Everything
php
Learn Community Releases The PHP Project
Home » Project » Newsgroups » php.internals » memory corruption with 5.1? »

memory corruption with 5.1?

php.internals

James Crumpton

21 years ago
I've run into a problem, when trying out 5.1.0b1, b2, and php5-200507060230, with a script of mine that relies pretty heavily on DomDocument and DomXPath. Using XPath, I pull nodes with a certain namespace (xx) from an xml document. With 5.0.*, this works as expected. However, with 5.1.*, I'm getting what appears to memory corruption(?) of the DomNode localName property. Previously echo $node->nodeName; echo $node->localName; would yeild xx:nodename nodename With 5.1, I'm getting instead xx:Õ¤9domN9dš9Øû Õ¤9domN9dš9Øû In reducing the operations to a simple: $string = '<root xmlns:xx="xx"><xx:nodename /></root>'; $dom = new DomDocument; $dom->loadXML($string); foreach ($xpath->query('descendant-or-self::xx:*') as $node) { echo $node->nodeName; } ... i don't get the corrupt node names. Only when used in the larger application framework do I run into the problem. I'm at a loss as to how to further troubleshoot this. And as the script isn't causing a segfault, I don't really know what other information to provide, or where to look. Any pointers or help with this would be much appreciated. -james

Rasmus Lerdorf

21 years ago
James Crumpton wrote:
> I've run into a problem, when trying out 5.1.0b1, b2, and > php5-200507060230, with a script of mine that relies pretty heavily on > DomDocument and DomXPath. > > Using XPath, I pull nodes with a certain namespace (xx) from an xml > document. With 5.0.*, this works as expected. > > However, with 5.1.*, I'm getting what appears to memory corruption(?) of > the DomNode localName property. > > Previously > > echo $node->nodeName; > echo $node->localName; > > would yeild > > xx:nodename > nodename > > With 5.1, I'm getting instead > > xx:Õ¤9domN9dš9Øû > Õ¤9domN9dš9Øû > > In reducing the operations to a simple: > > $string = '<root xmlns:xx="xx"><xx:nodename /></root>'; > > $dom = new DomDocument; > $dom->loadXML($string); > foreach ($xpath->query('descendant-or-self::xx:*') as $node) { > echo $node->nodeName; > } > > ... i don't get the corrupt node names. Only when used in the larger > application framework do I run into the problem. > > I'm at a loss as to how to further troubleshoot this. And as the script > isn't causing a segfault, I don't really know what other information to > provide, or where to look. > > Any pointers or help with this would be much appreciated.
If you could run this thing under Valgrind and send us the output, it would help a lot. -Rasmus

Derick Rethans

21 years ago
On Tue, 5 Jul 2005, Rasmus Lerdorf wrote:
> > Any pointers or help with this would be much appreciated. > > If you could run this thing under Valgrind and send us the output, it > would help a lot.
It would even help more if you recompiled with the --disable-zend-mm switch before running it through valgrind, as that helps finding memory problems. Derick
-- Derick Rethans http://derickrethans.nl | http://ez.no | http://xdebug.org

James Crumpton

21 years ago
So ... php-5.1.0b2 with --disable-zend-mm --enable-debug ... apache segfaults on startup. Without --disable-zend-nm, and run through valgrind, I don't actually experience the corruption, but boy is there a lot of output. Hope you like to read ;) I've included urls for the --disable-zend-mm segfaulting valgrind output (pid 30703), and the non --disable-zend-mm (pid 27107) below that. There is no interesting output from valgrind with php-5.0.4 and the same script. Without zend mm ---------------------------------------------------------- https://www.die.net/tmp/6f51b90defa5c822.txt/withoutmm.txt With zend mm ---------------------------------------------------------- https://www.die.net/tmp/00e9a7d1e7a5d0fc.txt/withmm.txt -james Rasmus Lerdorf wrote:

Antony Dovgal

21 years ago
On Thu, 07 Jul 2005 16:17:36 -0700 James Crumpton <james@safesearching.com> wrote:
> So ... php-5.1.0b2 with --disable-zend-mm --enable-debug ... apache segfaults on > startup. > > Without --disable-zend-nm, and run through valgrind, I don't actually experience > the corruption, but boy is there a lot of output. Hope you like to read ;)
Are you sure you did ./cvsclean && ./buildconf before rebuilding fresh CVS sources? Or do you use snapshots from http://snaps.php.net ?
-- Wbr, Antony Dovgal

