Segmentation fault in PHP7 beta2

[guoxiao]

I try to use this extension in PHP7 beta2 and php crashed.

test.php:
<?php 
$redis = new Redis();
$redis->connect('127.0.0.1');
$redis->get('hello');

% php test.php
[1]    90702 segmentation fault (core dumped)  php test.php

% lldb /usr/local/bin/php -c /cores/core.90702                                                                                                           :(
(lldb) target create "/usr/local/bin/php" --core "/cores/core.90702"
warning: (x86_64) /cores/core.90702 load command 116 LC_SEGMENT_64 has a fileoff + filesize (0x218de000) that extends beyond the end of the file (0x218dd000), the segment will be truncated to match
warning: (x86_64) /cores/core.90702 load command 117 LC_SEGMENT_64 has a fileoff (0x218de000) that extends beyond the end of the file (0x218dd000), ignoring this section
bCore file '/cores/core.90702' (x86_64) was loaded.
(lldb) bt
* thread #1: tid = 0x0000, 0x00007fff87744fd6 libsystem_platform.dylib`_platform_memmove$VARIANT$Haswell + 182, stop reason = signal SIGSTOP
  * frame #0: 0x00007fff87744fd6 libsystem_platform.dylib`_platform_memmove$VARIANT$Haswell + 182
    frame #1: 0x0000000108e1fd41 redis.so`redis_cmd_format_static + 3355
    frame #2: 0x0000000108e183d7 redis.so`redis_key_cmd + 115
    frame #3: 0x0000000108e040b2 redis.so`zim_Redis_get + 115
    frame #4: 0x0000000107d9201d php`ZEND_DO_FCALL_SPEC_HANDLER + 625
    frame #5: 0x0000000107d7ccea php`execute_ex + 34
    frame #6: 0x0000000107d7ce28 php`zend_execute + 307
    frame #7: 0x0000000107d337e5 php`zend_eval_stringl + 493
    frame #8: 0x0000000107b7c9bd php`readline_shell_run + 2743
    frame #9: 0x0000000107dd2429 php`do_cli + 2860
    frame #10: 0x0000000107dd16d5 php`main + 1290
    frame #11: 0x00007fff8b8375ad libdyld.dylib`start + 1
    frame #12: 0x00007fff8b8375ad libdyld.dylib`start + 1

[Jan-E]

What happens if you do a 'sudo php test.php'?

[guoxiao]

@Jan-E It still crashs.

[Jan-E]

Pity. I tested your script on Windows (with an external redis server). To be sure it did not crash, I added this to the script:

var_dump($redis->info());

No problems and the expected output. The crash seems to happen only on *nix systems.

[guoxiao]

I find that only $redis->get() crashes. If I run $redis->set() or $redis->info() it will not crash.

[guoxiao]

I try to run $redis->info() in debug version of PHP7-beta2, and it outputs as following:

[Wed Jul  8 12:01:23 2015]  Script:  '/private/tmp/test.php'
/private/tmp/php7-redis20150707-87622-1yqzi9t/library.c(981) :  Freeing 0x10DC01660 (11 bytes), script=/private/tmp/test.php
Last leak repeated 25 times
[Wed Jul  8 12:01:23 2015]  Script:  '/private/tmp/test.php'
Zend/zend_string.h(98) :  Freeing 0x10DC77700 (224 bytes), script=/private/tmp/test.php
=== Total 27 memory leaks detected ===

May it be helpful for you.

[SonicGD]

Can confirm segfault when call get() on debain jessie and php7 beta1.

<?php
$r = new Redis();
$r->connect('127.0.0.1',6379);
var_dump($r->info()); //dump
$r->set('foo','bar');  //ok
echo $r->get('foo'); //segfault

[edtechd]

Hi, I have performed some changes, could you please try the updated version?

[SonicGD]

Now it's working. Will try more complex commands.

[guoxiao]

It works on my machine now.

