[BUG]: Phalcon 3.4.5 + PHP 7.3.17 segfault

[davihu]

Questions? Forum: https://phalcon.link/forum or Discord: https://phalcon.link/discord

Describe the bug
Phalcon 3.4.5 in combination with Opcache under PHP 7.3.17 is causing segfault when trying to save model metadata.

To Reproduce
Core was generated by `php-fpm: pool www '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 zephir_ensure_array (zv=0x7fd1f47af0a0) at ./build/php7/64bits/phalcon.zep.c:5932
5932 ./build/php7/64bits/phalcon.zep.c: No such file or directory.
(gdb) bt
#0 zephir_ensure_array (zv=0x7fd1f47af0a0) at ./build/php7/64bits/phalcon.zep.c:5932
#1 zephir_array_isset_long_fetch (arr=0x7ffd5d11a4e0, arr=0x7ffd5d11a4e0, readonly=1, index=11, fetched=0x7ffd5d11a500) at ./build/php7/64bits/phalcon.zep.c:6025
#2 zephir_array_update_multi_ex (value=value@entry=0x7fd209e1e660, types=types@entry=0x7fd1f91aa632 "zl", types_length=types_length@entry=2, ap=ap@entry=0x7ffd5d11a810, types_count=2,
arr=, arr=) at ./build/php7/64bits/phalcon.zep.c:6562
#3 0x00007fd1f8f3e027 in zephir_update_property_array_multi (object=object@entry=0x7fd209e1e610, property=property@entry=0x7fd1f91a3e40 "_metaData", property_length=property_length@entry=9,
value=0x7fd209e1e660, types=types@entry=0x7fd1f91aa632 "zl", types_length=2, types_count=2, types_count=2, types_length=2) at ./build/php7/64bits/phalcon.zep.c:5470
#4 0x00007fd1f90f7bbd in zim_Phalcon_Mvc_Model_MetaData_writeMetaDataIndex (execute_data=, return_value=) at ./build/php7/64bits/phalcon.zep.c:88867
#5 0x000055f9541544fd in zend_call_function (fci=fci@entry=0x7ffd5d11ac10, fci_cache=) at ./Zend/zend_execute_API.c:770
#6 0x00007fd1f8e14a73 in zephir_call_user_function (object_pp=0x7fd209e1e5a0, obj_ce=, type=zephir_fcall_method, function_name=0x7ffd5d11ae00, retval_ptr=0x0, cache_entry=0x0,
cache_slot=, param_count=, params=0x7ffd5d11aeb0) at ./build/php7/64bits/phalcon.zep.c:8385
#7 0x00007fd1f8e1532a in zephir_call_class_method_aparams (return_value=return_value@entry=0x0, ce=0x55f955bd3a10, type=type@entry=zephir_fcall_method, object=object@entry=0x7fd209e1e5a0,
method_name=method_name@entry=0x7fd1f91a9e9b "writemetadataindex", method_len=method_len@entry=18, cache_entry=0x0, cache_slot=7, param_count=3, params=0x7ffd5d11aeb0)
at ./build/php7/64bits/phalcon.zep.c:8521
#8 0x00007fd1f90aa688 in zephir_call_class_method_aparams (params=0x7ffd5d11aeb0, param_count=3, cache_slot=7, cache_entry=0x0, method_len=18, method_name=0x7fd1f91a9e9b "writemetadataindex",
object=, type=zephir_fcall_method, ce=, return_value=0x0) at ./build/php7/64bits/phalcon.zep.c:89252
#9 zim_Phalcon_Mvc_Model_MetaData_setAutomaticUpdateAttributes (execute_data=, return_value=) at ./build/php7/64bits/phalcon.zep.c:23716
#10 0x000055f9541544fd in zend_call_function (fci=fci@entry=0x7ffd5d11b0c0, fci_cache=) at ./Zend/zend_execute_API.c:770
#11 0x00007fd1f8e14a73 in zephir_call_user_function (object_pp=0x7ffd5d11b390, obj_ce=, type=zephir_fcall_method, function_name=0x7ffd5d11b2b0, retval_ptr=0x0, cache_entry=0x0,
cache_slot=, param_count=, params=0x7ffd5d11b3b0) at ./build/php7/64bits/phalcon.zep.c:8385
#12 0x00007fd1f8e1532a in zephir_call_class_method_aparams (return_value=0x0, ce=0x55f955bd3a10, type=zephir_fcall_method, object=0x7ffd5d11b390,
method_name=0x7fd1f91a9d1c "setautomaticupdateattributes", method_len=28, cache_entry=0x0, cache_slot=0, param_count=2, params=0x7ffd5d11b3b0) at ./build/php7/64bits/phalcon.zep.c:8521
#13 0x00007fd1f90a15cb in zim_Phalcon_Mvc_Model_skipAttributesOnUpdate (execute_data=, return_value=) at ./build/php7/64bits/phalcon.zep.c:53434
#14 0x000055f9541f1125 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:984
#15 execute_ex (ex=0x7fd1f47aef00) at ./Zend/zend_vm_execute.h:55527
#16 0x000055f954154633 in zend_call_function (fci=fci@entry=0x7ffd5d11b660, fci_cache=) at ./Zend/zend_execute_API.c:756
#17 0x00007fd1f8e14a73 in zephir_call_user_function (object_pp=0x7fd209e1e4b0, obj_ce=, type=zephir_fcall_method, function_name=0x7ffd5d11b850, retval_ptr=0x0, cache_entry=0x0,
cache_slot=, param_count=, params=0x7ffd5d11b930) at ./build/php7/64bits/phalcon.zep.c:8385
#18 0x00007fd1f8e1532a in zephir_call_class_method_aparams (return_value=0x0, ce=0x7fd1ef4755c0, type=zephir_fcall_method, object=0x7fd209e1e4b0, method_name=0x7fd1f91a5050 "initialize", method_len=10,
cache_entry=0x0, cache_slot=0, param_count=0, params=0x7ffd5d11b930) at ./build/php7/64bits/phalcon.zep.c:8521
#19 0x00007fd1f906a42e in zim_Phalcon_Mvc_Model_Manager_initialize (execute_data=, return_value=0x7ffd5d11baf0) at ./build/php7/64bits/phalcon.zep.c:85285
#20 0x000055f9541544fd in zend_call_function (fci=fci@entry=0x7ffd5d11bb40, fci_cache=) at ./Zend/zend_execute_API.c:770
#21 0x00007fd1f8e14a73 in zephir_call_user_function (object_pp=0x7fd209e1e450, obj_ce=, type=zephir_fcall_method, function_name=0x7ffd5d11bd30, retval_ptr=0x0, cache_entry=0x7ffd5d11bae8,
cache_slot=, param_count=, params=0x7ffd5d11be30) at ./build/php7/64bits/phalcon.zep.c:8385
#22 0x00007fd1f8e1532a in zephir_call_class_method_aparams (return_value=0x0, ce=0x7fd209ec9140, type=zephir_fcall_method, object=0x7fd209e1e450, method_name=0x7fd1f91a5050 "initialize", method_len=10,
cache_entry=0x0, cache_slot=0, param_count=1, params=0x7ffd5d11be30) at ./build/php7/64bits/phalcon.zep.c:8521
#23 0x00007fd1f8f5af87 in zim_Phalcon_Mvc_Model___construct (execute_data=, return_value=) at ./build/php7/64bits/phalcon.zep.c:49080
#24 0x000055f9541544fd in zend_call_function (fci=fci@entry=0x7ffd5d11c040, fci_cache=) at ./Zend/zend_execute_API.c:770
#25 0x00007fd1f8e14a73 in zephir_call_user_function (object_pp=0x7ffd5d11cb60, obj_ce=, type=zephir_fcall_method, function_name=0x7ffd5d11c230, retval_ptr=0x0, cache_entry=0x0,
cache_slot=, param_count=, params=0x7ffd5d11c3e0) at ./build/php7/64bits/phalcon.zep.c:8385
#26 0x00007fd1f8e1532a in zephir_call_class_method_aparams (return_value=0x0, ce=0x7fd1ef4755c0, type=zephir_fcall_method, object=0x7ffd5d11cb60, method_name=0x7fd1f91a3ac5 "__construct", method_len=11,
cache_entry=0x0, cache_slot=0, param_count=3, params=0x7ffd5d11c3e0) at ./build/php7/64bits/phalcon.zep.c:8521
#27 0x00007fd1f915cef4 in zim_Phalcon_Mvc_Model_Manager_load (execute_data=, return_value=0x7ffd5d11cb60) at ./build/php7/64bits/phalcon.zep.c:85434
#28 0x000055f9541544fd in zend_call_function (fci=fci@entry=0x7ffd5d11c610, fci_cache=) at ./Zend/zend_execute_API.c:770
#29 0x00007fd1f8e14a73 in zephir_call_user_function (object_pp=0x7ffd5d11caf0, obj_ce=, type=zephir_fcall_method, function_name=0x7ffd5d11c800, retval_ptr=0x7ffd5d11cb60,
cache_entry=0x7ffd5d11c5b8, cache_slot=, param_count=, params=0x7ffd5d11cf90) at ./build/php7/64bits/phalcon.zep.c:8385
#30 0x00007fd1f8e1532a in zephir_call_class_method_aparams (return_value=0x7ffd5d11cb60, ce=0x7fd209ec9140, type=zephir_fcall_method, object=0x7ffd5d11caf0, method_name=0x7fd1f91a9105 "load",
method_len=4, cache_entry=0x7ffd5d11c958, cache_slot=0, param_count=2, params=0x7ffd5d11cf90) at ./build/php7/64bits/phalcon.zep.c:8521
#31 0x00007fd1f8fc2b8e in zim_Phalcon_Mvc_Model_Query__prepareSelect (execute_data=, return_value=0x7ffd5d11d460) at ./build/php7/64bits/phalcon.zep.c:92319
#32 0x000055f9541544fd in zend_call_function (fci=fci@entry=0x7ffd5d11d1a0, fci_cache=) at ./Zend/zend_execute_API.c:770
#33 0x00007fd1f8e14a73 in zephir_call_user_function (object_pp=0x7fd209e1e2f0, obj_ce=, type=zephir_fcall_method, function_name=0x7ffd5d11d390, retval_ptr=0x7ffd5d11d460,
cache_entry=0x7ffd5d11d148, cache_slot=, param_count=, params=0x7ffd5d11d4e0) at ./build/php7/64bits/phalcon.zep.c:8385
#34 0x00007fd1f8e1532a in zephir_call_class_method_aparams (return_value=0x7ffd5d11d460, ce=0x55f955bdd9d0, type=zephir_fcall_method, object=0x7fd209e1e2f0, method_name=0x7fd1f91a8f38 "_prepareselect",
method_len=14, cache_entry=0x0, cache_slot=327, param_count=0, params=0x7ffd5d11d4e0) at ./build/php7/64bits/phalcon.zep.c:8521
#35 0x00007fd1f9052650 in zim_Phalcon_Mvc_Model_Query_parse (execute_data=, return_value=0x7ffd5d11da50) at ./build/php7/64bits/phalcon.zep.c:93224

