend_compile_stmt (ast=0x7f2cbdc2c178) at ./Zend/zend_compile.c:10192
#20 0x0000557312026c8f in zend_compile_stmt_list (ast=<optimized out>) at ./Zend/zend_compile.c:6176
#21 zend_compile_stmt (ast=0x7f2cbdc2bc88) at ./Zend/zend_compile.c:10100
#22 0x0000557312029951 in zend_compile_func_decl (result=<optimized out>, ast=<optimized out>, toplevel=<optimized out>) at ./Zend/zend_compile.c:7428
#23 0x0000557312027aec in zend_compile_stmt (ast=0x7f2cbdc2c9c8) at ./Zend/zend_compile.c:10153
#24 0x0000557312026c8f in zend_compile_stmt_list (ast=<optimized out>) at ./Zend/zend_compile.c:6176
#25 zend_compile_stmt (ast=0x7f2cbdc4e590) at ./Zend/zend_compile.c:10100
#26 0x000055731202acd0 in zend_compile_class_decl (result=0x0, ast=<optimized out>, toplevel=<optimized out>) at ./Zend/zend_compile.c:7909
#27 0x000055731202666c in zend_compile_top_stmt (ast=0x7f2cbdc4fb80) at ./Zend/zend_compile.c:10075
#28 0x0000557312026698 in zend_compile_top_stmt (ast=<optimized out>) at ./Zend/zend_compile.c:10064
#29 zend_compile_top_stmt (ast=0x7f2cbdbcac78) at ./Zend/zend_compile.c:10054
#30 0x000055731200813e in zend_compile (type=type@entry=2) at ./Zend/zend_language_scanner.c:620
#31 0x000055731200993a in compile_file (file_handle=0x7ffcb463b500, type=2) at ./Zend/zend_language_scanner.c:655
#32 0x00007f2cc90f26b6 in phar_compile_file (file_handle=0x7ffcb463b500, type=2) at ./ext/phar/phar.c:3355
#33 0x00007f2cca838df2 in opcache_compile_file (file_handle=0x7ffcb463b500, type=2, op_array_p=0x7ffcb463b400) at ./ext/opcache/ZendAccelerator.c:1820
#34 0x00007f2cca83b941 in persistent_compile_file (type=2, file_handle=0x7ffcb463b500) at ./ext/opcache/ZendAccelerator.c:2164
#35 persistent_compile_file (file_handle=0x7ffcb463b500, type=2) at ./ext/opcache/ZendAccelerator.c:1978
#36 0x000055731200999d in compile_filename (type=type@entry=2, filename=filename@entry=0x557314329a78) at ./Zend/zend_language_scanner.c:706
#37 0x000055731207a6f6 in zend_include_or_eval (inc_filename_zv=<optimized out>, type=2) at ./Zend/zend_execute.c:4799
#38 0x0000557312089f8e in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER () at ./Zend/zend_vm_execute.h:38948
#39 0x00005573120b090d in execute_ex (ex=0x7f2ccac00040) at ./Zend/zend_vm_execute.h:59395
#40 0x0000557312037caa in zend_call_function (fci_cache=<optimized out>, fci=<optimized out>) at ./Zend/zend_execute_API.c:947
#41 zend_call_function (fci=<optimized out>, fci_cache=<optimized out>) at ./Zend/zend_execute_API.c:749
--Type <RET> for more, q to quit, c to continue without paging--
#42 0x000055731203811d in zend_call_known_function (fn=0x55731840d038, object=<optimized out>, called_scope=<optimized out>, retval_ptr=retval_ptr@entry=0x0, param_count=param_count@entry=1,
    params=params@entry=0x7ffcb463b890, named_params=0x0) at ./Zend/zend_execute_API.c:1041
#43 0x0000557311f31257 in spl_perform_autoload (class_name=0x7f2cbe110d90, lc_name=0x7f2cbe110d58) at ./ext/spl/php_spl.c:445
#44 0x0000557312036f08 in zend_lookup_class_ex (name=<optimized out>, key=key@entry=0x0, flags=flags@entry=0) at ./Zend/zend_execute_API.c:1207
#45 0x000055731203710d in zend_lookup_class (name=<optimized out>) at ./Zend/zend_execute_API.c:1228
#46 0x0000557312062395 in class_exists_impl (return_value=0x7f2ccac15a30, skip_flags=3, flags=8, execute_data=0x7f2ccac15a40) at ./Zend/zend_builtin_functions.c:992
#47 zif_class_exists (execute_data=0x7f2ccac15a40, return_value=0x7f2ccac15a30) at ./Zend/zend_builtin_functions.c:1006
#48 0x00005573120b6123 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1637
#49 execute_ex (ex=0x7f2ccac00040) at ./Zend/zend_vm_execute.h:56056
#50 0x0000557312037caa in zend_call_function (fci_cache=<optimized out>, fci=0x7ffcb463ba50) at ./Zend/zend_execute_API.c:947
#51 zend_call_function (fci=fci@entry=0x7ffcb463bb60, fci_cache=fci_cache@entry=0x7ffcb463bb40) at ./Zend/zend_execute_API.c:749
#52 0x0000557311f6d109 in zif_array_map (execute_data=<optimized out>, return_value=0x7f2ccac156c0) at ./ext/standard/array.c:6193
#53 0x00005573120b6123 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at ./Zend/zend_vm_execute.h:1637
#54 execute_ex (ex=0x7f2ccac00040) at ./Zend/zend_vm_execute.h:56056
#55 0x00005573120b9701 in zend_execute (op_array=0x7f2ccac7e000, return_value=0x0) at ./Zend/zend_vm_execute.h:60396
#56 0x0000557312046e55 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at ./Zend/zend.c:1827
#57 0x0000557311fe23fa in php_execute_script (primary_file=<optimized out>) at ./main/main.c:2542
#58 0x000055731213050a in do_cli (argc=10, argv=0x557312e00170) at ./sapi/cli/php_cli.c:964
#59 0x0000557311e72c5b in main (argc=10, argv=0x557312e00170) at ./sapi/cli/php_cli.c:1333

zbacktrace:

(gdb) zbacktrace
[0x7f2ccac15b30] Composer\Autoload\{closure}("/zoon/zoon/vendor/composer/../../Module/Seo/Orm/MetaObject.php") /zoon/zoon/vendor/composer/ClassLoader.php:576
[0x7f2ccac15aa0] Composer\Autoload\ClassLoader->loadClass("Z\Module\Seo\Orm\MetaObject") /zoon/zoon/vendor/composer/ClassLoader.php:427
[0x7f2ccac15a40] class_exists("Z\Module\Seo\Orm\MetaObject") [internal function]
[0x7f2ccac159d0] Zoon\ORM\Mongo\MongoMapper->prepareObjectClassName() /zoon/zoon/vendor/zoon/orm/src/Mongo/MongoMapper.php:156
[0x7f2ccac15940] Zoon\ORM\Mongo\MongoMapper->__construct() /zoon/zoon/vendor/zoon/orm/src/Mongo/MongoMapper.php:173
[0x7f2ccac158b0] Zoon\ORM\Mongo\MongoMapper->get() /zoon/zoon/vendor/zoon/orm/src/Mongo/MongoMapper.php:127
// more stuff

PHP Version

PHP 8.2.7

Operating System

Ubuntu 20.04, ondrej repos

Activity

  1. kamil-tekiela commented on Nov 7, 2026

    @kamil-tekiela
    Member

    Same as #11655 I am closing it for lack of reproducible steps or ASAN log. We don't even know if the issue is in PHP core or in one of the loaded extensions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions