#16820 [Fbk->Opn]: hangs in multithreded environment (ZTS)

[wmeler at wp-sa dot pl]

ID: 16820
User updated by: wmeler at wp-sa dot pl
Reported By: wmeler at wp-sa dot pl
-Status: Feedback
+Status: Open
Bug Type: Scripting Engine problem
Operating System: linux
PHP Version: 4.3.0-dev
New Comment:

script like:
<?
set_time_limit(1);
while (TRUE) {
$a.='a';
}
?>

should hang server in ZTS mode on linux after few reloads.

You can download my patch from

[url]http://strony.wp.pl/wp/wmeler/execution-timeout.patch[/url]

It is for erlier version, but it applies with offsets.


Previous Comments:
------------------------------------------------------------------------

[2003-07-10 19:54:27] [email]sniper@php.net[/email]

Can you please provide either a testcase for this so we can actually
reproduce this or a patch to fix it?


------------------------------------------------------------------------

[2002-10-21 11:19:40] [email]sniper@php.net[/email]

Updated version info. (assuming the last comment was based on the
snapshot)


------------------------------------------------------------------------

[2002-10-21 00:18:54] wmeler at wp-sa dot pl

Well, it seems that nothing has changed - on timeout it still does
longjmp without care of semaphores. Locks won't be freed so it will
hang.
As I wrote few months ago, signal handler should only set EG(timeout)
flag.

------------------------------------------------------------------------

[2002-10-20 01:00:03] php-bugs at lists dot php dot net

No feedback was provided for this bug for over 2 weeks, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

------------------------------------------------------------------------

[2002-10-03 22:43:06] [email]iliaa@php.net[/email]

Please try using this CVS snapshot:

[url]http://snaps.php.net/php4-latest.tar.gz[/url]

For Windows:

[url]http://snaps.php.net/win32/php4-win32-latest.zip[/url]



------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
[url]http://bugs.php.net/16820[/url]

--
Edit this bug report at [url]http://bugs.php.net/?id=16820&edit=1[/url]

[wmeler at wp-sa dot pl]

ID: 16820
User updated by: wmeler at wp-sa dot pl
Reported By: wmeler at wp-sa dot pl
-Status: Feedback
+Status: Open
Bug Type: Scripting Engine problem
Operating System: linux
PHP Version: 4.3.0-dev
New Comment:

that funny restrictions ... try this:
[url]http://strony.wp.pl/wp/wmeler/execution-timeout.patch.html[/url]


Previous Comments:
------------------------------------------------------------------------

[2003-07-11 02:54:49] [email]sniper@php.net[/email]

That url gives 403..was it incorrect..?


------------------------------------------------------------------------

[2003-07-11 02:40:47] wmeler at wp-sa dot pl

script like:
<?
set_time_limit(1);
while (TRUE) {
$a.='a';
}
?>

should hang server in ZTS mode on linux after few reloads.

You can download my patch from

[url]http://strony.wp.pl/wp/wmeler/execution-timeout.patch[/url]

It is for erlier version, but it applies with offsets.

------------------------------------------------------------------------

[2003-07-10 19:54:27] [email]sniper@php.net[/email]

Can you please provide either a testcase for this so we can actually
reproduce this or a patch to fix it?


------------------------------------------------------------------------

[2002-10-21 11:19:40] [email]sniper@php.net[/email]

Updated version info. (assuming the last comment was based on the
snapshot)


------------------------------------------------------------------------

[2002-10-21 00:18:54] wmeler at wp-sa dot pl

Well, it seems that nothing has changed - on timeout it still does
longjmp without care of semaphores. Locks won't be freed so it will
hang.
As I wrote few months ago, signal handler should only set EG(timeout)
flag.

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
[url]http://bugs.php.net/16820[/url]

--
Edit this bug report at [url]http://bugs.php.net/?id=16820&edit=1[/url]

[wmeler at wp-sa dot pl]

ID: 16820
User updated by: wmeler at wp-sa dot pl
Reported By: wmeler at wp-sa dot pl
-Status: Feedback
+Status: Open
Bug Type: Scripting Engine problem
Operating System: linux
PHP Version: 4.3.3RC2-dev
New Comment:

patches work together

[url]http://strony.wp.pl/wp/wmeler/[/url]


Previous Comments:
------------------------------------------------------------------------

[2003-07-21 03:12:52] [email]sniper@php.net[/email]

Yes, a patch is always appreciated..


------------------------------------------------------------------------

[2003-07-21 02:46:15] wmeler at wp-sa dot pl

As I said - heap corrupted.
backtrace:

#0 0x40393966 in _efree (ptr=0x42671030,
__zend_filename=0x403e5840
"/tmp/php4-STABLE-200307081130/Zend/zend_execute_API.c",
__zend_lineno=291,
__zend_orig_filename=0x403e5ca0
"/tmp/php4-STABLE-200307081130/Zend/zend_variables.c",
__zend_orig_lineno=44) at
/tmp/php4-STABLE-200307081130/Zend/zend_alloc.c:259
#1 0x403a3e18 in _zval_dtor (zvalue=0x81d6018,
__zend_filename=0x403e5840
"/tmp/php4-STABLE-200307081130/Zend/zend_execute_API.c",
__zend_lineno=291) at
/tmp/php4-STABLE-200307081130/Zend/zend_variables.c:61
#2 0x4039b878 in _zval_ptr_dtor (zval_ptr=0x81d60d4,
__zend_filename=0x403e5ca0
"/tmp/php4-STABLE-200307081130/Zend/zend_variables.c",
__zend_lineno=167) at
/tmp/php4-STABLE-200307081130/Zend/zend_execute_API.c:291
#3 0x403a40d2 in _zval_ptr_dtor_wrapper (zval_ptr=0x81d60d4)
at /tmp/php4-STABLE-200307081130/Zend/zend_variables.c:167
#4 0x403aa7a3 in zend_hash_destroy (ht=0x81bfa94)
at /tmp/php4-STABLE-200307081130/Zend/zend_hash.c:543
#5 0x4039b361 in shutdown_executor (tsrm_ls=0x81aa7f0)
at /tmp/php4-STABLE-200307081130/Zend/zend_execute_API.c:186
#6 0x403a546d in zend_deactivate (tsrm_ls=0x81aa7f0)
at /tmp/php4-STABLE-200307081130/Zend/zend.c:666
#7 0x40374772 in php_request_shutdown (dummy=0x0) at
/tmp/php4-STABLE-200307081130/main/main.c:995
#8 0x403c4923 in php_apache_request_dtor (r=0x81a6830,
tsrm_ls=0x81aa7f0)
at
/tmp/php4-STABLE-200307081130/sapi/apache2handler/sapi_apache2.c:445
#9 0x403c4c4d in php_handler (r=0x81a6830)
at
/tmp/php4-STABLE-200307081130/sapi/apache2handler/sapi_apache2.c:541
#10 0x808269e in ap_run_handler (r=0x81a6830) at config.c:194


With my patch there are almost no problems. The problem is that
shutdown function won't execute - EG(timeout) flag should be cleared
before execution of shutdown function.
I can correct it if you want.

------------------------------------------------------------------------

[2003-07-21 02:07:48] wmeler at wp-sa dot pl

I took few days off. You know - holidays.
My config.nice :

'./configure' \
'--disable-all' \
'--with-apxs2=/usr/local/apache2/bin/apxs' \
'--with-config-file-path=/usr/local/apache2/conf/' \
'--enable-debug' \
"$@"

my script:
<?
function shutdown() {
echo strlen($GLOBALS['a']);
}
set_time_limit(1);
register_shutdown_function('shutdown');
while (true) $a.='a';

I use apache 2.0.47 with config.nice:
"./configure" \
"--enable-so" \
"--with-mpm=worker" \
"$@"

Now I have SIGSEGVs instead of hangs :) - probably longjump hit in the
middle of emalloc/erealloc and memory cache is corrupted.
I used my own module before, witch uses shared variables and locks -
thats why it hanged. Now - without my module it just crashes :).

------------------------------------------------------------------------

[2003-07-21 01:30:30] [email]sniper@php.net[/email]

Still waiting for the configure line..


------------------------------------------------------------------------

[2003-07-16 01:08:36] [email]sniper@php.net[/email]

Could you also tell us what configure line you have used?
(so we can try to reproduce this too before applying any patches..)


------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
[url]http://bugs.php.net/16820[/url]

--
Edit this bug report at [url]http://bugs.php.net/?id=16820&edit=1[/url]

[wmeler at wp-sa dot pl]

ID: 16820
User updated by: wmeler at wp-sa dot pl
Reported By: wmeler at wp-sa dot pl
-Status: Feedback
+Status: Open
Bug Type: Scripting Engine problem
Operating System: linux
PHP Version: 4.3.3RC2-dev
New Comment:

RH 7.2 kernel 2.4.20 glibc (2.2.4? I'm not sure) - I will check it
tomorrow.

The fact is it doesn't matter!!! As long as longjmp call is being used
in zend_bailout, heap and stack can be corrupted and locks (if taken)
won't be released. If you guys can't understand it I just waste your
and my time. My patches solves the problem - if you don't want them -
it is your problem. I don't use binary distributions and can patch
sources as I already do.

And you should know that windows binaries call shutdown handlers and
immediately stops them because EG(timed_out) flag is set (you have n+1
error messages about timeout where n is number of registered shutdown
functions). I've checked it against binaries found at snaps.php.net.

Just close this report if you want (Won't fix status?). I'm bored.
EOT


Previous Comments:
------------------------------------------------------------------------

[2003-07-28 08:14:14] [email]sniper@php.net[/email]

Which linux distro are you testing with? glibc/kernel versions, etc?


------------------------------------------------------------------------

[2003-07-28 04:58:06] wmeler at wp-sa dot pl

Forgot to change status.
And I'm almost sure that on windows shutdown functions won't be called.

------------------------------------------------------------------------

[2003-07-28 04:56:01] wmeler at wp-sa dot pl

What is --worker=MPM ? Did you mean --mpm=worker ?
If so, with php4-STABLE-200307280730 I got in error_log (configure
options the same as before):

[Mon Jul 28 11:41:58 2003] [notice] Apache/2.0.47 (Unix)
PHP/4.3.3RC2-dev configured -- resuming normal operations
[Mon Jul 28 11:42:28 2003] [notice] child pid 31209 exit signal
Segmentation fault (11)
[Mon Jul 28 11:42:30 2003] [notice] child pid 31233 exit signal
Segmentation fault (11)
[Mon Jul 28 11:42:31 2003] [notice] child pid 31252 exit signal
Segmentation fault (11)
[Mon Jul 28 11:42:33 2003] [notice] child pid 31271 exit signal
Segmentation fault (11)


Finally I saw the page I requested, but it was after 4 crashes -
mozilla tries to reload page if server disconnects without response.

------------------------------------------------------------------------

[2003-07-21 04:18:51] wmeler at wp-sa dot pl

patches work together

[url]http://strony.wp.pl/wp/wmeler/[/url]

------------------------------------------------------------------------

[2003-07-21 03:12:52] [email]sniper@php.net[/email]

Yes, a patch is always appreciated..


------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
[url]http://bugs.php.net/16820[/url]

--
Edit this bug report at [url]http://bugs.php.net/?id=16820&edit=1[/url]

[wmeler]

ID: 16820
User updated by: wmeler at wp-sa dot pl
Reported By: wmeler at wp-sa dot pl
-Status: Feedback
+Status: Open
Bug Type: Scripting Engine problem
Operating System: linux
PHP Version: 4CVS, 5CVS
New Comment:

Zeev corrected #21513. It won't help.
As long as zend_timeout calls longjmp (through zend_error, php_error_cb
and zend_bailout) shutdown functions can get memory, locks - any
objects in undefined state.
2 years - no change ...


Previous Comments:
------------------------------------------------------------------------

[2004-01-26 22:20:02] net

Please try using this CVS snapshot:

http://snaps.php.net/php4-STABLE-latest.tar.gz

For Windows:

http://snaps.php.net/win32/php4-win32-STABLE-latest.zip

Zeev applied some fix recently, so please test.


