Bug #64966 [Opn]: reflection_method_invokeArgs core dump

Edit report at https://bugs.php.net/bug.php?id=64966&edit=1 ID: 64966 User updated by: bfrance@php.net Reported by: bfrance@php.net Summary: reflection_method_invokeArgs core dump Status: Open Type: Bug Package: Scripting Engine problem PHP Version: Irrelevant Block user comment: N Private report: N New Comment: I just added a patch that make 5.3.24+ not core dump, but I want somebody to review it. http://git.php.net/?p=php-src.git;a=blob;f=Zend/zend_vm_execute.h;h=f6220b0f5305924afd7f480f321cae8075b46ab2;hb=refs/heads/PHP-5.3#l303 The issue is allocate for EX_T(opline->result.u.var).var.ptr was moved to line 316 and inside the: if (EXPECTED(EG(exception) == NULL)) { } block. The problem with this is that on line 417, it calls: zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr); but without allocating it. May be the other option would be to add a else option at line 330 to either null the value or set: RETURN_VALUE_USED(opline) to false instead of true (no idea how to do that), which it currently is. Thoughts? Previous Comments: ------------------------------------------------------------------------ [2013-06-07 19:53:45] bfrance@php.net The following patch has been added/updated: Patch Name: exception.diff Revision: 1370634825 URL: https://bugs.php.net/patch-display.php?bug=64966&patch=exception.diff&revision=1370634825 ------------------------------------------------------------------------ [2013-06-07 17:29:56] bfrance@php.net Here is the patch that was applied to 5.3.23: http://www.brianfrance.com/php/5.3.24.txt If I keep this line: ALLOC_INIT_ZVAL(EX_T(opline->result.u.var).var.ptr); then the core dump goes away and a get the same test failure, like in 5.4.14+. And that can be explain by the: if (EXPECTED(EG(exception) == NULL)) { } from the comment above. I can't explain why yet, but working on seeing if I can found who uses that value or who might expect it to be allocated. ------------------------------------------------------------------------ [2013-06-07 17:14:49] bfrance@php.net 5.3.24 is blank as it core dumps and 5.4.14 is blank because it fails. 5.3.23: <?xml version="1.0" encoding="UTF-8"?> <testsuites> <testsuite name="YPHPINTLTest" file="/home/bfrance/php-5.3.23/ext/intl/tests/phpIntlTest02.php" tests="1" assertions="116" failures="0" errors="0" time="0.010190"> <testcase name="test_collator_sort" class="YPHPINTLTest" file="/home/bfrance/php-5.3.23/ext/intl/tests/phpIntlTest02.php" line="7" assertions="116" time="0.010190"/> </testsuite> </testsuites> and 5.4.13: <?xml version="1.0" encoding="UTF-8"?> <testsuites> <testsuite name="YPHPINTLTest" file="/home/bfrance/php-5.4.13/ext/intl/tests/phpIntlTest03.php" tests="1" assertions="2" failures="0" errors="0" time="22.547478"> <testcase name="test_collator_sort" class="YPHPINTLTest" file="/home/bfrance/php-5.4.13/ext/intl/tests/phpIntlTest03.php" line="7" assertions="2" time="22.547478"/> </testsuite> </testsuites> I created a phpIntlTest03.php from phpIntlTest02.php that is only line 1-33, then "} } ?>" ------------------------------------------------------------------------ [2013-06-07 17:06:38] laruence@php.net where can I get the "results.xml"? ------------------------------------------------------------------------ [2013-06-07 16:40:04] bfrance@php.net Sorry, this is for work and I am pretty sure the wouldn't let me give you access to a internal machine. See if this helps: sudo pear config-set auto_discover 1 sudo pear channel-discover pear.phpunit.de sudo pear install pear.phpunit.de/PHPUnit That worked for me for two clean installs this morning (5.4.13 and 5.4.14). So I think have figured out what is happening, at least with 5.4 and why it changed. Code in question is this: http://git.php.net/?p=php-src.git;a=blob;f=Zend/zend_vm_execute.h;h=bb50b4803f7143acff1c15647f5f45807d7ced16;hb=HEAD#l525 I can't figure out how to get git to let me show 5.3.13 and 5.2.14 diff, so here is a clean diff: http://www.brianfrance.com/php/5.4.14.txt The issue in 5.4.14 is that zend_verify_arg_type is throwing an exception, this means that the real function will never be called as it is now wrapped in a: if (EXPECTED(EG(exception) == NULL)) { } In 5.4.13 there wasn't an exception check, so it would call the function regardless of the zend_verify_arg_type checks (would still have a warning printed). If this is now the normal flow, I can go back to the intl our team and tell them they need to fix there test cases (in 5.4). Granted this doesn't fix 5.3 core dump, which is what I am digging into again today. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=64966 -- Edit this bug report at https://bugs.php.net/bug.php?id=64966&edit=1