Sometimes, we're getting segfaults in http\Client->send() in one of our unit tests that makes use of NTLM Proxy authentication if a persistent client that did not previously use Proxy auth is re-used. An xdebug call trace call shows that the attached observer receives a few updates before the segfault occurs, and usually ends on SplObjectStorage->valid()
, which is associated with the send()
call. The segault is always in __strcasecmp_l_avx() via curl_strequal().
(gdb) zbacktrace
[0x7ffff14179d0] http\Client->send() [internal function]
[0x7ffff14175e0] RequestLoader->send() /lib/php/http/RequestLoader.php:1021
(gdb) bt
#0 __strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:165
#1 0x00007ffff6dc26e9 in curl_strequal (first=<optimized out>, second=<optimized out>) at strequal.c:37
#2 0x00007ffff6dba7bc in ConnectionExists (waitpipe=<synthetic pointer>, force_reuse=<synthetic pointer>, usethis=<synthetic pointer>, needle=0xf859a0, data=0xf7a6c0) at url.c:3344
#3 create_conn (async=0x7fffffff9e58, in_connect=0xf7a6d0, data=<optimized out>) at url.c:5719
#4 Curl_connect (data=data@entry=0xf7a6c0, in_connect=in_connect@entry=0xf7a6d0, asyncp=asyncp@entry=0x7fffffff9e58, protocol_done=protocol_done@entry=0x7fffffff9e59) at url.c:5979
#5 0x00007ffff6dcb5d3 in multi_runsingle (multi=multi@entry=0xed0b90, now=..., data=data@entry=0xf7a6c0) at multi.c:1089
#6 0x00007ffff6dcc02d in curl_multi_perform (multi_handle=0xed0b90, running_handles=running_handles@entry=0x7fffdd8d2548) at multi.c:1793
#7 0x00007fffee6f9deb in php_http_client_curl_once (h=0x7fffdd410cc0) at /external/pecl_http-3.0.1/src/php_http_client_curl.c:2394
#8 php_http_client_curl_exec (h=0x7fffdd410cc0) at /external/pecl_http-3.0.1/src/php_http_client_curl.c:2424
#9 0x00007fffee6f36f1 in zim_HttpClient_send (execute_data=0x7ffff14179d0, return_value=0x7ffff14178d0) at /external/pecl_http-3.0.1/src/php_http_client.c:788
#10 0x000000000075cec2 in ZEND_DO_FCALL_SPEC_HANDLER () at /external/php-7.0.5/Zend/zend_vm_execute.h:842
#11 0x000000000071ab6b in execute_ex (ex=<optimized out>) at /external/php-7.0.5/Zend/zend_vm_execute.h:414
#12 0x00000000006c5d6d in zend_call_function (fci=fci@entry=0x7fffffffa220, fci_cache=fci_cache@entry=0x7fffffffa1f0) at /external/php-7.0.5/Zend/zend_execute_API.c:863
#13 0x0000000000572e78 in zim_reflection_method_invokeArgs (execute_data=<optimized out>, return_value=0x7ffff1417020) at /external/php-7.0.5/ext/reflection/php_reflection.c:3348
#14 0x000000000075cec2 in ZEND_DO_FCALL_SPEC_HANDLER () at /external/php-7.0.5/Zend/zend_vm_execute.h:842
#15 0x000000000071ab6b in execute_ex (ex=<optimized out>) at /external/php-7.0.5/Zend/zend_vm_execute.h:414
#16 0x000000000077d7fb in zend_execute (op_array=0x7ffff1488000, op_array@entry=0x7ffff1416e20, return_value=return_value@entry=0x0) at /external/php-7.0.5/Zend/zend_vm_execute.h:458
#17 0x00000000006d4a00 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=2) at /external/php-7.0.5/Zend/zend.c:1427
#18 0x000000000066a63a in php_execute_script (primary_file=primary_file@entry=0x7fffffffc900) at /external/php-7.0.5/main/main.c:2503
#19 0x000000000077f786 in do_cli (argc=4, argv=0xd056b0) at /external/php-7.0.5/sapi/cli/php_cli.c:974
#20 0x000000000042d824 in main (argc=4, argv=0xd056b0) at /external/php-7.0.5/sapi/cli/php_cli.c:1344
(gdb) bt full
#0 __strcasecmp_l_avx () at ../sysdeps/x86_64/multiarch/strcmp-sse42.S:165
No locals.