James Crumpton

21 years ago
The output from valgrind that I posted was from 5.1.0b2. Before posting to internals I tried php5-200507060230 from snaps.php.net with no luck... I haven't tried running that through valgrind, however, but I suspect it would produce the same output. -james Antony Dovgal wrote:

Rob Richards

21 years ago
You should probably try a newer version of libxml2. I suspect you are hitting a refcount issue with dictionaries that was fixed in 2.6.8. And before you ask, the error would be more prominent using PHP 5.1 than 5.0. Rob James Crumpton wrote:

James Crumpton

21 years ago
Looks like libxml2-2.6.8 did the trick. Perhaps the version requirement for libxml2 should be bumped up for php5.1? Also, it may or may not be worth noting that as of libxml2-2.6.18, I'm getting a segfault after the script has finished. 2.6.17 however, works fine. Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 1024 (LWP 4947)] 0x4045d4f5 in _efree (ptr=0x838d02c) at /home/james/php-5.1.0b2/Zend/zend_alloc.c:302 302 REMOVE_POINTER_FROM_LIST(p); (gdb) bt #0 0x4045d4f5 in _efree (ptr=0x838d02c) at /home/james/php-5.1.0b2/Zend/zend_alloc.c:302 #1 0x4046e723 in _zval_dtor_func (zvalue=0x838bcf8) at /home/james/php-5.1.0b2/Zend/zend_variables.c:36 #2 0x40468067 in destroy_op_array (op_array=0x8390e5c) at /home/james/php-5.1.0b2/Zend/zend_variables.h:35 #3 0x40475dc8 in zend_hash_destroy (ht=0x8374b80) at /home/james/php-5.1.0b2/Zend/zend_hash.c:519 #4 0x40467e96 in destroy_zend_class (pce=0x8374d7c) at /home/james/php-5.1.0b2/Zend/zend_opcode.c:164 #5 0x40475d20 in zend_hash_del_key_or_index (ht=0x80a4de8, arKey=0x8374d90 "", nKeyLength=95, h=3763876606, flag=0) at /home/james/php-5.1.0b2/Zend/zend_hash.c:490 #6 0x40476295 in zend_hash_reverse_apply (ht=0x80a4de8, apply_func=0x40464b80 <is_not_internal_class>) at /home/james/php-5.1.0b2/Zend/zend_hash.c:738 #7 0x4046507d in shutdown_executor () at /home/james/php-5.1.0b2/Zend/zend_execute_API.c:264 #8 0x4046f788 in zend_deactivate () at /home/james/php-5.1.0b2/Zend/zend.c:823 #9 0x4043f848 in php_request_shutdown (dummy=0x0) at /home/james/php-5.1.0b2/main/main.c:1237 #10 0x404ff38b in apache_php_module_main (r=0x8158768, display_source_mode=0) at /home/james/php-5.1.0b2/sapi/apache/sapi_apache.c:59 #11 0x404ffd24 in send_php (r=0x8158768, display_source_mode=0, filename=0x0) at /home/james/php-5.1.0b2/sapi/apache/mod_php5.c:639 #12 0x404ffd72 in send_parsed_php (r=0x8158768) at /home/james/php-5.1.0b2/sapi/apache/mod_php5.c:654 #13 0x0805480d in ap_invoke_handler () #14 0x08067b0c in process_request_internal () #15 0x08067b83 in ap_process_request () #16 0x0805fc97 in child_main () #17 0x0805fe3a in make_child () #18 0x0805ff7d in startup_children () #19 0x080605d0 in standalone_main () #20 0x08060ed3 in main () #21 0x42017589 in __libc_start_main () from /lib/i686/libc.so.6 Rob Richards wrote:

Sebastian Bergmann

21 years ago
James Crumpton schrieb:
> Also, it may or may not be worth noting that as of libxml2-2.6.18, I'm > getting a segfault after the script has finished. 2.6.17 however, works > fine.
Looks like libxml2-2.6.19 has the same / a similar issue: http://bugs.gentoo.org/show_bug.cgi?id=97406
-- Sebastian Bergmann http://www.sebastian-bergmann.de/ GnuPG Key: 0xB85B5D69 / 27A7 2B14 09E4 98CD 6277 0E5B 6867 C514 B85B 5D69

Andi Gutmans

21 years ago
Can you try and cut down the script to a minimum and post it? Even if it's a couple of files, that'll help (as long as it doesn't require a db or external resource, in which case you could cut that out too). At 04:17 PM 7/7/2005 -0700, James Crumpton wrote: