Debugging PHP Memory Corruption with Valgrind

Question

Hi.

I'm encountering what seems to be a memory corruption issue with PHP. I have a large code base that I am porting to the 5.3 runtime. I get segfaults and "zend_mm_heap corrupted" errors, but the backtraces from those points are not useful. The backtraces always lead back to various core PHP functions such as variable assignment or concatenation.

To the best of my knowledge, PHP's memory is getting corrupted at some point before the segfaults/heap corruption errors occur.

I've followed the instructions at bugs.php.net/bugs-getting-valgrind-log.php and have generated a quite large valgrind log. It's filled with many errors like "Conditional jump or move depends on uninitialised value". Because there's so much information in that valgrind log, I'm not sure what is a true defect and what is normal behavior.

Here's a portion of the valgrind output: http://pastie.org/private/exngtften3jeppqyjn4hw

Answer 1

All of the errors that you posted are uses of uninitialized values. Use the valgrind option --track-origins=yes (added in valgrind 3.4.0) to show the origin of the value that ends up being used uninitialized. It will run slower and use more memory, but can show much more helpful information for uses of uninitialized values.