#1 0x00007ffff6dc26e9 in curl_strequal (first=<optimized out>, second=<optimized out>) at strequal.c:37
No locals.
#2 0x00007ffff6dba7bc in ConnectionExists (waitpipe=<synthetic pointer>, force_reuse=<synthetic pointer>, usethis=<synthetic pointer>, needle=0xf859a0,
data=0xf7a6c0) at url.c:3344
match = true
pipeLen = 0
max_pipe_len = 5
best_pipe_len = 5
curr = 0x0
chosen = 0x0
bundle = <optimized out>
wantProxyNTLMhttp = true
check = 0xf83710
canPipeline = false
wantNTLMhttp = true
#3 create_conn (async=0x7fffffff9e58, in_connect=0xf7a6d0, data=<optimized out>) at url.c:5719
conn = <optimized out>
result = <optimized out>
options = 0x15b00 <error: Cannot access memory at address 0x15b00>
proxy = 0x0
max_host_connections = <optimized out>
conn_temp = 0x0
urllen = <optimized out>
passwd = 0xf85860 ""
prot_missing = <optimized out>
connections_available = true
max_total_connections = <optimized out>
user = 0xf85840 ""
reuse = <optimized out>
force_reuse = false
waitpipe = false
#4 Curl_connect (data=data@entry=0xf7a6c0, in_connect=in_connect@entry=0xf7a6d0, asyncp=asyncp@entry=0x7fffffff9e58,
protocol_done=protocol_done@entry=0x7fffffff9e59) at url.c:5979
result = <optimized out>
#5 0x00007ffff6dcb5d3 in multi_runsingle (multi=multi@entry=0xed0b90, now=..., data=data@entry=0xf7a6c0) at multi.c:1089
disconnect_conn = false
msg = <optimized out>
connected = false
async = false
protocol_connect = false
dophase_done = false
done = false
rc = CURLM_OK
result = CURLE_OK
k = <optimized out>
timeout_ms = <optimized out>
control = 32767
#6 0x00007ffff6dcc02d in curl_multi_perform (multi_handle=0xed0b90, running_handles=running_handles@entry=0x7fffdd8d2548) at multi.c:1793
result = <optimized out>
wc = 0xf83258
pipe_st = {old_pipe_act = {__sigaction_handler = {sa_handler = 0x1, sa_sigaction = 0x1}, sa_mask = {__val = {4096, 140736911328648,
6545642012970847240, 140736911609880, 6545642014900255232, 140737488330224, 6545642014900255232, 140737488330224, 140737193644977,
140736911328648, 140733193391112, 140737488330296, 140737488330292, 140736905654208, 6545642014900255232, 140736911329576}},
sa_flags = 335544320, sa_restorer = 0x7ffff640e2f0 <__restore_rt>}, no_signal = false}
multi = 0xed0b90
data = 0xf7a6c0
returncode = CURLM_OK
t = 0x0
#7 0x00007fffee6f9deb in php_http_client_curl_once (h=0x7fffdd410cc0)
at /external/pecl_http-3.0.1/src/php_http_client_curl.c:2394
curl = 0x7fffdd8d2540
#8 php_http_client_curl_exec (h=0x7fffdd410cc0) at /external/pecl_http-3.0.1/src/php_http_client_curl.c:2424
No locals.
