php (php-5.3.3-27.el6_5.x86_64) Segfault in gc_collect_cycles

Issue

• php segfault crashing in gc_collect_cycles - Upstream Bug #63635

(gdb) bt full
#0  _zend_mm_free_int (heap=0xca72d0, p=0x3c06408) at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2018
        mm_block = 0x3c063f8
        next_block = 0xc7d10a0
        size = 146582696
#1  0x00000000005a782f in _zval_dtor_func (zvalue=0x3a469c8) at /usr/src/debug/php-5.3.3/Zend/zend_variables.c:43
No locals.
#2  0x000000000059be5a in _zval_dtor (zval_ptr=0x3a53878) at /usr/src/debug/php-5.3.3/Zend/zend_variables.h:35
No locals.
#3  _zval_ptr_dtor (zval_ptr=0x3a53878) at /usr/src/debug/php-5.3.3/Zend/zend_execute_API.c:445
No locals.
#4  0x00000000005b49bb in zend_hash_destroy (ht=0x3a53a78) at /usr/src/debug/php-5.3.3/Zend/zend_hash.c:526
        p = 0x0
        q = 0x3a53860
#5  0x00000000005a0350 in destroy_zend_class (pce=<value optimized out>) at /usr/src/debug/php-5.3.3/Zend/zend_opcode.c:187
        ce = 0x3a53a00
#6  0x00000000005b4685 in zend_hash_apply_deleter (ht=0xca7c20, p=0x3ae90d0) at /usr/src/debug/php-5.3.3/Zend/zend_hash.c:609
        retval = <value optimized out>
#7  0x00000000005b4789 in zend_hash_reverse_apply (ht=0xca7c20, apply_func=0x59b5a0 <clean_non_persistent_class>)
    at /usr/src/debug/php-5.3.3/Zend/zend_hash.c:758
        result = 1
        p = 0x3a73f00
        q = 0x3ae90d0
#8  0x000000000059c2ae in shutdown_executor () at /usr/src/debug/php-5.3.3/Zend/zend_execute_API.c:312
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {9618240, 7021098497997711900, 140734974592751, 0, 0, 140734974592751, -7020787449176610276, 
              7021098509068053020}, __mask_was_saved = 0, __saved_mask = {__val = {45144544, 45014280, 44941704, 44941704, 
                45014280, 0, 0, 13343776, 9620512, 9619744, 9616760, 9618056, 0, 0, 5928229, 9619744}}}}
#9  0x00000000005a8a72 in zend_deactivate () at /usr/src/debug/php-5.3.3/Zend/zend.c:890
No locals.
#10 0x0000000000556655 in php_request_shutdown (dummy=<value optimized out>) at /usr/src/debug/php-5.3.3/main/main.c:1634
        report_memleaks = 1 '\001'
#11 0x0000000000631064 in main (argc=3, argv=0x7fff6a2ae9c8) at /usr/src/debug/php-5.3.3/sapi/cli/php_cli.c:1373
        exit_status = 255
        c = <value optimized out>
        file_handle = {type = ZEND_HANDLE_MAPPED, filename = 0x7fff6a2b06ef "/appdata/cmapi/app/console", opened_path = 0x0, 
          handle = {fd = 16047272, fp = 0xf4dca8, stream = {handle = 0xf4dca8, isatty = 0, mmap = {len = 962, pos = 0, 
                map = 0x7f27251b3000, buf = 0x7f27251b3013 <Address 0x7f27251b3013 out of bounds>, old_handle = 0xf75f40, 
                old_closer = 0x5bd350 <zend_stream_stdio_closer>}, reader = 0x5bd960 <zend_stream_stdio_reader>, 
              fsizer = 0x5bd400 <zend_stream_stdio_fsizer>, closer = 0x5bd8f0 <zend_stream_mmap_closer>}}, 
          free_filename = 0 '\000'}
        behavior = <value optimized out>
        reflection_what = <value optimized out>
        orig_optind = 1
        orig_optarg = 0x0
        arg_free = <value optimized out>
        arg_excp = <value optimized out>
        script_file = <value optimized out>
        interactive = <value optimized out>
        module_started = 1
        request_started = 1
        lineno = 2
---Type <return> to continue, or q <return> to quit---
        exec_direct = <value optimized out>
        exec_run = <value optimized out>
        exec_begin = <value optimized out>
        exec_end = <value optimized out>
        param_error = <value optimized out>
        hide_argv = <value optimized out>
        ini_entries_len = <value optimized out>
(gdb) frame
#0  _zend_mm_free_int (heap=0xca72d0, p=0x3c06408) at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2018
2018            if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
(gdb) info locals
mm_block = 0x3c063f8
next_block = 0xc7d10a0
size = 146582696