[SonicGD]

I catch another segfault on evalSHA call

lldb php -c core
Core file 'core' (x86_64) was loaded.
Process 0 stopped
* thread #1: tid = 0, 0x00007f2b88b7e9b4 redis.so`redis_sock_get(id=0x00007f2b00000000, redis_sock=0x00007ffd70688cf8, no_throw=0) + 4 at redis.c:433, name = 'php', stop reason = signal SIGSEGV
    frame #0: 0x00007f2b88b7e9b4 redis.so`redis_sock_get(id=0x00007f2b00000000, redis_sock=0x00007ffd70688cf8, no_throw=0) + 4 at redis.c:433
   430
   431      zval *socket;
   432
-> 433      if (Z_TYPE_P(id) != IS_OBJECT || (socket = zend_hash_str_find(Z_OBJPROP_P(id), "socket",
   434                      sizeof("socket") - 1)) == NULL) {
   435          // Throw an exception unless we've been requested not to
   436          if(!no_throw) {
(lldb) bt
* thread #1: tid = 0, 0x00007f2b88b7e9b4 redis.so`redis_sock_get(id=0x00007f2b00000000, redis_sock=0x00007ffd70688cf8, no_throw=0) + 4 at redis.c:433, name = 'php', stop reason = signal SIGSEGV
  * frame #0: 0x00007f2b88b7e9b4 redis.so`redis_sock_get(id=0x00007f2b00000000, redis_sock=0x00007ffd70688cf8, no_throw=0) + 4 at redis.c:433
    frame #1: 0x00007f2b88b96efd redis.so`zim_Redis_evalsha(execute_data=0x00007f2b890143e0, return_value=0x00007ffd70688e40) + 141 at redis.c:3124
    frame #2: 0x00000000007884ab php`zend_call_function(fci=0x00007ffd70688e80, fci_cache=0x00007ffd70688e50) + 1915 at zend_execute_API.c:874
    frame #3: 0x00000000006d26de php`zif_call_user_func_array(execute_data=0x00007f2b89014360, return_value=0x00007f2b89014330) + 206 at basic_functions.c:4807
    frame #4: 0x0000000000829315 php`ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER + 549 at zend_vm_execute.h:706
    frame #5: 0x00000000007d692b php`execute_ex(ex=<unavailable>) + 27 at zend_vm_execute.h:406
    frame #6: 0x00000000007883aa php`zend_call_function(fci=0x00007ffd706890d0, fci_cache=0x00007f2b890142a0) + 1658 at zend_execute_API.c:855
    frame #7: 0x000000000067a126 php`zim_reflection_method_invokeArgs(execute_data=0x00007f2b89070248, return_value=0x00007f2b89013c00) + 438 at php_reflection.c:3365
    frame #8: 0x0000000000829ec2 php`ZEND_DO_FCALL_SPEC_HANDLER + 1890 at zend_vm_execute.h:835
    frame #9: 0x00000000007d692b php`execute_ex(ex=<unavailable>) + 27 at zend_vm_execute.h:406
    frame #10: 0x000000000082d687 php`zend_execute(op_array=0x00007f2b89083000, return_value=<unavailable>) + 423 at zend_vm_execute.h:450
    frame #11: 0x00000000007979f5 php`zend_execute_scripts(type=<unavailable>, retval=<unavailable>, file_count=<unavailable>) + 229 at zend.c:1399
    frame #12: 0x000000000073a108 php`php_execute_script(primary_file=0x00007ffd7068b7d0) + 632 at main.c:2475
    frame #13: 0x000000000082eeec php`do_cli(argc=<unavailable>, argv=<unavailable>) + 4060 at php_cli.c:971
    frame #14: 0x000000000043f7f7 php`main(argc=<unavailable>, argv=<unavailable>) + 1063 at php_cli.c:1338
    frame #15: 0x00007f2b8c6f5b45 libc.so.6`__libc_start_main + 245
    frame #16: 0x000000000043f938 php`_start + 41

[edtechd]

It is fixed now

[SonicGD]