#9 0x00007fffee6f36f1 in zim_HttpClient_send (execute_data=0x7ffff14179d0, return_value=0x7ffff14178d0)
at /external/pecl_http-3.0.1/src/php_http_client.c:788
__zeh = {handling = EH_NORMAL, exception = 0x0, user_handler = {value = {lval = 140736905654208, dval = 6.9533270185744858e-310,
counted = 0x7fffdd44afc0, str = 0x7fffdd44afc0, arr = 0x7fffdd44afc0, obj = 0x7fffdd44afc0, res = 0x7fffdd44afc0, ref = 0x7fffdd44afc0,
ast = 0x7fffdd44afc0, zv = 0x7fffdd44afc0, ptr = 0x7fffdd44afc0, ce = 0x7fffdd44afc0, func = 0x7fffdd44afc0, ww = {w1 = 3712266176, w2 = 32767}},
u1 = {v = {type = 7 '\a', type_flags = 28 '\034', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 7175}, u2 = {var_flags = 0, next = 0,
cache_slot = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0}}}
#10 0x000000000075cec2 in ZEND_DO_FCALL_SPEC_HANDLER () at /external/php-7.0.5/Zend/zend_vm_execute.h:842
should_change_scope = 1
call = 0x7ffff14179d0
fbc = 0xeb35d0
object = <optimized out>
ret = <optimized out>
#11 0x000000000071ab6b in execute_ex (ex=<optimized out>) at /external/php-7.0.5/Zend/zend_vm_execute.h:414
orig_opline = 0x0
orig_execute_data = 0xe46c20
#12 0x00000000006c5d6d in zend_call_function (fci=fci@entry=0x7fffffffa220, fci_cache=fci_cache@entry=0x7fffffffa1f0)
at /external/php-7.0.5/Zend/zend_execute_API.c:863
call_via_handler = 1
i = <optimized out>
calling_scope = <optimized out>
call = 0xc3
dummy_execute_data = {opline = 0x0, call = 0x0, return_value = 0x7fffffffa150, func = 0x80, This = {value = {lval = 0, dval = 0, counted = 0x0,
str = 0x0, arr = 0x0, obj = 0x0, res = 0x0, ref = 0x0, ast = 0x0, zv = 0x0, ptr = 0x0, ce = 0x0, func = 0x0, ww = {w1 = 0, w2 = 0}}, u1 = {v = {
type = 0 '\000', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 0}, u2 = {var_flags = 32767, next = 32767,
cache_slot = 32767, lineno = 32767, num_args = 32767, fe_pos = 32767, fe_iter_idx = 32767}}, called_scope = 0xe46c20,
prev_execute_data = 0x710c9a <zend_object_std_init+42>, symbol_table = 0xe46c20, run_time_cache = 0xe46c20, literals = 0x7fffdd9a0238}
fci_cache_local = {initialized = 64 '@', function_handler = 0x7fffdd44bc5b, calling_scope = 0xe46c20,
called_scope = 0x713c07 <zend_std_write_property+439>, object = 0x0}
func = 0x7fffddb22f68
orig_scope = 0x7ffff14175e0
#13 0x0000000000572e78 in zim_reflection_method_invokeArgs (execute_data=<optimized out>, return_value=0x7ffff1417020)
at /external/php-7.0.5/ext/reflection/php_reflection.c:3348
retval = {value = {lval = 140736912917632, dval = 6.9533273774353128e-310, counted = 0x7fffddb38480, str = 0x7fffddb38480, arr = 0x7fffddb38480,
obj = 0x7fffddb38480, res = 0x7fffddb38480, ref = 0x7fffddb38480, ast = 0x7fffddb38480, zv = 0x7fffddb38480, ptr = 0x7fffddb38480,
ce = 0x7fffddb38480, func = 0x7fffddb38480, ww = {w1 = 3719529600, w2 = 32767}}, u1 = {v = {type = 0 '\000', type_flags = 0 '\000',
