[BUG]: Segmentation fault after upgrading from Phalcon v3.4.5 to v4.1.2

[bobkorinek]

I am trying to upgrade PHP from v7.2.34 to v7.4.27 which means I have to upgrade the Phalcon from v3.4.5 to v4.1.2. When I tried to install Phalcon v4.1.2 I have started to get occasionally segmentation fault (some of my web pages are running alright, some of them just crash).

I've tried to locate the code where the program stops, but it stops pretty much randomly (modifying the code like removing lines, where the program stops will cause the program to stop on the next line for example). Reinstalling Phalcon didn't helped either, even though I have tried installing it from PECL, from ppa:ondrej/php and building the framework on my own. The problem has been tested in my environment Ubuntu 20.04 (Apache2 with PHP FPM) and inside Docker container using php:7.4-apache and php:7.2-apache images. Every environment resulted in the same error.

I believed this was the same problem as described in this issue, but nothing from there unfortunately helped me.

Here is my backtrace.

#0  0x000055a8e3d2a0f8 in _emalloc ()
#1  0x000055a8e3d2d583 in ?? ()
#2  0x000055a8e3d3c286 in ?? ()
#3  0x000055a8e3d33926 in ?? ()
#4  0x000055a8e3d37478 in ?? ()
#5  0x000055a8e3d3785b in ?? ()
#6  0x000055a8e3d37dd5 in ?? ()
#7  0x000055a8e3d37296 in ?? ()
#8  0x000055a8e3d33bf4 in ?? ()
#9  0x000055a8e3d3afa7 in ?? ()
#10 0x000055a8e3d3c0bf in ?? ()
#11 0x000055a8e3d3b117 in ?? ()
#12 0x000055a8e3d3dbba in ?? ()
#13 0x000055a8e3d3b10a in ?? ()
#14 0x000055a8e3d3c0bf in ?? ()
#15 0x000055a8e3d3b117 in ?? ()
#16 0x000055a8e3d3c700 in ?? ()
#17 0x000055a8e3d3b12c in ?? ()
#18 0x000055a8e3d3c0bf in ?? ()
#19 0x000055a8e3d3b117 in ?? ()
#20 0x000055a8e3d3ce40 in ?? ()
#21 0x000055a8e3d3ddc7 in ?? ()
#22 0x000055a8e3d3ddf0 in ?? ()
#23 0x000055a8e3d152f4 in ?? ()
#24 0x000055a8e3d16a5a in compile_file ()
#25 0x00007f56542e59ad in ?? () from /usr/lib/php/20190902/phar.so
#26 0x000055a8e3d9bb81 in ?? ()
#27 0x000055a8e3db874e in ?? ()
#28 0x000055a8e3dd0479 in execute_ex ()
#29 0x000055a8e3d40f6f in zend_call_function ()
#30 0x000055a8e3c4b2b4 in ?? ()
#31 0x000055a8e3d41172 in zend_call_function ()
#32 0x000055a8e3d41545 in zend_lookup_class_ex ()
#33 0x000055a8e3d41d93 in zend_fetch_class_by_name ()
#34 0x000055a8e3db5a77 in ?? ()
#35 0x000055a8e3dd1c27 in execute_ex ()
#36 0x000055a8e3d40f6f in zend_call_function ()
#37 0x00007f5653a67133 in zephir_call_user_func_array_noex (return_value=0x7ffec9b05710, handler=<optimized out>, params=0x7ffec9b04bd0) at /tmp/pear/temp/phalcon/phalcon.zep.c:8927
#38 0x00007f5653b03ff5 in zephir_call_user_func_array (params=0x7ffec9b04bd0, handler=0x7ffec9b04be0, return_value=0x7ffec9b05710) at /tmp/pear/temp/phalcon/phalcon.zep.c:164656
#39 zim_Phalcon_Dispatcher_AbstractDispatcher_callActionMethod (execute_data=<optimized out>, return_value=0x7ffec9b05710) at /tmp/pear/temp/phalcon/phalcon.zep.c:33584
#40 0x000055a8e3d41172 in zend_call_function ()
