Segmentation fault with php7.1 about pecl-memcache

[tomassrnka]

Hi,

unfortunately, I can't reproduce the bug. Installed PHP 7.1 on CentOS 7.7 from REMI's repository and all seems to be working fine.

Could you please provide code that crashes PHP?
Could you please provide "php -i"?

Thanks,
Tomas

[imaben]

@tomassrnka Thanks for your reply.
This error occurs occasionally，It is more likely to occur when memcache restarting.
Debugging with gdb can find that the variable address taken out on line 1751 is unreadable.
Sorry, till now I haven't found the conditions to reproduce this error.

[shmel1k]

Hi. I have the conditions to reproduce.

I have at least 10 fpms with some kind of load(100-200rps prob) on them. I have at least 2 servers in configuration. I restart one of them and get SEGFAULT.

[imaben]

@shmel1k awesome!

[shmel1k]

I have such kind of stacktrace by the way

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f4345fc7d93 in mmc_value_handler_single () from /usr/lib/php/20170718/memcache.so
(gdb) bt
#0  0x00007f4345fc7d93 in mmc_value_handler_single () from /usr/lib/php/20170718/memcache.so
#1  0x00007f4345fcce8d in mmc_unpack_value () from /usr/lib/php/20170718/memcache.so
#2  0x00007f4345fd2c9c in ?? () from /usr/lib/php/20170718/memcache.so
#3  0x00007f4345fced04 in mmc_pool_select () from /usr/lib/php/20170718/memcache.so
#4  0x00007f4345fcf7a8 in mmc_pool_run () from /usr/lib/php/20170718/memcache.so
#5  0x00007f4345fc97a2 in ?? () from /usr/lib/php/20170718/memcache.so

Looks like all resources are freed in another C(not php) thread, but idk.
Checks like

if (!result) { return -1; }

do not work. If they dont, I think, that it is some kind of race issue

[imaben]

@shmel1k Hi, Could you please provide code that crashes PHP?

[shmel1k]

Hi!

Nothing diffucult, something like

Init script

$m = new Memcache();
$m->addServer($host1, $port1); // persistent
$m->addServer($host2, $port2); // persistent

Somewhere in php-fpm logic

$m->set('some_key', 'some_value', 42);
$m->get('some_key');