const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 0}, u2 = {var_flags = 0, next = 0, cache_slot = 0, lineno = 0, num_args = 0,
fe_pos = 0, fe_iter_idx = 0}}
params = 0x7fffdd831560
val = <optimized out>
object = 0x7ffff14173b0
mptr = <optimized out>
i = <optimized out>
argc = <optimized out>
result = <optimized out>
fci = {size = 72, function_table = 0x0, function_name = {value = {lval = 140736911386712, dval = 6.9533273017978149e-310, counted = 0x7fffdd9c2858,
str = 0x7fffdd9c2858, arr = 0x7fffdd9c2858, obj = 0x7fffdd9c2858, res = 0x7fffdd9c2858, ref = 0x7fffdd9c2858, ast = 0x7fffdd9c2858,
zv = 0x7fffdd9c2858, ptr = 0x7fffdd9c2858, ce = 0x7fffdd9c2858, func = 0x7fffdd9c2858, ww = {w1 = 3717998680, w2 = 32767}}, u1 = {v = {
type = 0 '\000', type_flags = 0 '\000', const_flags = 0 '\000', reserved = 0 '\000'}, type_info = 0}, u2 = {var_flags = 0, next = 0,
cache_slot = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0}}, symbol_table = 0x0, retval = 0x7fffffffa1e0, params = 0x7fffdd831560,
object = 0x7fffddb88300, no_separation = 1 '\001', param_count = 0}
fcc = {initialized = 1 '\001', function_handler = 0x7fffddb22f68, calling_scope = 0x7fffddb20a60, called_scope = 0x7fffddb20a60,
object = 0x7fffddb88300}
obj_ce = 0x7fffddb20a60
param_array = 0x7ffff14173c0
#14 0x000000000075cec2 in ZEND_DO_FCALL_SPEC_HANDLER () at /external/php-7.0.5/Zend/zend_vm_execute.h:842
should_change_scope = 1
call = 0x7ffff1417350
fbc = 0xd50230
object = <optimized out>
ret = <optimized out>
#15 0x000000000071ab6b in execute_ex (ex=<optimized out>) at /external/php-7.0.5/Zend/zend_vm_execute.h:414
orig_opline = 0x1
orig_execute_data = 0x7ffff1488000
#16 0x000000000077d7fb in zend_execute (op_array=0x7ffff1488000, op_array@entry=0x7ffff1416e20, return_value=return_value@entry=0x0)
at /external/php-7.0.5/Zend/zend_vm_execute.h:458
execute_data = 0x7ffff1414030
#17 0x00000000006d4a00 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=2)
at /external/php-7.0.5/Zend/zend.c:1427
files = {{gp_offset = 32, fp_offset = 32767, overflow_arg_area = 0x7fffffffa400, reg_save_area = 0x7fffffffa390}}
i = 0
file_handle = 0x7fffffffc900
op_array = 0x7ffff1416e20
#18 0x000000000066a63a in php_execute_script (primary_file=primary_file@entry=0x7fffffffc900)
at /external/php-7.0.5/main/main.c:2503
orig_start_lineno = 2
realfile = "/scripts/devel/runTest.php\000\000\000\vzN\000\000\000\000\000`\000\000\000\000\000\000\000\022\000\000\000\000\000\000\000\254\272\377\377\377\177\000\000\200\267\377\377\377\177\000\000\020\272\377\377\377\177\000\000\264\267\377\377\377\177\000\000\001\000\000\000\000\000\000\000\a\000\000\000\061", '\000' <repeats 19 times>, "[\000\000\000n", '\000' <repeats 19 times>, "w\000\000\000|\000\000\000\260\070\331\000\000\000\000\000\200\273\325\000\000\000\000\000\001\000\000\000\001", '\000' <repeats 11 times>...