Steps to reproduce the behavior:

Completely randomely behavior, sometimes on model save causes segfault.

(gdb) frame 2
#2 zephir_array_update_multi_ex (value=value@entry=0x7fd209e1e660, types=types@entry=0x7fd1f91aa632 "zl", types_length=types_length@entry=2, ap=ap@entry=0x7ffd5d11a810, types_count=2,
arr=, arr=) at ./build/php7/64bits/phalcon.zep.c:6562
6562 in ./build/php7/64bits/phalcon.zep.c
(gdb) info locals
fetched = {value = {lval = 140539726589696, dval = 6.9435850783890364e-310, counted = 0x7fd1f47aef00, str = 0x7fd1f47aef00, arr = 0x7fd1f47aef00, obj = 0x7fd1f47aef00, res = 0x7fd1f47aef00,
ref = 0x7fd1f47aef00, ast = 0x7fd1f47aef00, zv = 0x7fd1f47aef00, ptr = 0x7fd1f47aef00, ce = 0x7fd1f47aef00, func = 0x7fd1f47aef00, ww = {w1 = 4101697280, w2 = 32721}}, u1 = {v = {type = 0 '\000',
type_flags = 0 '\000', u = {call_info = 0, extra = 0}}, type_info = 0}, u2 = {next = 0, cache_slot = 0, opline_num = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0, access_flags = 0,
property_guard = 0, constant_flags = 0, extra = 0}}
old_l = {390842024046, 140726164890992, 140726164891312, 72, 140540145278016, -8245590648742827391, 140726164891432, 140726164891296, 94529374522464, 140540141785837, 140535624892424,
-5324475354825956352, 140535624892420, 140726164891256, 140726164891760, 0}
old_ll = {4, 11, 140540085659152, 140539800407324, 140540087178240, 264, 140540086322032, 140724603453702, 140539669083832, 94527935217670, 140540087516544, 140724603453702, 0, 140539800406804,
18741307056, 94529373682192}
s = 0x7ffd5d11a990 "p\003\354\t\322\177"
old_s = {0x2e <error: Cannot access memory at address 0x2e>, 0x7ffd5d11a710 "\020:\275U\371U", 0x22 <error: Cannot access memory at address 0x22>, 0x2c <error: Cannot access memory at address 0x2c>,
0xb <error: Cannot access memory at address 0xb>, 0x7fd1ef453608 "_metaData", 0x7ffd00000000 <error: Cannot access memory at address 0x7ffd00000000>, 0x55f955bd3a10 "\001",
0x7ffd5d11a9c0 "@\346\341\t\322\177", 0x7ffd00000000 <error: Cannot access memory at address 0x7ffd00000000>, 0x7fd209e1e7f0 "Hu\r\361\321\177", 0x55f955bd4f70 "\001", 0x7fd209f9b020 "\003",
0x7fd100000001 <error: Cannot access memory at address 0x7fd100000001>, 0x7fd1ef479b60 "\001", 0x55f900000000 <error: Cannot access memory at address 0x55f900000000>}
old_type = "z\252\021]\375\177\000\000\000\000\000\000\340\251\033\266"
item = 0x7ffd5d11a990
old_item = {0x7ffd5d11a990, 0x7ffd0000000e, 0x55f955bd4f70, 0x55f95418bae1 <zend_string_hash_func+17>, 0x55f955bd3a88, 0x55f954174900 <zend_hash_find+144>, 0x0, 0x7fd209e91150, 0x0,
0x55f9541966de <zend_std_read_property+942>, 0x7ffd5d11a5c0, 0x7ffd5d11a7a0, 0x55f955bd3910, 0x55f900000001, 0x55f955bd3a10, 0x55f954561240 <executor_globals>}
pzv = {value = {lval = 140539726589696, dval = 6.9435850783890364e-310, counted = 0x7fd1f47aef00, str = 0x7fd1f47aef00, arr = 0x7fd1f47aef00, obj = 0x7fd1f47aef00, res = 0x7fd1f47aef00,