#41 0x00007f5653a6f7f3 in zephir_call_user_function (object_pp=object_pp@entry=0x7f5656e14660, obj_ce=obj_ce@entry=0x55a8e4eef160, type=type@entry=zephir_fcall_method, function_name=function_name@entry=0x7ffec9b05020, retval_ptr=retval_ptr@entry=0x7ffec9b05710, 
    cache_entry=cache_entry@entry=0x7ffec9b05208, cache_slot=<optimized out>, param_count=<optimized out>, params=<optimized out>) at /tmp/pear/temp/phalcon/phalcon.zep.c:8731
#42 0x00007f5653a70097 in zephir_call_class_method_aparams (return_value=return_value@entry=0x7ffec9b05710, ce=0x55a8e4eef160, type=type@entry=zephir_fcall_method, object=object@entry=0x7f5656e14660, method_name=method_name@entry=0x7f5653f0b8a1 "callactionmethod", 
    method_len=method_len@entry=16, cache_entry=0x7ffec9b05208, cache_slot=0, param_count=3, params=0x7ffec9b05870) at /tmp/pear/temp/phalcon/phalcon.zep.c:8869
#43 0x00007f5653e9d214 in zim_Phalcon_Dispatcher_AbstractDispatcher_dispatch (execute_data=<optimized out>, return_value=0x7ffec9b05e20) at /usr/include/php/20190902/Zend/zend_types.h:441
#44 0x000055a8e3d41172 in zend_call_function ()
#45 0x00007f5653a6f7f3 in zephir_call_user_function (object_pp=object_pp@entry=0x7ffec9b05d90, obj_ce=obj_ce@entry=0x55a8e4eef160, type=type@entry=zephir_fcall_method, function_name=function_name@entry=0x7ffec9b05c70, retval_ptr=retval_ptr@entry=0x7ffec9b05e20, 
    cache_entry=cache_entry@entry=0x0, cache_slot=<optimized out>, param_count=<optimized out>, params=<optimized out>) at /tmp/pear/temp/phalcon/phalcon.zep.c:8731
#46 0x00007f5653a70097 in zephir_call_class_method_aparams (return_value=return_value@entry=0x7ffec9b05e20, ce=0x55a8e4eef160, type=type@entry=zephir_fcall_method, object=object@entry=0x7ffec9b05d90, method_name=method_name@entry=0x7f5653f06c42 "dispatch", 
    method_len=method_len@entry=8, cache_entry=0x0, cache_slot=0, param_count=0, params=0x7ffec9b06100) at /tmp/pear/temp/phalcon/phalcon.zep.c:8869
#47 0x00007f5653d8893e in zim_Phalcon_Mvc_Application_handle (execute_data=<optimized out>, return_value=0x7f5656e14460) at /usr/include/php/20190902/Zend/zend_types.h:441
#48 0x000055a8e3dd686b in execute_ex ()
#49 0x000055a8e3db82b4 in ?? ()
#50 0x000055a8e3dd1e5b in execute_ex ()
#51 0x000055a8e3dd663e in execute_ex ()
#52 0x000055a8e3dd965b in zend_execute ()
#53 0x000055a8e3d4fb8c in zend_execute_scripts ()
#54 0x000055a8e3cef2a0 in php_execute_script ()
#55 0x000055a8e3bb6a2e in ?? ()
#56 0x00007f56591300b3 in __libc_start_main (main=0x55a8e3bb5b00, argc=4, argv=0x7ffec9b08dc8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffec9b08db8) at ../csu/libc-start.c:308
#57 0x000055a8e3bb782e in _start ()

[Fenikkusu]

Does the back trace look relatively the same on each execution? Also, did you compile Phalcon in development mode? It appears not from what I see.

[bobkorinek]

I have tried to build Phalcon as described here and now I get this backtrace:

GNU gdb (Debian 10.1-1.7) 10.1.90.20210103-git
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/php-fpm7.4...
(No debugging symbols found in /usr/sbin/php-fpm7.4)

