Bug #63913 [NEW]: Segfault on preg_replace with some weird conditions

From: seld Operating system: Windows 7 x64 PHP version: 5.5.0alpha2 Package: *Regular Expressions Bug Type: Bug Bug description:Segfault on preg_replace with some weird conditions Description: ------------ The composer test suite segfaults on 5.5 as you can see on https://travis-ci.org/composer/composer/jobs/3971664 I tried investigating on my machine and could not get to the bottom of it, so here are my findings, I hope someone else can reproduce and will have more of a clue than I do. The weirdest thing is that *sometimes* depending on the code changes I make to runme.php (see https://gist.github.com/7f465d4109d667a73984) it actually runs through fine, but most of the time it crashes. Then a bit later if I try and do a similar change it crashes again, either it's an intermittent system issue or something's very wrong. Since it also segfaults on travis I would assume the latter. Note that tweaking the input to the preg_replace call (by removing bits and pieces of testcase.php) also tends to make it work sometimes. For example removing the "}" at line 15 makes it work for me. Test script: --------------- Run these commands: git clone https://gist.github.com/7f465d4109d667a73984.git reproduce cd reproduce/ php runme.php Expected result: ---------------- With 5.4.8 VC9 TS I get the following: $ php runme.php string(8) "content:" string(103) "<?php\n namespace Foo; class StripNoise { public function test() { return <<<A\nclass Fail23\n{\n}\nA\n; } } " string(4) "test" string(2) "aa" string(8) "starting" string(4) "done" bool(true) Actual result: -------------- With 5.5.0-alpha2 V9 TS I get this: $ php runme.php string(8) "content:" string(103) "<?php namespace Foo; class StripNoise { public function test() { return <<<A class Fail23 { } A ; } } " string(4) "test" --- then the process crashes and I get a crash window with the following details --- Problem signature: Problem Event Name: APPCRASH Application Name: php.exe Application Version: 5.5.0.0 Application Timestamp: 50d1254a Fault Module Name: php5ts.dll Fault Module Version: 5.5.0.0 Fault Module Timestamp: 50d13446 Exception Code: c0000005 Exception Offset: 0004762d OS Version: 6.1.7601.2.1.0.256.1 Locale ID: 4108 Additional Information 1: 0a9e Additional Information 2: 0a9e372d3b4ad19135b953a78882e789 Additional Information 3: 0a9e Additional Information 4: 0a9e372d3b4ad19135b953a78882e789 -- Edit bug report at https://bugs.php.net/bug.php?id=63913&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=63913&r=trysnapshot54 Try a snapshot (PHP 5.3): https://bugs.php.net/fix.php?id=63913&r=trysnapshot53 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=63913&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=63913&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=63913&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=63913&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=63913&r=needscript Try newer version: https://bugs.php.net/fix.php?id=63913&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=63913&r=support Expected behavior: https://bugs.php.net/fix.php?id=63913&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=63913&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=63913&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=63913&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=63913&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=63913&r=dst IIS Stability: https://bugs.php.net/fix.php?id=63913&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=63913&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=63913&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=63913&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=63913&r=mysqlcfg