------------------------------------------------------------------------

[2003-08-13 21:43:09] net

I could finally reproduce this. The patches didn't make any
difference.


------------------------------------------------------------------------

[2003-07-21 04:18:51] wmeler at wp-sa dot pl

patches work together

http://strony.wp.pl/wp/wmeler/

------------------------------------------------------------------------

[2003-07-21 02:46:15] wmeler at wp-sa dot pl

As I said - heap corrupted.
backtrace:

#0 0x40393966 in _efree (ptr=0x42671030,
__zend_filename=0x403e5840
"/tmp/php4-STABLE-200307081130/Zend/zend_execute_API.c",
__zend_lineno=291,
__zend_orig_filename=0x403e5ca0
"/tmp/php4-STABLE-200307081130/Zend/zend_variables.c",
__zend_orig_lineno=44) at
/tmp/php4-STABLE-200307081130/Zend/zend_alloc.c:259
#1 0x403a3e18 in _zval_dtor (zvalue=0x81d6018,
__zend_filename=0x403e5840
"/tmp/php4-STABLE-200307081130/Zend/zend_execute_API.c",
__zend_lineno=291) at
/tmp/php4-STABLE-200307081130/Zend/zend_variables.c:61
#2 0x4039b878 in _zval_ptr_dtor (zval_ptr=0x81d60d4,
__zend_filename=0x403e5ca0
"/tmp/php4-STABLE-200307081130/Zend/zend_variables.c",
__zend_lineno=167) at
/tmp/php4-STABLE-200307081130/Zend/zend_execute_API.c:291
#3 0x403a40d2 in _zval_ptr_dtor_wrapper (zval_ptr=0x81d60d4)
at /tmp/php4-STABLE-200307081130/Zend/zend_variables.c:167
#4 0x403aa7a3 in zend_hash_destroy (ht=0x81bfa94)
at /tmp/php4-STABLE-200307081130/Zend/zend_hash.c:543
#5 0x4039b361 in shutdown_executor (tsrm_ls=0x81aa7f0)
at /tmp/php4-STABLE-200307081130/Zend/zend_execute_API.c:186
#6 0x403a546d in zend_deactivate (tsrm_ls=0x81aa7f0)
at /tmp/php4-STABLE-200307081130/Zend/zend.c:666
#7 0x40374772 in php_request_shutdown (dummy=0x0) at
/tmp/php4-STABLE-200307081130/main/main.c:995
#8 0x403c4923 in php_apache_request_dtor (r=0x81a6830,
tsrm_ls=0x81aa7f0)
at
/tmp/php4-STABLE-200307081130/sapi/apache2handler/sapi_apache2.c:445
#9 0x403c4c4d in php_handler (r=0x81a6830)
at
/tmp/php4-STABLE-200307081130/sapi/apache2handler/sapi_apache2.c:541
#10 0x808269e in ap_run_handler (r=0x81a6830) at config.c:194


With my patch there are almost no problems. The problem is that
shutdown function won't execute - EG(timeout) flag should be cleared
before execution of shutdown function.
I can correct it if you want.

------------------------------------------------------------------------

[2003-07-21 02:07:48] wmeler at wp-sa dot pl

I took few days off. You know - holidays.
My config.nice :

'./configure' \
'--disable-all' \
'--with-apxs2=/usr/local/apache2/bin/apxs' \
'--with-config-file-path=/usr/local/apache2/conf/' \
'--enable-debug' \
"$@"

my script:
<?
function shutdown() {
echo strlen($GLOBALS['a']);
}
set_time_limit(1);
register_shutdown_function('shutdown');
while (true) $a.='a';

I use apache 2.0.47 with config.nice:
"./configure" \
"--enable-so" \
"--with-mpm=worker" \
"$@"

Now I have SIGSEGVs instead of hangs :) - probably longjump hit in the
middle of emalloc/erealloc and memory cache is corrupted.
I used my own module before, witch uses shared variables and locks -
thats why it hanged. Now - without my module it just crashes :).

------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
http://bugs.php.net/16820

--
Edit this bug report at http://bugs.php.net/?id=16820&edit=1