Bug #66127 [Com]: Segmentation fault with ArrayObject unset

Edit report at https://bugs.php.net/bug.php?id=66127&edit=1 ID: 66127 Comment by: arjen at react dot com Reported by: webm4st0r at gmail dot com Summary: Segmentation fault with ArrayObject unset Status: Assigned Type: Bug Package: Reproducible crash Operating System: CentOS confirmed PHP Version: 5.5.6 Assigned To: stas Block user comment: N Private report: N New Comment: Still crashes: 5.4.13 - 5.6.0beta3 http://3v4l.org/j4GdO Previous Comments: ------------------------------------------------------------------------ [2013-11-22 04:54:20] laruence@php.net @Stas, could you please look into this? ------------------------------------------------------------------------ [2013-11-20 18:06:19] webm4st0r at gmail dot com Description: ------------ This appears to have been introduced as the result of the patch to https://bugs.php.net/bug.php?id=52861. I ran into this issue while regression testing our application on PHP 5.5.5, and was able to create a short script to reproduce the segfault. Building PHP 5.4.13 with the patch for #52861 removed results in a successful execution and proper execution of the error handler. Build was on a clean version of the 5.4.13 distribution, with no configure options provided. gdb backtrace for PHP 5.4.13: #0 _zend_mm_alloc_int (heap=0xd2b290, size=32) at /root/build/php-5.4.13/Zend/zend_alloc.c:1906 #1 0x00000000006765ad in zend_error (type=1024, format=0xa7dee1 "%s") at /root/build/php-5.4.13/Zend/zend.c:1123 #2 0x0000000000687419 in zif_trigger_error (ht=<value optimized out>, return_value=0x7ffff7fe2290, return_value_ptr=<value optimized out>, this_ptr=<value optimized out>, return_value_used=<value optimized out>) at /root/build/php-5.4.13/Zend/zend_builtin_functions.c:1504 #3 0x00000000006ee76a in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /root/build/php-5.4.13/Zend/zend_vm_execute.h:642 #4 0x00000000006dbe60 in execute (op_array=0xe9ff50) at /root/build/php-5.4.13/Zend/zend_vm_execute.h:410 #5 0x000000000067616e in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/build/php-5.4.13/Zend/zend.c:1315 #6 0x000000000061c17e in php_execute_script (primary_file=0x7fffffffe2b0) at /root/build/php-5.4.13/main/main.c:2492 #7 0x000000000071bbb3 in do_cli (argc=2, argv=0x7fffffffe6b8) at /root/build/php-5.4.13/sapi/cli/php_cli.c:988 #8 0x000000000071c2b4 in main (argc=2, argv=0x7fffffffe6b8) at /root/build/php-5.4.13/sapi/cli/php_cli.c:1364 gdb backtrace for PHP 5.5.6: #0 _zend_mm_alloc_int (heap=0xd9ed00, size=32) at /root/build/php-5.5.6/Zend/zend_alloc.c:1910 #1 0x0000000000691b9a in zend_error (type=1024, format=0xa6f4ec "%s") at /root/build/php-5.5.6/Zend/zend.c:1126 #2 0x00000000006a3c5b in zif_trigger_error (ht=<value optimized out>, return_value=0x7ffff7fe22d0, return_value_ptr=<value optimized out>, this_ptr=<value optimized out>, return_value_used=<value optimized out>) at /root/build/php-5.5.6/Zend/zend_builtin_functions.c:1521 #3 0x0000000000713da3 in zend_do_fcall_common_helper_SPEC (execute_data=<value optimized out>) at /root/build/php-5.5.6/Zend/zend_vm_execute.h:550 #4 0x0000000000705350 in execute_ex (execute_data=0x7ffff7fad310) at /root/build/php-5.5.6/Zend/zend_vm_execute.h:363 #5 0x0000000000691749 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/build/php-5.5.6/Zend/zend.c:1320 #6 0x00000000006335b9 in php_execute_script (primary_file=0x7fffffffe2b0) at /root/build/php-5.5.6/main/main.c:2489 #7 0x0000000000741ccc in do_cli (argc=2, argv=0xd9ea20) at /root/build/php-5.5.6/sapi/cli/php_cli.c:994 #8 0x0000000000742468 in main (argc=2, argv=0xd9ea20) at /root/build/php-5.5.6/sapi/cli/php_cli.c:1378 Test script: --------------- <?php function crash() { set_error_handler(function () {}); $var = 1; trigger_error('error'); $var2 = $var; $var3 = $var; trigger_error('error'); } $items = new ArrayObject(); unset($items[0]); unset($items[0][0]); crash(); echo "Worked!\n"; Expected result: ---------------- Worked! Actual result: -------------- Segmentation fault (core dumped) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66127&edit=1