Bug #54609 [NEW]: Certain implementation(s) of SplFixedArray cause hard crash

From: Operating system: *nix PHP version: 5.3.6 Package: SPL related Bug Type: Bug Bug description:Certain implementation(s) of SplFixedArray cause hard crash Description: ------------ Problem can be reproduced on both Linux and Unix environments, does not seem to be OS specific. Backtrace and other tests point specifically at SplFixedArray. PHP/OS: PHP 5.3.6 8.2-RELEASE FreeBSD Extensions: extension=ctype.so extension=curl.so extension=dom.so extension=filter.so extension=gd.so extension=hash.so extension=json.so extension=mbstring.so extension=mcrypt.so extension=session.so extension=simplexml.so extension=ftp.so extension=mysqli.so extension=igbinary.so extension=apc.so extension=memcached.so Test script: --------------- <?php /** * Proof of concept * @author Aleksey Korzun */ ini_set('memory_limit', '1024M'); ini_set('display_errors', 'On'); error_reporting(E_ALL); // Hard limit for our test loop $limit = 10000; /** * Placeholder model */ class Model { public function foo() {} } /** * Placeholder collection, using SplFixedArray */ class Collection extends \SplFixedArray { // Population method public function bar() { $models = array(); foreach($this as $id => $model) { $model->foo(); $models[$id] = $model; } } } // Initialize and run the test $collection = new Collection; $collection->setSize($limit); while($limit > 0) { --$limit; $collection[$limit] = new Model; } $collection->bar(); Expected result: ---------------- Script should not crash Actual result: -------------- (gdb) bt full #0 0x00000008026f5567 in _zend_is_inconsistent (ht=0xffffffff, file=0x80285a5b8 "/usr/ports/lang/php5/work/php-5.3.6/Zend/zend_hash.c", line=520) at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_hash.c:53 No locals. #1 0x00000008026f7381 in zend_hash_destroy (ht=0xffffffff) at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_hash.c:520 p = (Bucket *) 0x802858ff0 q = (Bucket *) 0x480 #2 0x0000000802710a66 in zend_object_std_dtor (object=0x808581920) at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_objects.c:41 No locals. #3 0x0000000802710f15 in zend_objects_free_object_storage (object=0x808581920) at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_objects.c:126 No locals. #4 0x0000000802716abf in zend_objects_store_del_ref_by_handle_ex (handle=3697, handlers=0x8029f0c20) at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_objects_API.c:220 __orig_bailout = (sigjmp_buf *) 0x7fffffffe1b0 __bailout = {{_sjb = {34400725674, 34376863547, 140737488347016, 140737488347184, 140737488350136, 140737488350104, 0, 0, 34499527295, 34498252960, 34499605672, 34359738368}}} obj = (struct _store_object *) 0x8094bdca8 failure = 0 #5 0x00000008027167ae in zend_objects_store_del_ref (zobject=0x8085a8130) at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_objects_API.c:172 handle = 3697 #6 0x00000008026e35b3 in _zval_dtor_func (zvalue=0x8085a8130, __zend_filename=0x802857e68 "/usr/ports/lang/php5/work/php-5.3.6/Zend/zend_execute_API.c", __zend_lineno=443) at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_variables.c:52 No locals. #7 0x00000008026d223f in _zval_dtor (zvalue=0x8085a8130, __zend_filename=0x802857e68 "/usr/ports/lang/php5/work/php-5.3.6/Zend/zend_execute_API.c", __zend_lineno=443) at zend_variables.h:35 No locals. #8 0x00000008026d2628 in _zval_ptr_dtor (zval_ptr=0x80821ad58, __zend_filename=0x80282b9d8 "/usr/ports/lang/php5/work/php-5.3.6/ext/spl/spl_fixedarray.c", __zend_lineno=182) at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_execute_API.c:443 No locals. #9 0x000000080256f408 in spl_fixedarray_object_free_storage (object=0x808214990) at /usr/ports/lang/php5/work/php-5.3.6/ext/spl/spl_fixedarray.c:182 intern = (spl_fixedarray_object *) 0x808214990 i = 897 #10 0x00000008027164bd in zend_objects_store_free_object_storage (objects=0x8029f75b8) at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_objects_API.c:92 obj = (struct _store_object *) 0x809484668 i = 24 #11 0x00000008026d1f7a in shutdown_executor () at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend_execute_API.c:302 __orig_bailout = (sigjmp_buf *) 0x0 __bailout = {{_sjb = {34400444143, 34376863547, 140737488347560, 140737488347712, 140737488350136, 140737488350104, 0, 0, 34402009727, 34384020168, 140737488347696, 34359738368}}} #12 0x00000008026e56de in zend_deactivate () at /usr/ports/lang/php5/work/php-5.3.6/Zend/zend.c:890 No locals. #13 0x00000008026656a1 in php_request_shutdown (dummy=0x0) at /usr/ports/lang/php5/work/php-5.3.6/main/main.c:1635 report_memleaks = 1 '\001' #14 0x00000008027d98b6 in php_apache_request_dtor (r=0x8035778a8) at /usr/ports/lang/php5/work/php-5.3.6/sapi/apache2handler/sapi_apache2.c:509 No locals. -- Edit bug report at http://bugs.php.net/bug.php?id=54609&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=54609&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=54609&r=trysnapshot53 Try a snapshot (trunk): http://bugs.php.net/fix.php?id=54609&r=trysnapshottrunk Fixed in SVN: http://bugs.php.net/fix.php?id=54609&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=54609&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=54609&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=54609&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=54609&r=needscript Try newer version: http://bugs.php.net/fix.php?id=54609&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=54609&r=support Expected behavior: http://bugs.php.net/fix.php?id=54609&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=54609&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=54609&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=54609&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=54609&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=54609&r=dst IIS Stability: http://bugs.php.net/fix.php?id=54609&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=54609&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=54609&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=54609&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=54609&r=mysqlcfg