Edit report at https://bugs.php.net/bug.php?id=64966&edit=1
ID: 64966
Updated by: laruence@php.net
Reported by: bfrance@php.net
Summary: reflection_method_invokeArgs core dump
Status: Open
Type: Bug
Package: Scripting Engine problem
PHP Version: Irrelevant
Block user comment: N
Private report: N
New Comment:
here is a small reproduce script, if no segfault, run with valgrind:
<?php
error_reporting(E_ALL | E_STRICT);
set_error_handler(function($error) { throw new Exception(); },
E_RECOVERABLE_ERROR);
function test($func) {
$a = $func("");
return true;
}
class A {
public function b() {
test("strlen");
test("iterator_apply");
}
}
$a = new A();
$a->b();
Previous Comments:
------------------------------------------------------------------------
[2013-06-08 06:37:10] laruence@php.net
A more simple fix might be like:
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 02566f3..d471f39 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2327,6 +2327,8 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
if (!RETURN_VALUE_USED(opline)) {
zval_ptr_dtor(&EX_T(opline-
>result.u.var).var.ptr);
}
+ } else if (RETURN_VALUE_USED(opline)) {
+ EX_T(opline->result.u.var).var.ptr = NULL;
}
} else if (EX(function_state).function->type == ZEND_USER_FUNCTION) {
EX(original_return_value) = EG(return_value_ptr_ptr);
------------------------------------------------------------------------
[2013-06-07 20:04:43] bfrance@php.net
I just added a patch that make 5.3.24+ not core dump, but I want somebody to review it.
http://git.php.net/?p=php-src.git;a=blob;f=Zend/zend_vm_execute.h;h=f6220b0f5305924afd7f480f321cae8075b46ab2;hb=refs/heads/PHP-5.3#l303
The issue is allocate for EX_T(opline->result.u.var).var.ptr was moved to line 316 and inside
the:
if (EXPECTED(EG(exception) == NULL)) {
}
block. The problem with this is that on line 417, it calls:
zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr);
but without allocating it.
May be the other option would be to add a else option at line 330 to either null the value or set:
RETURN_VALUE_USED(opline)
to false instead of true (no idea how to do that), which it currently is.
Thoughts?
------------------------------------------------------------------------
[2013-06-07 19:53:45] bfrance@php.net
The following patch has been added/updated:
Patch Name: exception.diff
Revision: 1370634825
URL: https://bugs.php.net/patch-display.php?bug=64966&patch=exception.diff&revision=1370634825
------------------------------------------------------------------------
[2013-06-07 17:29:56] bfrance@php.net
Here is the patch that was applied to 5.3.23:
http://www.brianfrance.com/php/5.3.24.txt
If I keep this line:
ALLOC_INIT_ZVAL(EX_T(opline->result.u.var).var.ptr);
then the core dump goes away and a get the same test failure, like in 5.4.14+. And that can be
explain by the:
if (EXPECTED(EG(exception) == NULL)) {
}
from the comment above.
I can't explain why yet, but working on seeing if I can found who uses that value or who might
expect it to be allocated.
------------------------------------------------------------------------
[2013-06-07 17:14:49] bfrance@php.net
5.3.24 is blank as it core dumps and 5.4.14 is blank because it fails. 5.3.23:
<?xml version="1.0" encoding="UTF-8"?>
<testsuites>
<testsuite name="YPHPINTLTest"
file="/home/bfrance/php-5.3.23/ext/intl/tests/phpIntlTest02.php" tests="1"
assertions="116" failures="0" errors="0" time="0.010190">
<testcase name="test_collator_sort" class="YPHPINTLTest"
file="/home/bfrance/php-5.3.23/ext/intl/tests/phpIntlTest02.php" line="7"
assertions="116" time="0.010190"/>
</testsuite>
</testsuites>
and 5.4.13:
<?xml version="1.0" encoding="UTF-8"?>
<testsuites>
<testsuite name="YPHPINTLTest"
file="/home/bfrance/php-5.4.13/ext/intl/tests/phpIntlTest03.php" tests="1"
assertions="2" failures="0" errors="0" time="22.547478">
<testcase name="test_collator_sort" class="YPHPINTLTest"
file="/home/bfrance/php-5.4.13/ext/intl/tests/phpIntlTest03.php" line="7"
assertions="2" time="22.547478"/>
</testsuite>
</testsuites>
I created a phpIntlTest03.php from phpIntlTest02.php that is only line 1-33, then "} }
?>"
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=64966--
Edit this bug report at https://bugs.php.net/bug.php?id=64966&edit=1