Hello list,
We've recently come across a segfault in php-fpm 0.6, which occurs
about the time when Zend extensions are enabled / loaded.

To enable core files for FPM:

sudo -s
echo '/tmp/core-%e.%p' > /proc/sys/kernel/core_pattern
echo 0 > /proc/sys/kernel/core_uses_pid
exit
ulimit -c unlimited
# nano /etc/php5/fpm/php5-fpm.conf
line 116: "Set max core size rlimit"
<value name="rlimit_core">unlimited</value>

To read the core files:
sudo /etc/init.d/php5-fpm start
sudo killall -9 php5-fpm
sudo gdbtui /usr/bin/php5-fpm /tmp/core-php5-fpm.5024

Core was generated by `/usr/bin/php5-fpm --fpm-config
/etc/php5/fpm/php5-fpm.conf'.
Program terminated with signal 11, Segmentation fault.
(gdb) bt
#0 0x08339955 in _zend_hash_add_or_update (ht=0x85c2f00,
arKey=0x85865f2 "FCGI_MAX_CONNS", nKeyLength=<error type>,
pData=0xbfedfa8c, nDataSize=<error type>, pDest=0x0, flag=2)
at /build/buildd/php5-5.2.10.dfsg.1/Zend/zend_hash.c:402
#1 0x083a399b in fcgi_set_mgmt_var (name=0x85865f2 "FCGI_MAX_CONNS",
name_len=<error type>, value=0xbfedfb21 "5", value_len=<error type>)
at /build/buildd/php5-5.2.10.dfsg.1/fpm/src/sapi/fastcgi.c:1294
#2 0x083aabfb in fpm_php_init_child (wp=0x9c0b6c8) at
/build/buildd/php5-5.2.10.dfsg.1/fpm/src/fpm/fpm_php.c:139
#3 0x083a761a in fpm_children_make (wp=0x9c0b6c8, in_event_loop=0) at
/build/buildd/php5-5.2.10.dfsg.1/fpm/src/fpm/fpm_children.c:138
#4 0x083a6136 in fpm_run (max_requests=0xbfedfd80) at
/build/buildd/php5-5.2.10.dfsg.1/fpm/src/fpm/fpm.c:65
#5 0x083a27a7 in main (argc=3, argv=0xbfee1ea4) at
/build/buildd/php5-5.2.10.dfsg.1/fpm/src/sapi/cgi_main.c:1449


|384 ZEND_API int _zend_hash_add_or_update(HashTable *ht, char
*arKey, uint nKeyLength, void *pData, uint nDataSize, void **pDest,
int flag ZEND_FILE_LINE_DC)
│385 {
│386 ulong h;
│387 uint nIndex;
│388 Bucket *p;
│389
│390 IS_CONSISTENT(ht);
│391
│392 if (nKeyLength <= 0) {
│393 #if ZEND_DEBUG
│394 ZEND_PUTS("zend_hash_update: Can't put in
empty key\n");
│395 #endif
│396 return FAILURE;
│397 }
│398
│399 h = zend_inline_hash_func(arKey, nKeyLength);
│400 nIndex = h & ht->nTableMask;
│401
>│402 p = ht->arBuckets[nIndex];
│403 while (p != NULL) {
│404 if ((p->h == h) && (p->nKeyLength ==
nKeyLength)) {
│405 if (!memcmp(p->arKey, arKey,
nKeyLength)) {
│406 if (flag & HASH_ADD) {
│407 return FAILURE;
│408 }
│409
HANDLE_BLOCK_INTERRUPTIONS();
│410 #if ZEND_DEBUG
│411 if (p->pData == pData) {
│412 ZEND_PUTS("Fatal
error in zend_hash_update: p->pData == pData\n");
│413
HANDLE_UNBLOCK_INTERRUPTIONS();
│414 return FAILURE;
│415 }
│416 #endif



Best regards,

dreamcat4
dreamcat4@gmail.com

Is this only for zend extensions?

In 5.3 didn't they remove zend extensions and now everything is just
an extension? (Is this an issue in 5.3 I guess?)

On Fri, Aug 28, 2009 at 7:32 AM, dreamcat four<dreamcat4@gmail.com> wrote:
>
> Hello list,
> We've recently come across a segfault in php-fpm 0.6, which occurs
> about the time when Zend extensions are enabled / loaded.

On Fri, Aug 28, 2009 at 5:17 PM, Michael Shadle<mike503@gmail.com> wrote:
>
> Is this only for zend extensions?
>
> In 5.3 didn't they remove zend extensions and now everything is just
> an extension? (Is this an issue in 5.3 I guess?)

Don't know. But this is 5.2.10 code. The stack shows the FPM child
process initialization function is trying to store variable
"FCGI_MAX_CONNS", using the helper fastcgi.c / fcgi_set_mgmt_var().

The lower level function _zend_hash_add_or_update() is called
previously many times with success (to set other variables). Zend code
is building a hash lookup table for functions whilst loading the
extensions. We seem to segfault late on in this loading process, after
the core extensions, the "PDO" extension and "fast-cgi" extension.


dreamcat4
dreamcat4@gmail.com