Yes, now it segfault on other call

 lldb php -c core
Core file '/var/www/cg2/core' (x86_64) was loaded.
Process 0 stopped
* thread #1: tid = 0, 0x0000000000794d10 php`_zval_dtor_func(p=0x0000000000000000) at zend_variables.c:32, name = 'php', stop reason = signal SIGSEGV
    frame #0: 0x0000000000794d10 php`_zval_dtor_func(p=0x0000000000000000) at zend_variables.c:32
   29
   30   ZEND_API void ZEND_FASTCALL _zval_dtor_func(zend_refcounted *p ZEND_FILE_LINE_DC)
   31   {
-> 32           switch (GC_TYPE(p)) {
   33                   case IS_STRING:
   34                   case IS_CONSTANT: {
   35                                   zend_string *str = (zend_string*)p;
(lldb) bt
* thread #1: tid = 0, 0x0000000000794d10 php`_zval_dtor_func(p=0x0000000000000000) at zend_variables.c:32, name = 'php', stop reason = signal SIGSEGV
  * frame #0: 0x0000000000794d10 php`_zval_dtor_func(p=0x0000000000000000) at zend_variables.c:32
    frame #1: 0x00007f8c89996dfe redis.so`redis_build_eval_cmd [inlined] _zval_dtor(zvalue=<unavailable>, zvalue=<unavailable>) + 21 at zend_variables.h:43
    frame #2: 0x00007f8c89996de9 redis.so`redis_build_eval_cmd(redis_sock=<unavailable>, ret=0x00007ffd95a46838, keyword=<unavailable>, value=0x00007f8c817a3948, val_len=<unavailable>, args=<unavailable>, keys_count=0) + 457 at redis.c:3089
    frame #3: 0x00007f8c89996f34 redis.so`zim_Redis_evalsha(execute_data=0x00007f8c89e14080, return_value=0x00007ffd95a469a0) + 196 at redis.c:3129
    frame #4: 0x000000000078859b php`zend_call_function(fci=0x00007ffd95a469e0, fci_cache=0x00007ffd95a469b0) + 1915 at zend_execute_API.c:874
    frame #5: 0x00000000006d274e php`zif_call_user_func_array(execute_data=0x00007f8c89e14000, return_value=0x00007f8c89e13fd0) + 206 at basic_functions.c:4808
    frame #6: 0x0000000000828c75 php`ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER + 549 at zend_vm_execute.h:706
    frame #7: 0x00000000007d62ab php`execute_ex(ex=<unavailable>) + 27 at zend_vm_execute.h:406
    frame #8: 0x000000000078849a php`zend_call_function(fci=0x00007ffd95a46c20, fci_cache=0x00007f8c89e13f40) + 1658 at zend_execute_API.c:855
    frame #9: 0x00000000006d274e php`zif_call_user_func_array(execute_data=0x00007f8c89e13700, return_value=0x00007f8c89e136d0) + 206 at basic_functions.c:4808
    frame #10: 0x0000000000828c75 php`ZEND_DO_FCALL_BY_NAME_SPEC_HANDLER + 549 at zend_vm_execute.h:706
    frame #11: 0x00000000007d62ab php`execute_ex(ex=<unavailable>) + 27 at zend_vm_execute.h:406
    frame #12: 0x000000000082cfe7 php`zend_execute(op_array=0x00007f8c89e830e0, return_value=<unavailable>) + 423 at zend_vm_execute.h:450
    frame #13: 0x0000000000797345 php`zend_execute_scripts(type=<unavailable>, retval=<unavailable>, file_count=<unavailable>) + 229 at zend.c:1399
    frame #14: 0x000000000073a178 php`php_execute_script(primary_file=0x00007ffd95a49320) + 632 at main.c:2475
    frame #15: 0x000000000082e86c php`do_cli(argc=<unavailable>, argv=<unavailable>) + 4060 at php_cli.c:971
    frame #16: 0x000000000043f7f7 php`main(argc=<unavailable>, argv=<unavailable>) + 1063 at php_cli.c:1338
    frame #17: 0x00007f8c8d47db45 libc.so.6`__libc_start_main + 245
    frame #18: 0x000000000043f938 php`_start + 41

[ParkFramework]

Yes, error is reproduced
customwebapps#1