Segmentation fault when creating Manager with empty arguments

[jeremyjannotta]

When executing phpunit to instantiate a Manager, I am seeing a consistent segmentation fault error like this:

/usr/local/bin/phpunit: line 3:  2440 Segmentation fault: 11  /usr/bin/env php -d allow_url_fopen=On -d detect_unicode=Off /usr/local/Cellar/phpunit/5.0.0/libexec/phpunit-5.0.0.phar

when creating a Manager with these empty arguments:

$manager = new \MongoDB\Driver\Manager("mongodb://localhost:27017", [], []);

But after removing the empty [] arguments it works fine:

$manager = new \MongoDB\Driver\Manager("mongodb://localhost:27017");

This was found when I noticed MongoDB\Client passes in these default values.

Also perhaps related, I notice under when trying to access any method, like getServers(), I see this error:

Fatal error: Allowed memory size of 1828716544 bytes exhausted (tried to allocate 18446744073273022950 bytes) in /Users/jeremyjannotta/Documents/dev/projects/mongodb/vendor/mongodb/mongodb/src/Client.php on line 32

Call Stack:
    0.0006     230272   1. {main}() /Users/jeremyjannotta/Documents/dev/projects/mongodb/index.php:0
    0.0070     344288   2. MongoDB\Client->__construct() /Users/jeremyjannotta/Documents/dev/projects/mongodb/index.php:6
    0.0070     344576   3. MongoDB\Driver\Manager->__construct() /Users/jeremyjannotta/Documents/dev/projects/mongodb/vendor/mongodb/mongodb/src/Client.php:32

Executing this on Mac OSX 10.11.2, PHP 5.6.14, PHPUnit 5.0.0, MongoDB driver v1.1.0.

[jmikola]

Cross-referencing with @alcaeus' report: https://gist.github.com/alcaeus/754e1458352e5e872f3c

[alcaeus]

I managed to reproduce this in the php-cli as well:

$ php -a
Interactive shell

php > $manager = new MongoDB\Driver\Manager('mongodb://localhost');
php > var_dump($manager);
Segmentation fault: 11

In this case, var_dumping the manager will cause the segfault. However, when adding arguments to the call it just segfaults right away:

$ php -a
Interactive shell

php > $manager = new \MongoDB\Driver\Manager("mongodb://localhost:27017", [], []);
Segmentation fault: 11

[alcaeus]

I just upgraded to 1.1.1 and was able to partly fix the issue.
The error still occurs when creating the manager with empty arrays for arguments (2nd example). The segmentation fault from the first example however is gone.

[jeremyjannotta]

I can confirm as well @alcaeus 's result, that after upgrading to v1.1.1, still segfaults with empty arrays.

[jmikola]

@jeremyjannotta: Were you able to create a GDB backtrace of your segfault? @alcaeus is in the process of creating his own, but it would certainly be helpful to have both to compare/contrast.

[jmikola]

Cross-referencing with PHPC-493.

[alcaeus]

Here goes:

$ gdb php
GNU gdb (GDB) 7.10.1
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin15.2.0".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from php...(no debugging symbols found)...done.
(gdb) run -r "new MongoDB\Driver\Manager('mongodb://localhost', [], []);"
Starting program: /usr/local/bin/php -r "new MongoDB\Driver\Manager('mongodb://localhost', [], []);"

Program received signal SIGSEGV, Segmentation fault.
0x00000001003cbb09 in zend_hash_num_elements ()
(gdb) bt full
#0  0x00000001003cbb09 in zend_hash_num_elements ()
No symbol table info available.
#1  0x0000000104c2de96 in zval_to_bson () from /usr/local/opt/php56-mongo/mongo.so
No symbol table info available.
#2  0x0000000104c855e3 in zim_Manager___construct () from /usr/local/opt/php56-mongodb/mongodb.so
No symbol table info available.
#3  0x00000001003b0ca9 in dtrace_execute_internal ()
No symbol table info available.
#4  0x00000001017c2776 in xdebug_execute_internal () from /usr/local/opt/php56-xdebug/xdebug.so
No symbol table info available.
#5  0x0000000100429fce in zend_do_fcall_common_helper_SPEC ()
No symbol table info available.
#6  0x00000001003e718e in execute_ex ()
No symbol table info available.
#7  0x00000001003b0be5 in dtrace_execute_ex ()
No symbol table info available.
#8  0x00000001017c245c in xdebug_execute_ex () from /usr/local/opt/php56-xdebug/xdebug.so
No symbol table info available.
#9  0x00000001003b2f4b in zend_eval_stringl ()
No symbol table info available.
#10 0x00000001003b328a in zend_eval_stringl_ex ()
No symbol table info available.
#11 0x000000010044aa82 in do_cli ()
No symbol table info available.
#12 0x0000000100449c8b in main ()
No symbol table info available.

[alcaeus]

@jeremyjannotta Do you, by any chance, also have ext-mongo installed next to ext-mongodb? Working on that adapter between these two I removed ext-mongo for testing purposes and all of a sudden the code used above no longer segfaulted.