__orig_bailout = 0x7fffffffc970
__bailout = {{__jmpbuf = {140737488341360, 3230684716981082733, 13653776, 10123608, 1, 140737488345880, 3230684720271514221, -3230684498283668883},
__mask_was_saved = 0, __saved_mask = {__val = {140737351952052, 130, 140737274569429, 0, 140737351916829, 33780297937977475, 140733344413699,
33780297971531907, 33884779560597507, 7228277404077127176, 13109978517422995065, 8651696361302917119, 18446603336858761216, 140737488336367,
140737277096190, 0}}}}
prepend_file_p = 0x7fffffffb430
append_file_p = 0x0
prepend_file = {handle = {fd = -246959360, fp = 0x7ffff147b300, stream = {handle = 0x7ffff147b300, isatty = 0, mmap = {len = 4510, pos = 0, map = 0x0,
buf = 0x7ffff7ff3000 "", old_handle = 0x0, old_closer = 0x0}, reader = 0x683ef0 <_php_stream_read>, fsizer = 0x668020 <php_zend_stream_fsizer>,
closer = 0x668000 <php_zend_stream_mmap_closer>}}, filename = 0xd22a18 "init/bootstrap.php", opened_path = 0x0, type = ZEND_HANDLE_MAPPED,
free_filename = 0 '\000'}
append_file = {handle = {fd = 0, fp = 0x0, stream = {handle = 0x0, isatty = 0, mmap = {len = 0, pos = 0, map = 0x0, buf = 0x0, old_handle = 0x0,
old_closer = 0x0}, reader = 0x0, fsizer = 0x0, closer = 0x0}}, filename = 0x0, opened_path = 0x0, type = ZEND_HANDLE_FILENAME,
free_filename = 0 '\000'}
old_cwd = 0x7fffffffa400 ""
retval = 0
#19 0x000000000077f786 in do_cli (argc=4, argv=0xd056b0) at /external/php-7.0.5/sapi/cli/php_cli.c:974
__orig_bailout = 0x7fffffffdb20
__bailout = {{__jmpbuf = {13377760, 3230684717153573485, 0, 0, 0, 140737488345880, 3230684717016734317, -3230684354615518611}, __mask_was_saved = 0,
__saved_mask = {__val = {10004352, 10004376, 9893079, 9893100, 10004389, 10004409, 10004426, 10004990, 10004447, 10004461, 10004483, 10004502,
10004529, 10004558, 0, 2133424}}}}
c = <optimized out>
file_handle = {handle = {fd = -246951760, fp = 0x7ffff147d0b0, stream = {handle = 0x7ffff147d0b0, isatty = 0, mmap = {len = 7396, pos = 0,
map = 0x7ffff7fec000, buf = 0x7ffff7fec014 <error: Cannot access memory at address 0x7ffff7fec014>, old_handle = 0xeccef0,
old_closer = 0x6f2b50 <zend_stream_stdio_closer>}, reader = 0x6f2b80 <zend_stream_stdio_reader>, fsizer = 0x6f2ad0 <zend_stream_stdio_fsizer>,
closer = 0x6f2a50 <zend_stream_mmap_closer>}}, filename = 0xd05710 "/scripts/devel/runTest.php", opened_path = 0x0,
type = ZEND_HANDLE_MAPPED, free_filename = 0 '\000'}
behavior = <optimized out>
reflection_what = 0x0
request_started = 1
exit_status = 0
php_optarg = 0x0
php_optind = 2
exec_direct = <optimized out>
exec_run = <optimized out>
exec_begin = <optimized out>
exec_end = <optimized out>
arg_free = <optimized out>
arg_excp = <optimized out>
script_file = <optimized out>
translated_path = 0xecce40 "/scripts/devel/runTest.php"
lineno = 2
param_error = 0x0
#20 0x000000000042d824 in main (argc=4, argv=0xd056b0) at /external/php-7.0.5/sapi/cli/php_cli.c:1344
__orig_bailout = 0x0
__bailout = {{__jmpbuf = {13377760, 3230684717153573485, 0, 0, 0, 140737488345880, 3230684717102717549, -3230684191535080851}, __mask_was_saved = 0,
__saved_mask = {__val = {4131212846, 4294967295, 140737351944685, 140737324683768, 140737353954544, 1, 140737324664544, 10, 4, 140737488346376,
140737351974768, 140737301641600, 140737351974768, 4294958068, 0, 1}}}}
c = <optimized out>
exit_status = 0
module_started = 1
sapi_started = 1
php_optarg = 0x0
php_optind = 1
use_extended_info = 0
ini_path_override = 0x0
ini_entries = 0xd059b0 "html_errors=0\nregister_argc_argv=1\nimplicit_flush=1\noutput_buffering=0\nmax_execution_time=0\nmax_input_time=-1\n"
ini_entries_len = 0
ini_ignore = 0
sapi_module = <optimized out>