#44214 [Ver->Csd]: Crash using preg_replace_callback and global variable

From: Date: Sat, 08 Mar 2008 13:12:29 +0000
Subject: #44214 [Ver->Csd]: Crash using preg_replace_callback and global variable
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-123058@lists.php.net to get a copy of this message 
 ID:               44214
 Updated by:       nlopess@php.net
 Reported By:      php at bouchery dot fr
-Status:           Verified
+Status:           Closed
 Bug Type:         Reproducible crash
 Operating System: Windows XP
 PHP Version:      5.3.0-dev
 New Comment:

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.




Previous Comments:
------------------------------------------------------------------------

[2008-03-03 22:31:39] nlopess@php.net

uhm, nice.. on windows I get the following stack trace:

zend_hash_destroy(_hashtable * ht=0x01f10318)  Line 525 + 0x5 bytes
_zval_dtor_func(_zval_struct * zvalue=0x01f0e9b8)  Line 44
_zval_ptr_dtor(_zval_struct * * zval_ptr=0x01f0eac4)  Line 422 + 0xe
bytes
zend_hash_destroy(_hashtable * ht=0x01f0e438)  Line 526 + 0x6 bytes
_zval_dtor_func(_zval_struct * zvalue=0x01f101a8)  Line 44
_zval_ptr_dtor(_zval_struct * * zval_ptr=0x01f10224)  Line 422 + 0xe
bytes
zend_hash_apply_deleter(_hashtable * ht=0x01e1e888, bucket *
p=0x01f10218)  Line 611 + 0x6 bytes
zend_hash_graceful_reverse_destroy(_hashtable * ht=0x01e1e888)  Line
647
shutdown_executor(void * * * tsrm_ls=0x002d2640)  Line 246 + 0x17
bytes
zend_deactivate(void * * * tsrm_ls=0x002d2640)  Line 882
php_request_shutdown(void * dummy=0x00000000)  Line 1497

I don't have time to look at this today, though. The problem is related
with the global variable referencing and/or some reference counting bug.

------------------------------------------------------------------------

[2008-03-03 15:27:40] php at bouchery dot fr

Same problem with nightly built "PHP 5.3.0-dev (cli) (built: Mar  3
2008 08:18:24)"

------------------------------------------------------------------------

[2008-02-22 15:01:39] php at bouchery dot fr

Description:
------------
When assigning callback parameter of preg_replace_callback into a
global variable, PHP CLI interpreter crash at the end of the script.
I generate this error with PHP v5.2.3.3, and I try the last 5.2.5.5,
but the result is the same.

Reproduce code:
---------------
<?php
$string = 'aaa bbb ccc ddd eee ccc aaa bbb';

$array = array();

function myCallBack( $match ) {
    global $array;
    $array[] = $match;
    return 'xxx';
}

echo preg_replace_callback( 'a+', 'myCallBack', $string);
?>

Expected result:
----------------
No crash at the end of the script.

Actual result:
--------------
Windows crash report with signature error.
---
AppName: php.exe  AppVer: 5.2.5.5  ModName: php5ts.dll
ModVer: 5.2.5.5  Offset: 0009a10a
--


------------------------------------------------------------------------


-- 
Edit this bug report at http://bugs.php.net/?id=44214&edit=1

Thread (4 messages)

« previous php.bugs (#123058) next »