Skip to content

Fix SIGSEGV double free (aka Unexpected memory piece)#1605

Merged
DrDet merged 1 commit into
masterfrom
dvakmsan/fix-sigsegv-double-free
Apr 13, 2026
Merged

Fix SIGSEGV double free (aka Unexpected memory piece)#1605
DrDet merged 1 commit into
masterfrom
dvakmsan/fix-sigsegv-double-free

Conversation

@DrDet
Copy link
Copy Markdown
Contributor

@DrDet DrDet commented Apr 9, 2026

Tips PR reorders runtime subsytems deinitializations to prevent SIGSEGV and "Unexpected memory piece" errors.

The main reason - wrong time of freeing Confdata and InstanceCache.
They MUST be freed at the very end. IC and CD call force_destroy() on runtime primitives inside, which forcibly sets refcnt to zero. It leads to double free if someone tries to destroy such primitives after it (e.g. in case of destroying saved callbacks capturing objects from InstanceCache or Confdata).

Minimal reproducer with register_kphp_on_oom_callback:

<?php

// run like this: `./a -f 3 -H 4444 --oom-handling-memory-ratio 0.01`
// load testing like this `ab -n 10000 -c 20 http://localhost:4444/` constantly catches some SIGSEGVs

/**
 * @kphp-immutable-class
 * @kphp-serializable
 */
class A {
    /** @kphp-serialized-field 1 */
    public string $name;
    function __construct() {
        $this->name = "qwerty";
    }
}

function myF($m) {
    fprintf(STDERR, "refcnt = " . get_reference_counter($m) . "\n");
    $a = (string)$m;
}

function demo() {
    instance_cache_store("test", new A);
    $a = instance_cache_fetch(A::class, "test");
    $str = $a->name;
    echo "OK: $str!\n";
    myF(123);
    myF($str);
    register_kphp_on_oom_callback(function () use ($a) {
        fprintf(STDERR, "\$a->name = " . $a->name . "\n");
    });
}

demo();

@DrDet DrDet changed the title Fix SIGSEGV double free (aka Unexpected memory piece) Draft: Fix SIGSEGV double free (aka Unexpected memory piece) Apr 9, 2026
Comment thread runtime/interface.cpp Outdated
@DrDet DrDet force-pushed the dvakmsan/fix-sigsegv-double-free branch from 9b7e63c to 9cb1c50 Compare April 10, 2026 13:29
- move callbacks to the very begin
- move instance cache and confdata to the very end
@DrDet DrDet force-pushed the dvakmsan/fix-sigsegv-double-free branch from 9cb1c50 to 571bf57 Compare April 10, 2026 15:45
@DrDet DrDet changed the title Draft: Fix SIGSEGV double free (aka Unexpected memory piece) Fix SIGSEGV double free (aka Unexpected memory piece) Apr 10, 2026
@DrDet DrDet added bug Something isn't working kphp Affects compiler or runtime in default mode (not K2) labels Apr 13, 2026
@DrDet DrDet added this to the next milestone Apr 13, 2026
Copy link
Copy Markdown
Contributor

@PetrShumilov PetrShumilov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK

Copy link
Copy Markdown
Contributor

@apolyakov apolyakov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

@DrDet DrDet merged commit bbdd69c into master Apr 13, 2026
7 checks passed
@DrDet DrDet deleted the dvakmsan/fix-sigsegv-double-free branch April 13, 2026 15:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working kphp Affects compiler or runtime in default mode (not K2)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants