Bug #67037 [NEW]: crash when assigning a function result after finally()

From: tony2001 Operating system: * PHP version: 5.5Git-2014-04-07 (Git) Package: Reproducible crash Bug Type: Bug Bug description:crash when assigning a function result after finally() Description: ------------ PHP crashes on this short script. It seems to be caused by finally(), since I'm unable to reproduce the crash if I remove it. Test script: --------------- <?php function process() { try { throw new Exception("1"); } finally { try { throw new Exception("2"); } catch (Exception $Error) { } } } $res = process(); ?> Expected result: ---------------- No crash =) Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. 0x00000000006af247 in zval_delref_p (pz=0x0) at /local/git/php-src/Zend/zend.h:409 409 return --pz->refcount__gc; (gdb) bt #0 0x00000000006af247 in zval_delref_p (pz=0x0) at /local/git/php-src/Zend/zend.h:409 #1 0x00000000006b0ba8 in zend_pzval_unlock_func (z=0x0, should_free=0x7fffffffa3b0, unref=1) at /local/git/php-src/Zend/zend_execute.c:72 #2 0x00000000006b0cb7 in _get_zval_ptr_var (var=4294967264, execute_data=0x7ffff7f8c128, should_free=0x7fffffffa3b0) at /local/git/php-src/Zend/zend_execute.c:186 #3 0x0000000000714fdf in ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (execute_data=0x7ffff7f8c128) at /local/git/php-src/Zend/zend_vm_execute.h:36930 #4 0x00000000006b532b in execute_ex (execute_data=0x7ffff7f8c128) at /local/git/php-src/Zend/zend_vm_execute.h:363 #5 0x00000000006b539c in zend_execute (op_array=0x7ffff7fc9320) at /local/git/php-src/Zend/zend_vm_execute.h:388 #6 0x0000000000679ca6 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /local/git/php-src/Zend/zend.c:1316 #7 0x00000000005f43ea in php_execute_script (primary_file=0x7fffffffd960) at /local/git/php-src/main/main.c:2506 #8 0x0000000000720af5 in do_cli (argc=2, argv=0xbe0b10) at /local/git/php-src/sapi/cli/php_cli.c:994 #9 0x0000000000721ac3 in main (argc=2, argv=0xbe0b10) at /local/git/php-src/sapi/cli/php_cli.c:1378 -- Edit bug report at https://bugs.php.net/bug.php?id=67037&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=67037&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=67037&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=67037&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=67037&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=67037&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=67037&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=67037&r=needscript Try newer version: https://bugs.php.net/fix.php?id=67037&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=67037&r=support Expected behavior: https://bugs.php.net/fix.php?id=67037&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=67037&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=67037&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=67037&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=67037&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=67037&r=dst IIS Stability: https://bugs.php.net/fix.php?id=67037&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=67037&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=67037&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=67037&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=67037&r=mysqlcfg