php5-fpm process coredump-ed when apcu_clear_cache() and opcache_reset() was called

[Peter Wang]

Description:
php5-fpm process coredump-ed when apcu_clear_cache() and opcache_reset() was called

OS:
Linux www 3.2.0-54-virtual #82-Ubuntu SMP Tue Sep 10 20:31:18 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

Packages:
ii php-apc 4.0.2-2+debphp.org~precise+1 APC User Cache for PHP 5 (transitional package)
ii php-pear 5.5.8+dfsg-3+sury.org~precise+2 PEAR - PHP Extension and Application Repository
ii php5 5.5.8+dfsg-3+sury.org~precise+2 server-side, HTML-embedded scripting language (metapackage)
ii php5-apcu 4.0.2-2+debphp.org~precise+1 APC User Cache for PHP 5
ii php5-cli 5.5.8+dfsg-3+sury.org~precise+2 command-line interpreter for the php5 scripting language
ii php5-common 5.5.8+dfsg-3+sury.org~precise+2 Common files for packages built from the php5 source
ii php5-curl 5.5.8+dfsg-3+sury.org~precise+2 CURL module for php5
ii php5-dbg 5.5.8+dfsg-3+sury.org~precise+2 Debug symbols for PHP5
ii php5-dev 5.5.8+dfsg-3+sury.org~precise+2 Files for PHP5 module development
ii php5-fpm 5.5.8+dfsg-3+sury.org~precise+2 server-side, HTML-embedded scripting language (FPM-CGI binary)
ii php5-gd 5.5.8+dfsg-3+sury.org~precise+2 GD module for php5
ii php5-intl 5.5.8+dfsg-3+sury.org~precise+2 internationalisation module for php5
ii php5-json 1.3.2-3+debphp.org~precise+1 JSON module for php5
ii php5-pgsql 5.5.8+dfsg-3+sury.org~precise+2 PostgreSQL module for php5
ii php5-readline 5.5.8+dfsg-3+sury.org~precise+2 Readline module for php5

PHP version:
PHP 5.5.8-3+sury.org~precise+2 (cli) (built: Jan 29 2014 13:23:55)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2013 Zend Technologies
    with Zend OPcache v7.0.3-dev, Copyright (c) 1999-2013, by Zend Technologies

GDB backtrace:
gdb /usr/sbin/php5-fpm /tmp/core-php5-fpm.27721
GNU gdb (Ubuntu/Linaro 7.4-2012.04-0ubuntu2.1) 7.4-2012.04
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>...
Reading symbols from /usr/sbin/php5-fpm...Reading symbols from /usr/lib/debug/usr/sbin/php5-fpm...done.
done.
[New LWP 27721]

warning: Can't read pathname for load map: Input/output error.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm: pool www '.
Program terminated with signal 11, Segmentation fault.
#0 zend_mm_add_to_free_list (heap=<optimized out>, mm_block=0x261a920) at /build/buildd/php5-5.5.8+dfsg/Zend/zend_alloc.c:752
752 /build/buildd/php5-5.5.8+dfsg/Zend/zend_alloc.c: No such file or directory.
(gdb) set height 0
(gdb) bt full
#0 zend_mm_add_to_free_list (heap=<optimized out>, mm_block=0x261a920) at /build/buildd/php5-5.5.8+dfsg/Zend/zend_alloc.c:752
        prev = 0x29520a800
        m = 9223372036854775808
        p = 0x24adbd7
        size = 616
        index = 9
#1 0x00000000006b8290 in _zend_mm_free_int (heap=0x157e300, p=0x261a930) at /build/buildd/php5-5.5.8+dfsg/Zend/zend_alloc.c:2118
        mm_block = 0x261a920
        next_block = 0x261a9d0
        size = 616
#2 0x00000000006ee56e in zend_hash_destroy (ht=0xe62550) at /build/buildd/php5-5.5.8+dfsg/Zend/zend_hash.c:565
        p = 0x262cee8
        q = 0x261a930
#3 0x00000000006d0823 in shutdown_executor () at /build/buildd/php5-5.5.8+dfsg/Zend/zend_execute_API.c:322
        __orig_bailout = 0x7fff828be0a0
        __bailout = {{__jmpbuf = {15082400, 2539187054545762541, 140659029368616, 0, 140659029365384, 36431296, -2539461879295084307, 2539187060597225709}, __mask_was_saved = 0,
            __saved_mask = {__val = {2539187248369006829, 0, 140658992555904, 15059776, 0, 140659029601344, 140655883976704, 140659029601392, 39585248, 39473032, 15082136, 1,
                140659029368616, 0, 7204110, 15082048}}}}
#4 0x00000000006e0165 in zend_deactivate () at /build/buildd/php5-5.5.8+dfsg/Zend/zend.c:935
No locals.
#5 0x000000000067e3f7 in php_request_shutdown (dummy=<optimized out>) at /build/buildd/php5-5.5.8+dfsg/main/main.c:1808
        report_memleaks = 1 '\001'
#6 0x00000000004665c6 in main (argc=<optimized out>, argv=<optimized out>) at /build/buildd/php5-5.5.8+dfsg/sapi/fpm/fpm/fpm_main.c:1961
        primary_script = <optimized out>
        __orig_bailout = 0x0
        __bailout = {{__jmpbuf = {0, -2539461812417955603, 3, 140735383603516, 0, 4294967295, -2539461879263627027, 2539187394369976557}, __mask_was_saved = 0, __saved_mask = {
              __val = {0 <repeats 16 times>}}}}
        exit_status = 0
        c = <optimized out>
        use_extended_info = 0
        file_handle = {type = ZEND_HANDLE_MAPPED, filename = 0x7fedbb7ae3c0 "\260\350}\273\355\177", opened_path = 0x0, handle = {fd = -1149365576, fp = 0x7fedbb7e12b8,
            stream = {handle = 0x7fedbb7e12b8, isatty = 0, mmap = {len = 1806, pos = 0, map = 0x0, buf = 0x7fedbb646000 <Address 0x7fedbb646000 out of bounds>, old_handle = 0x0,
                old_closer = 0}, reader = 0x695c20 <_php_stream_read>, fsizer = 0x67c450 <php_zend_stream_fsizer>, closer = 0x67c440 <php_zend_stream_mmap_closer>}},
          free_filename = 0 '\000'}
        orig_optind = 1
        orig_optarg = 0x0
        ini_entries_len = <optimized out>
        max_requests = 100
        requests = 80
        fcgi_fd = 15081056
        request = {listen_socket = 0, fd = 6, id = 1, keep = 0, closed = 0, in_len = 0, in_pad = 1, out_hdr = 0x7fff828be4f0, out_pos = 0x7fff828be835 "",
          out_buf = "\001\006\000\001\000\033\005\000Cache-Control: max-age=0, private, no-cache, no-store, must-revalidate, no-transform\r\nX-Hide-Out-Localized: false\r\nVary: Accept-Encoding\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-H"..., reserved = '\000' <repeats 15 times>, env = 0x7fedbb7ad040}
        fpm_config = 0x7fff828c093c ""
        fpm_prefix = 0x0
        fpm_pid = 0x0
        test_conf = 0
        force_daemon = <optimized out>
        php_information = 0
        php_allow_to_run_as_root = 0
        __func__ = "main"
(gdb) quit

[Peter Wang (peterwang)]

There is a more detailed bug report here: https://bugs.php.net/bug.php?id=66799