小记调试PHP-X一个吐血的core dump过程

2017-12-05

在使用PHP-X开发PHP拓展的过程中，发现一个非常奇怪的bug

在频繁地调用zend_wrong_paramers_count_error这个Zend API方法后，会导致发生core dump。这个方法的作用是抛出一个入参参数数量不正确的Warning级别异常

先看看我们的源码：

ZEND_RESULT_CODE _check_args_num(zend_execute_data *data, int num_args)
{
    uint32_t min_num_args = data->func->common.required_num_args;
    uint32_t max_num_args = data->func->common.num_args;
    if (num_args < min_num_args || (num_args > max_num_args && max_num_args > 0)) 
    {
        #if PHP_MAJOR_VERSION >= 7 && PHP_MINOR_VERSION == 0
        zend_wrong_paramers_count_error(num_args, min_num_args, max_num_args);
        #else
        zend_wrong_parameters_count_error(num_args, min_num_args, max_num_args);  //出错所在
        #endif
        return FAILURE;
	}
    return SUCCESS;
}

使用gdb对core进行分析

$ gdb php -c /corefile/core.11
[New LWP 2852]
Core was generated by `php ../tests/main.php'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000000000085c681 in incomplete_class_message (object=0x7effd7a6b140, error_type=32511) at /usr/local/php-7.2.0/ext/standard/incomplete_class.c:47
47			php_error_docref(NULL, error_type, INCOMPLETE_CLASS_MSG, "unknown")
$ (gdb) bt
#0  0x000000000085c681 in zend_mm_alloc_small (bin_num=8, size=79, heap=0x7f1cf8800040) at /usr/local/php-7.0.26/Zend/zend_alloc.c:1318
#1  zend_mm_alloc_heap (size=79, heap=0x7f1cf8800040) at /usr/local/php-7.0.26/Zend/zend_alloc.c:1389
#2  zend_mm_realloc_heap (heap=0x7f1cf8800040, ptr=0x0, size=79, copy_size=79) at /usr/local/php-7.0.26/Zend/zend_alloc.c:1485
#3  0x000000000086409e in _erealloc (ptr=0x0, size=79) at /usr/local/php-7.0.26/Zend/zend_alloc.c:2506
#4  0x00000000007f999c in xbuf_format_converter (xbuf=0x7ffeddbfe950, is_char=1 '\001', fmt=0xe356e5 "PHP %s:  %s in %s on line %d", ap=0x7ffeddbfe9a8) at /usr/local/php-7.0.26/main/spprintf.c:246
#5  0x00000000007fc799 in vspprintf (pbuf=0x7ffeddbfeb40, max_len=0, format=0xe356e5 "PHP %s:  %s in %s on line %d", ap=0x7ffeddbfe9a8) at /usr/local/php-7.0.26/main/spprintf.c:847
#6  0x00000000007fc8af in spprintf (pbuf=0x7ffeddbfeb40, max_len=0, format=0xe356e5 "PHP %s:  %s in %s on line %d") at /usr/local/php-7.0.26/main/spprintf.c:871
#7  0x00000000007f2fd3 in php_error_cb (type=2, error_filename=0x7f1cf886a068 "/share/docker/c/www/PHP-X-demo/args/tests/main.php", error_lineno=10, format=0xe4b424 "%s", args=0x7ffeddbfed40) at /usr/local/php-7.0.26/main/main.c:1122
#8  0x00000000008a398d in zend_error (type=2, format=0xe4b424 "%s") at /usr/local/php-7.0.26/Zend/zend.c:1172
#9  0x00000000008a468b in zend_internal_type_error (throw_exception=0 '\000', format=0xe4b520 "%s%s%s() expects %s %d parameter%s, %d given") at /usr/local/php-7.0.26/Zend/zend.c:1366
#10 0x00000000008a5476 in zend_wrong_paramers_count_error (num_args=2, min_num_args=1, max_num_args=1) at /usr/local/php-7.0.26/Zend/zend_API.c:205
#11 0x00007f1cf83ba69f in php::_check_args_num (data=0x7f1cf8813170, num_args=2) at /share/docker/c/www/PHP-X/src/base.cc:216
#12 0x00007f1cf83ba54e in php::_exec_method (data=0x7f1cf8813170, return_value=0x7f1cf8813110) at /share/docker/c/www/PHP-X/src/base.cc:194
#13 0x0000000000938799 in ZEND_DO_FCALL_SPEC_HANDLER () at /usr/local/php-7.0.26/Zend/zend_vm_execute.h:842
#14 0x0000000000934566 in execute_ex (ex=0x7f1cf8813030) at /usr/local/php-7.0.26/Zend/zend_vm_execute.h:414
#15 0x0000000000934efa in zend_execute (op_array=0x7f1cf887f000, return_value=0x0) at /usr/local/php-7.0.26/Zend/zend_vm_execute.h:458
#16 0x00000000008a4a6d in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/php-7.0.26/Zend/zend.c:1445
#17 0x00000000007f619f in php_execute_script (primary_file=0x7ffeddc01ac0) at /usr/local/php-7.0.26/main/main.c:2518
#18 0x0000000000a103f7 in do_cli (argc=2, argv=0x2144a20) at /usr/local/php-7.0.26/sapi/cli/php_cli.c:977
#19 0x0000000000a117bd in main (argc=2, argv=0x2144a20) at /usr/local/php-7.0.26/sapi/cli/php_cli.c:1347

看到这个backtrace后一头雾水，貌似是跟php的内存管理扯上边了？但其实不然

经过长时间的debug发现，原来是我的拓展某行代码写错了，导致发生了这种问题。

直接上我们的代码：

void printArgs(Args args){
    cout << "Args: ";
    for (unsigned int i = 0; i <args.count(); i++)
    {
        if (args[i].type() == IS_ARRAY)
        {
            Array arr(args[i]);
            cout << '[';
            for (auto it = arr.begin(); it != arr.end(); it++)
            {
                cout << it.value().toString();
            }
            cout << ']' << ' ';
        }
        else
        {
            cout << args[i].toString() << ' ';
        }
    }
    cout << endl;
}
PHPX_METHOD(ArgsTest,noneArgs){
    printArgs(args);
    cout << "noneArgs() called" << endl;
}

我们来看看PHPX_METHOD这个宏的定义

1	#define PHPX_METHOD(c, m) void c##_##m(Object &_this, Args &args, Variant &retval)

注意上面的代码中printArgs(args);这一行代码传入了args参数，而从PHPX_METHOD定义我们可以看到，args是一个引用参数，但是在printArgs()函数定义时，没有把args作为引用参数而导致了错误。初步猜测是因为传参过程中，一些对象复制的问题导致了错误

正确写法应该是把void printArgs(Args args)改为void printArgs(Args &args)

问题最终顺利解决~