php - 使用 valgrind 调试 PHP cli 段错误

Question

我有一个在 cli 中运行的第三方 PHP 脚本，它抛出一个 segmentation fault，我是现在尝试调试。

刚刚了解了 valgrind 工具，但我能找到的大多数指南似乎都是针对在 Apache 中运行的 PHP，而不是cli.

如何使用 valgrind 调试我的 cli 脚本并找出导致此段错误的原因？

编辑:

使用@sudowned 的帮助，它给了我以下信息，但不确定它告诉我什么:

==32363== Invalid read of size 8
==32363==    at 0x6A459A: _zend_mm_alloc_canary_int (in /usr/bin/php5)
==32363==    by 0x6A4CFD: _zend_mm_realloc_canary_int (in /usr/bin/php5)
==32363==    by 0x690CC3: zend_hash_do_resize (in /usr/bin/php5)
==32363==    by 0x6925C7: _zend_hash_add_or_update (in /usr/bin/php5)
==32363==    by 0x68EA1F: add_assoc_zval_ex (in /usr/bin/php5)
==32363==    by 0x69729D: zif_get_defined_constants (in /usr/bin/php5)
==32363==    by 0xE393B63: ??? (in /usr/lib/php5/20090626/suhosin.so)
==32363==    by 0x6D4B15: zend_do_fcall_common_helper_SPEC (in /usr/bin/php5)
==32363==    by 0x6ABD8F: execute (in /usr/bin/php5)
==32363==    by 0xE394115: ??? (in /usr/lib/php5/20090626/suhosin.so)
==32363==    by 0x6D4805: zend_do_fcall_common_helper_SPEC (in /usr/bin/php5)
==32363==    by 0x6ABD8F: execute (in /usr/bin/php5)
==32363==  Address 0x1c486147 is not stack'd, malloc'd or (recently) free'd
==32363== 
==32363== 
==32363== Process terminating with default action of signal 11 (SIGSEGV)
==32363==  Access not within mapped region at address 0x1C486147
==32363==    at 0x6A459A: _zend_mm_alloc_canary_int (in /usr/bin/php5)
==32363==    by 0x6A4CFD: _zend_mm_realloc_canary_int (in /usr/bin/php5)
==32363==    by 0x690CC3: zend_hash_do_resize (in /usr/bin/php5)
==32363==    by 0x6925C7: _zend_hash_add_or_update (in /usr/bin/php5)
==32363==    by 0x68EA1F: add_assoc_zval_ex (in /usr/bin/php5)
==32363==    by 0x69729D: zif_get_defined_constants (in /usr/bin/php5)
==32363==    by 0xE393B63: ??? (in /usr/lib/php5/20090626/suhosin.so)
==32363==    by 0x6D4B15: zend_do_fcall_common_helper_SPEC (in /usr/bin/php5)
==32363==    by 0x6ABD8F: execute (in /usr/bin/php5)
==32363==    by 0xE394115: ??? (in /usr/lib/php5/20090626/suhosin.so)
==32363==    by 0x6D4805: zend_do_fcall_common_helper_SPEC (in /usr/bin/php5)
==32363==    by 0x6ABD8F: execute (in /usr/bin/php5)
==32363==  If you believe this happened as a result of a stack
==32363==  overflow in your program's main thread (unlikely but
==32363==  possible), you can try to increase the size of the
==32363==  main thread stack using the --main-stacksize= flag.
==32363==  The main thread stack size used in this run was 8388608.
==32363== 
==32363== HEAP SUMMARY:
==32363==     in use at exit: 180,903,362 bytes in 27,691 blocks
==32363==   total heap usage: 11,144,829 allocs, 11,117,138 frees, 2,198,841,176 bytes allocated
==32363== 
==32363== LEAK SUMMARY:
==32363==    definitely lost: 0 bytes in 0 blocks
==32363==    indirectly lost: 0 bytes in 0 blocks
==32363==      possibly lost: 0 bytes in 0 blocks
==32363==    still reachable: 180,903,362 bytes in 27,691 blocks
==32363==         suppressed: 0 bytes in 0 blocks
==32363== Reachable blocks (those to which a pointer was found) are not shown.
==32363== To see them, rerun with: --leak-check=full --show-reachable=yes
==32363== 
==32363== For counts of detected and suppressed errors, rerun with: -v
==32363== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 37 from 10)

Answer 1

您可以，如 Valgrind quick-start guide 中所述，按如下方式链接您的 PHP CLI 命令:

valgrind --leak-check=yes php -f filename.php args

为了从输出中收集有用的信息，您可能需要使用 debug symbols. 重新编译 PHP。 :

./configure --enable-debug

编辑:针对您的评论，请记住，当您使用 Valgrind 时，您不是调试您的 PHP 脚本:您正在调试 PHP 解释器，这是底层的 C 可执行文件。

这不是轻松愉快的任务。

如果不深入了解 C(并调试它)，您将很难从堆栈跟踪中收集有关情况的有用信息。

Valgrind 已准确告诉您解释器中的哪个函数导致了段错误。下一步是隔离发生段错误时传递给函数的变量。从那里深入了解 PHP 代码如何映射到底层 C 将是必要的，然后您甚至可以确定是什么 PHP 指令导致了它。

简单的答案是开始注释掉 PHP 行，直到您的段错误不再发生，然后再处理有罪的行，直到您确定什么不该做。技术含量低？当然。有效，同样肯定。你也可以使用 xdebug，discussed here ，这可以提供有关解释代码的更有针对性的信息。