gdb) bt full
#0  _zend_mm_free_int (heap=0xca72d0, p=0x3c06408) at /usr/src/debug/php-5.3.3/Zend/zend_alloc.c:2018
        mm_block = 0x3c063f8
        next_block = 0xc7d10a0
        size = 146582696
#1  0x00000000005a782f in _zval_dtor_func (zvalue=0x3a469c8) at /usr/src/debug/php-5.3.3/Zend/zend_variables.c:43
No locals.
#2  0x000000000059be5a in _zval_dtor (zval_ptr=0x3a53878) at /usr/src/debug/php-5.3.3/Zend/zend_variables.h:35
No locals.
#3  _zval_ptr_dtor (zval_ptr=0x3a53878) at /usr/src/debug/php-5.3.3/Zend/zend_execute_API.c:445
No locals.
#4  0x00000000005b49bb in zend_hash_destroy (ht=0x3a53a78) at /usr/src/debug/php-5.3.3/Zend/zend_hash.c:526
        p = 0x0
        q = 0x3a53860
#5  0x00000000005a0350 in destroy_zend_class (pce=<value optimized out>) at /usr/src/debug/php-5.3.3/Zend/zend_opcode.c:187
        ce = 0x3a53a00
#6  0x00000000005b4685 in zend_hash_apply_deleter (ht=0xca7c20, p=0x3ae90d0) at /usr/src/debug/php-5.3.3/Zend/zend_hash.c:609
        retval = <value optimized out>
#7  0x00000000005b4789 in zend_hash_reverse_apply (ht=0xca7c20, apply_func=0x59b5a0 <clean_non_persistent_class>)
    at /usr/src/debug/php-5.3.3/Zend/zend_hash.c:758
        result = 1
        p = 0x3a73f00
        q = 0x3ae90d0
#8  0x000000000059c2ae in shutdown_executor () at /usr/src/debug/php-5.3.3/Zend/zend_execute_API.c:312
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {9618240, 7021098497997711900, 140734974592751, 0, 0, 140734974592751, -7020787449176610276, 
              7021098509068053020}, __mask_was_saved = 0, __saved_mask = {__val = {45144544, 45014280, 44941704, 44941704, 
                45014280, 0, 0, 13343776, 9620512, 9619744, 9616760, 9618056, 0, 0, 5928229, 9619744}}}}
#9  0x00000000005a8a72 in zend_deactivate () at /usr/src/debug/php-5.3.3/Zend/zend.c:890
No locals.
#10 0x0000000000556655 in php_request_shutdown (dummy=<value optimized out>) at /usr/src/debug/php-5.3.3/main/main.c:1634
        report_memleaks = 1 '\001'
#11 0x0000000000631064 in main (argc=3, argv=0x7fff6a2ae9c8) at /usr/src/debug/php-5.3.3/sapi/cli/php_cli.c:1373
        exit_status = 255
        c = <value optimized out>
        file_handle = {type = ZEND_HANDLE_MAPPED, filename = 0x7fff6a2b06ef "/appdata/cmapi/app/console", opened_path = 0x0, 
          handle = {fd = 16047272, fp = 0xf4dca8, stream = {handle = 0xf4dca8, isatty = 0, mmap = {len = 962, pos = 0, 
                map = 0x7f27251b3000, buf = 0x7f27251b3013 <Address 0x7f27251b3013 out of bounds>, old_handle = 0xf75f40, 
                old_closer = 0x5bd350 <zend_stream_stdio_closer>}, reader = 0x5bd960 <zend_stream_stdio_reader>, 
              fsizer = 0x5bd400 <zend_stream_stdio_fsizer>, closer = 0x5bd8f0 <zend_stream_mmap_closer>}}, 
          free_filename = 0 '\000'}
        behavior = <value optimized out>
        reflection_what = <value optimized out>
        orig_optind = 1
        orig_optarg = 0x0
        arg_free = <value optimized out>
        arg_excp = <value optimized out>
        script_file = <value optimized out>
        interactive = <value optimized out>
        module_started = 1
        request_started = 1
        lineno = 2
---Type <return> to continue, or q <return> to quit---
        exec_direct = <value optimized out>
        exec_run = <value optimized out>
        exec_begin = <value optimized out>
        exec_end = <value optimized out>
        param_error = <value optimized out>
        hide_argv = <value optimized out>
        ini_entries_len = <value optimized out>