hp_get_function_stack crash

[wjiacn]

0x00000000005e8b74 in ?? ()
#1 0x00000000005b0f57 in ?? ()
#2 0x000000000061056c in zend_vspprintf ()
#3 0x00000000006106b3 in zend_spprintf ()
#4 0x00007f8d4c0a4047 in hp_get_function_stack (entry=entry@entry=0x1e0e340, level=level@entry=2) at /root/xhprof_mysql/extension/xhprof.c:582
#5 0x00007f8d4c0a4195 in hp_mode_hier_endfn_cb (entries=) at /root/xhprof_mysql/extension/xhprof.c:1024
#6 0x00007f8d4c0a5503 in hp_execute_internal (execute_data=0x7f8d5241c500, return_value=0x7f8d5241c4d0) at /root/xhprof_mysql/extension/xhprof.c:1149
#7 0x000000000068a11b in ?? ()
#8 0x0000000000656838 in execute_ex ()
#9 0x00007f8d4c0a535e in hp_execute_ex (execute_data=0x7f8d5241c450) at /root/xhprof_mysql/extension/xhprof.c:1107
#10 0x0000000000601110 in zend_call_function ()
#11 0x000000000062f733 in zend_call_method ()
#12 0x000000000064beaa in ?? ()
#13 0x00000000006771f6 in ?? ()
#14 0x0000000000656838 in execute_ex ()
#15 0x00007f8d4c0a535e in hp_execute_ex (execute_data=0x7f8d5241c370) at /root/xhprof_mysql/extension/xhprof.c:1107
#16 0x000000000068a4b1 in ?? ()
#17 0x0000000000656838 in execute_ex ()
#18 0x00007f8d4c0a535e in hp_execute_ex (execute_data=0x7f8d5241c2e0) at /root/xhprof_mysql/extension/xhprof.c:1107
#19 0x000000000068a4b1 in ?? ()
#20 0x0000000000656838 in execute_ex ()
#21 0x00007f8d4c0a535e in hp_execute_ex (execute_data=0x7f8d5241c1d0) at /root/xhprof_mysql/extension/xhprof.c:1107
#22 0x000000000068a4b1 in ?? ()
#23 0x0000000000656838 in execute_ex ()
#24 0x00007f8d4c0a535e in hp_execute_ex (execute_data=0x7f8d5241c150) at /root/xhprof_mysql/extension/xhprof.c:1107
#25 0x000000000068a4b1 in ?? ()
#26 0x0000000000656838 in execute_ex ()
#27 0x00007f8d4c0a535e in hp_execute_ex (execute_data=0x7f8d5241c0c0) at /root/xhprof_mysql/extension/xhprof.c:1107
#28 0x000000000068a4b1 in ?? ()
#29 0x0000000000656838 in execute_ex ()
#30 0x00007f8d4c0a535e in hp_execute_ex (execute_data=0x7f8d5241c030) at /root/xhprof_mysql/extension/xhprof.c:1107
#31 0x0000000000601110 in zend_call_function ()
#32 0x0000000000601d67 in _call_user_function_ex ()
#33 0x000000000060ec15 in zend_try_exception_handler ()
#34 0x000000000060ed7f in zend_execute_scripts ()
#35 0x00000000005ac3f8 in php_execute_script ()
#36 0x00000000006c945e in ?? ()
#37 0x000000352561ed20 in __libc_start_main () from /lib64/libc.so.6
#38 0x000000000042b815 in _start ()

[longxinH]

@wjiacn 能否提供重现的demo 或者 更加详细的gdb信息，部分执行函数显示成问号，无法定位

[wjiacn]

[wjiacn]

具体重现demo 不是很方便定位, 我试试 coredump 能不能发上来,
应该不行, , coredump 需要配套的 .so bin 文件, 信息没有上面截图更多

[longxinH]

出现问号是因为，产生这个coredump的，跟你gdb的不一样，如果你的coredump是php-fpm产生的，gdb的时候，需要指定该php-fpm

[wjiacn]

@longxinH 我的 php-fpm 是线上版的, symbol太少 , 只有xhprof.so是我编译有symbol信息多, 另外这个coredump 是我gdb attache 上去, 在异常时gcore 导出的, 不存在不匹配的问题,

[wjiacn]

prev_result, curr_result 有可能是野指针,因为
#1
if(result_buf &&prev_result&&prev_result[0]&&curr_result&&curr_result[0])
spprintf(&result_buf, 0, "%s%s", prev_result, curr_result);//crash

#2
spprintf(&result_buf, 0, "%s", prev_result);//首次OK 第二次crash

#３
spprintf(&result_buf, 0, "%s", curr_result);//crash

#４
spprintf(&result_buf, 0, "%s", "xx");//ok

[longxinH]

能提供一下 你的php版本信息和xhprof版本信息吗？ 在上面gdb显示的行号，跟master上的不一样

[wjiacn]

PHP 7.2.11 (cli) (built: Oct 10 2018 10:17:37) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.2.11, Copyright (c) 1999-2018, by Zend Technologies

[longxinH]

xhprof版本能提供一下吗

[wjiacn]

先描述一下状况: 特定请求必然重起, 其他都正常
如果有必要我可用master 上的代码再重打一下堆栈, 只是目前觉得必要性好像不大, hp_get_entry_name 像截图里限制长度就行了,不了解PHP扩展,不清楚为什么,
加了长度限制后 就都正常了, 是不哪里超长/溢出? (另外截图那里那个 fprintf 会在12000行+处出错, 加了 .50s限制会跑到 15000行+正常结束, !!!注释中的log都打开 会正常运行, 但file log中最长 55, 最短 6, 打出来的file log 看起起来都正常, 看起来不是我上面说的野指针及越界等,

[wjiacn]

@longxinH
我再 master 重现一次吧,

[wjiacn]

[longxinH]

或者你加一下我的QQ 188248813

[GaetanF]

Hello,

from my side, i have tried to compile the master branch on Debian Stretch with php -v :
PHP 7.2.11-4+020181106031630.10+stretch1.gbp789850 (cli) (built: Nov 6 2018 03:16:30) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.2.11-4+020181106031630.10+stretch1.gbp789850, Copyright (c) 1999-2018, by Zend Technologies

And i have the same issue and same stack trace

[longxinH]

@GaetanF I am still locating the problem, the problem is occasional, or do you have an example that can be reproduced?

[GaetanF]

I'm try to launch the console command line utility of symfony 4 with xhprof enabled

[longxinH]

@GaetanF Is there a recurring example?

[GaetanF]

I'm just launch the console command without any arguments to list symfony command.

segfault.log

[longxinH]

The problem has been targeted and will be fixed in the near future. Thanks for your support.

[longxinH]

@GaetanF You can try the latest code of the master branch.