php7-fpm segfault

[danelowe]

I've been finding segfaults in production.

I'm not using weakref directly but it is part of the dependencies for a library that I'm using (https://github.com/OggettoWeb/messenger/wiki/Installation-&-Setup#weakref), so I haven't got steps to reproduce.

GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/php-fpm7.0...Reading symbols from /usr/lib/debug/.build-id/c7/7525c868f3a9e62665b89857f9bac4b640f132.debug...done.
done.
[New LWP 29729]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm: pool www                                                            '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007f9aa244e1c6 in wr_store_tracked_object_dtor (ref_obj=0x7f9aae09a3c0) at /tmp/pear/temp/Weakref/wr_store.c:63
#2  0x00007f9ab0b6b72b in zend_objects_store_del (object=0x7f9aae09a3c0) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_objects_API.c:160
#3  0x00007f9ab0b31486 in _zval_dtor_func_for_ptr (p=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_variables.c:109
#4  0x00007f9ab0bb732a in i_free_compiled_variables (execute_data=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_execute.c:2061
#5  zend_leave_helper_SPEC () at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:531
#6  0x00007f9ab0b6f44b in execute_ex (ex=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:414
#7  0x00007f9ab0b239f9 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_dtrace.c:83
#8  0x00007f9aa1775c62 in nr_php_execute_enabled () from /usr/lib/php/20151012/newrelic.so
#9  0x00007f9aa17763b2 in nr_php_execute () from /usr/lib/php/20151012/newrelic.so
#10 0x00007f9ab0bacc30 in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:800
#11 0x00007f9ab0b6f44b in execute_ex (ex=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:414
#12 0x00007f9ab0b239f9 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_dtrace.c:83
#13 0x00007f9aa1775c62 in nr_php_execute_enabled () from /usr/lib/php/20151012/newrelic.so
#14 0x00007f9aa17763b2 in nr_php_execute () from /usr/lib/php/20151012/newrelic.so
#15 0x00007f9ab0bacc30 in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:800
#16 0x00007f9ab0b6f44b in execute_ex (ex=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:414
#17 0x00007f9ab0b239f9 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_dtrace.c:83
#18 0x00007f9aa1775c62 in nr_php_execute_enabled () from /usr/lib/php/20151012/newrelic.so
#19 0x00007f9aa17763b2 in nr_php_execute () from /usr/lib/php/20151012/newrelic.so
#20 0x00007f9ab0bacc30 in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:800
#21 0x00007f9ab0b6f44b in execute_ex (ex=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:414
#22 0x00007f9ab0b239f9 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_dtrace.c:83
#23 0x00007f9aa1775c62 in nr_php_execute_enabled () from /usr/lib/php/20151012/newrelic.so
#24 0x00007f9aa17763b2 in nr_php_execute () from /usr/lib/php/20151012/newrelic.so
#25 0x00007f9ab0bacc30 in ZEND_DO_FCALL_SPEC_HANDLER () at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:800
#26 0x00007f9ab0b6f44b in execute_ex (ex=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:414
#27 0x00007f9ab0b239f9 in dtrace_execute_ex (execute_data=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_dtrace.c:83
#28 0x00007f9aa1775e46 in nr_php_execute_enabled () from /usr/lib/php/20151012/newrelic.so
#29 0x00007f9aa17763b2 in nr_php_execute () from /usr/lib/php/20151012/newrelic.so
#30 0x00007f9ab0bb866f in zend_execute (op_array=op_array@entry=0x7f9aae07f000, return_value=return_value@entry=0x0)
    at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend_vm_execute.h:458
#31 0x00007f9ab0b33034 in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3) at /build/php7.0-RID4hL/php7.0-7.0.6/Zend/zend.c:1427
#32 0x00007f9ab0ad6d28 in php_execute_script (primary_file=0x7fff939f3420) at /build/php7.0-RID4hL/php7.0-7.0.6/main/main.c:2494
#33 0x00007f9ab09c7d7c in main (argc=<optimized out>, argv=<optimized out>) at /build/php7.0-RID4hL/php7.0-7.0.6/sapi/fpm/fpm/fpm_main.c:1968
(gdb) frame 1
#1  0x00007f9aa244e1c6 in wr_store_tracked_object_dtor (ref_obj=0x7f9aae09a3c0) at /tmp/pear/temp/Weakref/wr_store.c:63
63  /tmp/pear/temp/Weakref/wr_store.c: No such file or directory.

Also don't have any experience with C or dumps. If I send the dump file, can it be looked into?

The libraries can still work without weakref, so I've just disabled weakref for now.

[colder]

I've just commited a fix to a different crash. It is however likely that it also fixes your issue here. Can you build it from the source in order to test it?