Bug #66609 [NEW]: php crashes with __get() and ++ operator in some cases
From: drewparoski at gmail dot com
Operating system: CentOS Linux 6.3
PHP version: 5.6.0alpha1
Package: Reproducible crash
Bug Type: Bug
Bug description:php crashes with __get() and ++ operator in some cases
Description:
------------
When I run the test script under PHP 5.6.0alpha1 (downloaded and built
today from http://downloads.php.net/tyrael/php-5.6.0alpha1.tar.gz),
it
causes the php process to crash. I can consistently reproduce this
problem on my machine. I've also been able to reproduce it with various
builds of PHP 5.5.0.
I've included the backtrace from the crash.
Test script:
---------------
<?php
$bar = new Bar;
$foo = new Foo;
class Bar {
public function __get($x) {
global $foo;
$foo->asd++;
}
}
class Foo {
public function __get($x) {
global $bar;
$bar->lol++;
}
}
$foo->blah++;
echo "Done\n";
Expected result:
----------------
Done
Actual result:
--------------
... the php process crashes, below is the stacktrace from the coredump
...
Core was generated by `/opt/bin/php segv.php'.
Program terminated with signal 11, Segmentation fault.
#0 0x00000000007462ef in zend_post_incdec_property_helper_SPEC_CV_CONST
(
incdec_op=0x6b7db0 <increment_function>,
execute_data=0x7f0734740238)
at
/data/users/andrewparoski/php-5.6.0alpha1/Zend/zend_vm_execute.h:32154
32154 Z_OBJ_HT_P(object)->write_property(object, property, z_copy,
((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
(gdb) bt
#0 0x00000000007462ef in zend_post_incdec_property_helper_SPEC_CV_CONST
(
incdec_op=0x6b7db0 <increment_function>,
execute_data=0x7f0734740238)
at
/data/users/andrewparoski/php-5.6.0alpha1/Zend/zend_vm_execute.h:32154
#1 0x0000000000727f20 in execute_ex (execute_data=0x7f0734740238)
at
/data/users/andrewparoski/php-5.6.0alpha1/Zend/zend_vm_execute.h:363
#2 0x00000000006bb6e9 in zend_execute_scripts (type=8, retval=0x0,
file_count=3) at
/data/users/andrewparoski/php-5.6.0alpha1/Zend/zend.c:1330
#3 0x000000000065bec9 in php_execute_script
(primary_file=0x7fffa7647360)
at /data/users/andrewparoski/php-5.6.0alpha1/main/main.c:2542
#4 0x000000000075e7fc in do_cli (argc=2, argv=0xdd2000)
at /data/users/andrewparoski/php-5.6.0alpha1/sapi/cli/php_cli.c:994
#5 0x000000000075ef98 in main (argc=2, argv=0xdd2000)
at
/data/users/andrewparoski/php-5.6.0alpha1/sapi/cli/php_cli.c:1378
--
Edit bug report at https://bugs.php.net/bug.php?id=66609&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=66609&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=66609&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=66609&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=66609&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=66609&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=66609&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=66609&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=66609&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=66609&r=support
Expected behavior: https://bugs.php.net/fix.php?id=66609&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=66609&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=66609&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=66609&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=66609&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=66609&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=66609&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=66609&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=66609&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=66609&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=66609&r=mysqlcfg
Thread (8 messages)
- drewparoski at gmail dot com