warning: Can't open file /dev/zero (deleted) during file-backed mapping note processing
[New LWP 28732]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm: pool www                                                          '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00005600878060a6 in _emalloc_56 ()
(gdb) bt
#0  0x00005600878060a6 in _emalloc_56 ()
#1  0x0000560087839839 in _zend_new_array_0 ()
#2  0x00007f0c314ba654 in ?? () from /usr/lib/php/20190902/tokenizer.so
#3  0x00007f0c314ba9ac in ?? () from /usr/lib/php/20190902/tokenizer.so
#4  0x00007f0c314bab58 in ?? () from /usr/lib/php/20190902/tokenizer.so
#5  0x00005600878b1fc4 in execute_ex ()
#6  0x000056008781f404 in zend_call_function ()
#7  0x000056008781f715 in _call_user_function_ex ()
#8  0x00005600877bd6a8 in ?? ()
#9  0x00005600877e1847 in _php_stream_fill_read_buffer ()
#10 0x00005600877e1bc9 in _php_stream_read ()
#11 0x0000560087849017 in zend_stream_fixup ()
#12 0x00005600877f3a4c in open_file_for_scanning ()
#13 0x00005600877f3d29 in compile_file ()
#14 0x00007f0c31663e39 in ?? () from /usr/lib/php/20190902/phar.so
#15 0x00007f0c342a0f8e in ?? () from /usr/lib/php/20190902/opcache.so
#16 0x00005600877f3e13 in compile_filename ()
#17 0x0000560087879237 in ?? ()
#18 0x00005600878953ca in ?? ()
#19 0x00005600878adc29 in execute_ex ()
#20 0x000056008781f404 in zend_call_function ()
#21 0x000056008772dc5c in ?? ()
#22 0x000056008781f2ed in zend_call_function ()
#23 0x000056008781f9e4 in zend_lookup_class_ex ()
#24 0x00005600878202bf in zend_fetch_class_by_name ()
#25 0x0000560087892857 in ?? ()
#26 0x00005600878acb7d in execute_ex ()
#27 0x000056008781f404 in zend_call_function ()
#28 0x00007f0c33d04163 in zephir_call_user_func_array_noex () from /usr/lib/php/20190902/phalcon.so
#29 0x00007f0c33ebd0c5 in zim_Phalcon_Di_Service_resolve () from /usr/lib/php/20190902/phalcon.so
#30 0x000056008781f2ed in zend_call_function ()
#31 0x00007f0c33d034c3 in zephir_call_user_function () from /usr/lib/php/20190902/phalcon.so
#32 0x00007f0c33d03fad in zephir_call_class_method_aparams () from /usr/lib/php/20190902/phalcon.so
#33 0x00007f0c33d94021 in zim_Phalcon_Di_get () from /usr/lib/php/20190902/phalcon.so
#34 0x00005600878b4257 in execute_ex ()
#35 0x000056008781f404 in zend_call_function ()
#36 0x00007f0c33d034c3 in zephir_call_user_function () from /usr/lib/php/20190902/phalcon.so
#37 0x00007f0c33d03fad in zephir_call_class_method_aparams () from /usr/lib/php/20190902/phalcon.so
#38 0x00007f0c33d99a18 in zim_Phalcon_Dispatcher_AbstractDispatcher_dispatch () from /usr/lib/php/20190902/phalcon.so
#39 0x000056008781f2ed in zend_call_function ()
#40 0x00007f0c33d034c3 in zephir_call_user_function () from /usr/lib/php/20190902/phalcon.so
#41 0x00007f0c33d03fad in zephir_call_class_method_aparams () from /usr/lib/php/20190902/phalcon.so
#42 0x00007f0c33f90a7d in zim_Phalcon_Mvc_Application_handle () from /usr/lib/php/20190902/phalcon.so
#43 0x00005600878b4257 in execute_ex ()
#44 0x00005600878b552b in zend_execute ()
#45 0x000056008782dfe4 in zend_execute_scripts ()
#46 0x00005600877ccc80 in php_execute_script ()
#47 0x000056008769b1b1 in ?? ()
#48 0x00007f0c369d6d0a in __libc_start_main (main=0x56008769a300, argc=4, argv=0x7ffeb9296c48, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffeb9296c38)
    at ../csu/libc-start.c:308
#49 0x000056008769bf0a in _start ()

I get the same backtrace everytime a execute the same script.

[noone-silent]

There is one warning: warning: Can't open file /dev/zero (deleted) during file-backed mapping note processing

Can you try to recompile phalcon and look for warnings or errors? Also disable all third party modules in PHP. If this doesn't help, which route are you calling? Can you step by step debug it and see on which line the seg fault happens?

[FPEPOSHI]

Same issue reported here (https://github.com/phalcon/cphalcon/discussions/16028 )

[Jeckerson]

Fixed in v5