[bjori]

As I can't repro this, could you run it again in debug mode? -- It'll print out a little more info for debugging:

So in gdb run:

(gdb) run -dmongodb.debug=stderr -r "new MongoDB\Driver\Manager('mongodb://localhost', [], []);"

[alcaeus]

@bjori Same result - there is no additional output and the trace is exactly the same.

[bjori]

Heh. I see now why there is no additional output. It segfaults as soon as it tries to convert the options... Doesn't make any sense :|

Which PHP version is this? And you are running pecl/mongodb 1.1.1?

Could you just for completeness try without xdebug?

[alcaeus]

As commented above, I have updated to 1.1.1 which solved one segfault I was experiencing.

I've previously tried running without xdebug after @jmikola suspected that and it didn't change a thing. Here's the output without xdebug:

(gdb) bt full
#0  0x00000001003cbb09 in zend_hash_num_elements ()
No symbol table info available.
#1  0x0000000104bf7e96 in zval_to_bson () from /usr/local/opt/php56-mongo/mongo.so
No symbol table info available.
#2  0x0000000104c4f5e3 in zim_Manager___construct () from /usr/local/opt/php56-mongodb/mongodb.so
No symbol table info available.
#3  0x00000001003b0ca9 in dtrace_execute_internal ()
No symbol table info available.
#4  0x0000000100429fce in zend_do_fcall_common_helper_SPEC ()
No symbol table info available.
#5  0x00000001003e718e in execute_ex ()
No symbol table info available.
#6  0x00000001003b0be5 in dtrace_execute_ex ()
No symbol table info available.
#7  0x00000001003b2f4b in zend_eval_stringl ()
No symbol table info available.
#8  0x00000001003b328a in zend_eval_stringl_ex ()
No symbol table info available.
#9  0x000000010044aa82 in do_cli ()
No symbol table info available.
#10 0x0000000100449c8b in main ()
No symbol table info available.

Again, disabling pecl/mongo fixes the issue.

Also:

$ php --version
PHP 5.6.16 (cli) (built: Nov 27 2015 10:28:34) 
Copyright (c) 1997-2015 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2015 Zend Technologies

[bjori]

Bahhh. Sorry for being so daft. It even worked for me locally on PHP 5.6.16 with both pecl/mongo and pecl/mongodb loaded -- but now I see what the problem is, I wasn't reading the paths from your stack trace correctly.

There is a symbol clash between pecl/mongodb and pecl/mongo, more specifically zval_to_bson is provided by both extensions.

In your case, the stacktrace shows the zim_Manager___construct() executing the zval_to_bson() function provided by mongo.so -- not mongodb.so.
These two functions don't share any implementation details and are not compatible with each other.

We'll have to rename the function provided by pecl/mongodb to phongo_zval_to_bson or something.

[alcaeus]

Now that you mention it, yes, it does say mongo.so. I didn't catch that either. Well, at least we now know what the problem is! 👍

[jeremyjannotta]

@alcaeus I do indeed have ext-mongo installed next to ext-mongodb.

Also, here is my gdb backtrace, which has the same result:

Program received signal SIGSEGV, Segmentation fault.
0x0000000100473db4 in zend_hash_num_elements ()
(gdb) bt full
#0  0x0000000100473db4 in zend_hash_num_elements ()
No symbol table info available.
#1  0x0000000104c6f85a in zval_to_bson () from /usr/local/php5/lib/php/extensions/no-debug-non-zts-20131226/mongo.so
No symbol table info available.
#2  0x0000000104cd44cf in zim_Manager___construct ()
   from /usr/local/php5/lib/php/extensions/no-debug-non-zts-20131226/mongodb.so
No symbol table info available.
#3  0x00000001004565de in dtrace_execute_internal ()
No symbol table info available.
#4  0x0000000101d9232f in xdebug_execute_internal ()
   from /usr/local/php5/lib/php/extensions/no-debug-non-zts-20131226/xdebug.so
No symbol table info available.
#5  0x00000001004d6c58 in zend_do_fcall_common_helper_SPEC ()
No symbol table info available.
#6  0x0000000100491918 in execute_ex ()
No symbol table info available.
#7  0x0000000100456512 in dtrace_execute_ex ()
No symbol table info available.
#8  0x0000000101d92060 in xdebug_execute_ex ()
   from /usr/local/php5/lib/php/extensions/no-debug-non-zts-20131226/xdebug.so
No symbol table info available.
#9  0x0000000100458cf4 in zend_eval_stringl ()
No symbol table info available.
#10 0x000000010045910c in zend_eval_string_ex ()
No symbol table info available.
#11 0x00000001004f80ed in do_cli ()
No symbol table info available.
#12 0x00000001004f72b8 in main ()
No symbol table info available.

[jeremyjannotta]

Confirmed as well that disabling ext-mongo fixes the segfault issue.

[jmikola]

Cross-referencing with PHPC-529. Thanks for following up with the traces, guys!

[jmikola]

1.1.2 has been released with a fix for this.