ref = 0x7fd1f47aef00, ast = 0x7fd1f47aef00, zv = 0x7fd1f47aef00, ptr = 0x7fd1f47aef00, ce = 0x7fd1f47aef00, func = 0x7fd1f47aef00, ww = {w1 = 4101697280, w2 = 32721}}, u1 = {v = {type = 7 '\a',
type_flags = 1 '\001', u = {call_info = 0, extra = 0}}, type_info = 263}, u2 = {next = 32765, cache_slot = 32765, opline_num = 32765, lineno = 32765, num_args = 32765, fe_pos = 32765,
fe_iter_idx = 32765, access_flags = 32765, property_guard = 32765, constant_flags = 32765, extra = 32765}}
p = 0x7fd1f47aef00
old_p = {0x7fd1ef479bd0, 0x7fd1f47aef00, 0x65646f6d5c63766d, 0xb61ba9e00446e400, 0x726f6d656d5c6174, 0x7ffd5d11a790, 0x55f954561240 <executor_globals>, 0x7ffd5d11a800, 0x1100, 0x7fd209e1e610, 0x0,
0x7fd1f8e0ce98 <zephir_read_property+264>, 0x7fd1f91a3e40, 0x7fd1ef4535f0, 0x7fd1ef4535f0, 0x55f900000106}
tmp = {value = {lval = 140726164891312, dval = 6.9527963543787818e-310, counted = 0x7ffd5d11a6b0, str = 0x7ffd5d11a6b0, arr = 0x7ffd5d11a6b0, obj = 0x7ffd5d11a6b0, res = 0x7ffd5d11a6b0,
ref = 0x7ffd5d11a6b0, ast = 0x7ffd5d11a6b0, zv = 0x7ffd5d11a6b0, ptr = 0x7ffd5d11a6b0, ce = 0x7ffd5d11a6b0, func = 0x7ffd5d11a6b0, ww = {w1 = 1561437872, w2 = 32765}}, u1 = {v = {type = 0 '\000',
type_flags = 0 '\000', u = {call_info = 0, extra = 0}}, type_info = 0}, u2 = {next = 22009, cache_slot = 22009, opline_num = 22009, lineno = 22009, num_args = 22009, fe_pos = 22009,
fe_iter_idx = 22009, access_flags = 22009, property_guard = 22009, constant_flags = 22009, extra = 22009}}
i = 1
j =
l = 1
ll = 11
re_update = 0
must_continue = 0
wrap_tmp = 0

Details

• Phalcon version: 3.4.5
• PHP Version: 7.3.17
• Operating System: Ubuntu 18.04
• Installation type: installing via package manager
• Zephir version (if any):
• Server: Nginx
• Other related info (Database, table schema):

[davihu]

Looks like its caused by code in Model

public function initialize()
{
...
$this->skipAttributesOnUpdate(['tsCreated']);
...
}

If I remove this, looks ok

[ruudboon]

Do you have to possibility to test if this occurs on Phalcon 4 as well? `

[Jeckerson]

Does xdebug is enabled?

[feng99]

I ran into the same problem when restarting php-fpm whether it was prompted
Php7.3 phalcon3.4 exactly like you
If you do, please let me know thank you

[davihu]

Does xdebug is enabled?

Xdebug has positive result to this, if you Enable it, segfault doesnt appear :). If you disable it, problem is there.

[davihu]

Do you have to possibility to test if this occurs on Phalcon 4 as well? `

Current code is written in Phalcon 3, didnt have time to refactor whole application to version 4 yet. But as I wrote, looks like the problem is caused by skipattributes maybe in corelation with behavior timestampable.

[feng99]

我解决了这个问题。
基于php7.3,重新安装了phalcon3.4.5，再重启php-fpm就没有这个问题了。
由于phalcon4.0不向下兼容，所以基于以前的代码和习惯，必须使用phalcon3.4.5