Bug #69700 [Asn->Csd]: tests/lang/this_assignment.phpt memory errors

Edit report at https://bugs.php.net/bug.php?id=69700&edit=1 ID: 69700 Updated by: dmitry@php.net Reported by: nikic@php.net Summary: tests/lang/this_assignment.phpt memory errors -Status: Assigned +Status: Closed Type: Bug Package: Scripting Engine problem PHP Version: 5.6Git-2015-05-24 (Git) Assigned To: dmitry Block user comment: N Private report: N New Comment: Automatic comment on behalf of dmitry@zend.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=c436e25fd5519bb26fea2385d858823be7e3fca2 Log: Fixed bug #69700 (tests/lang/this_assignment.phpt memory errors) Previous Comments: ------------------------------------------------------------------------ [2015-05-24 20:11:55] nikic@php.net Assigning to Dmitry as this is likely related to the recent $this refcounting changes. ------------------------------------------------------------------------ [2015-05-24 20:11:20] nikic@php.net Description: ------------ From gcov: ==5934== Invalid read of size 8 ==5934== at 0x10B3C11: ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER (zend_vm_execute.h:23938) ==5934== by 0x100E4E5: execute_ex (zend_vm_execute.h:394) ==5934== by 0x100EFFE: zend_execute (zend_vm_execute.h:434) ==5934== by 0xF46C5B: zend_execute_scripts (zend.c:1389) ==5934== by 0xE48EBB: php_execute_script (main.c:2479) ==5934== by 0x114D47A: do_cli (php_cli.c:967) ==5934== by 0x114EEE9: main (php_cli.c:1334) ==5934== Address 0x11d52e70 is 16 bytes inside a block of size 40 free'd ==5934== at 0x4C27C24: free (vg_replace_malloc.c:473) ==5934== by 0xEECE24: _efree (zend_alloc.c:2222) ==5934== by 0xFF31A2: zend_objects_store_del (zend_objects_API.c:205) ==5934== by 0xF40F2D: _zval_dtor_func_for_ptr (zend_variables.c:116) ==5934== by 0x10F25B2: zend_assign_to_variable (zend_execute.h:104) ==5934== by 0x10F25B2: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:33656) ==5934== by 0x100E4E5: execute_ex (zend_vm_execute.h:394) ==5934== by 0x100EFFE: zend_execute (zend_vm_execute.h:434) ==5934== by 0xF46C5B: zend_execute_scripts (zend.c:1389) ==5934== by 0xE48EBB: php_execute_script (main.c:2479) ==5934== by 0x114D47A: do_cli (php_cli.c:967) ==5934== by 0x114EEE9: main (php_cli.c:1334) ==5934== ==5934== Invalid read of size 8 ==5934== at 0x10B3CBA: ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER (zend_vm_execute.h:23944) ==5934== by 0x100E4E5: execute_ex (zend_vm_execute.h:394) ==5934== by 0x100EFFE: zend_execute (zend_vm_execute.h:434) ==5934== by 0xF46C5B: zend_execute_scripts (zend.c:1389) ==5934== by 0xE48EBB: php_execute_script (main.c:2479) ==5934== by 0x114D47A: do_cli (php_cli.c:967) ==5934== by 0x114EEE9: main (php_cli.c:1334) ==5934== Address 0x11d52e78 is 24 bytes inside a block of size 40 free'd ==5934== at 0x4C27C24: free (vg_replace_malloc.c:473) ==5934== by 0xEECE24: _efree (zend_alloc.c:2222) ==5934== by 0xFF31A2: zend_objects_store_del (zend_objects_API.c:205) ==5934== by 0xF40F2D: _zval_dtor_func_for_ptr (zend_variables.c:116) ==5934== by 0x10F25B2: zend_assign_to_variable (zend_execute.h:104) ==5934== by 0x10F25B2: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:33656) ==5934== by 0x100E4E5: execute_ex (zend_vm_execute.h:394) ==5934== by 0x100EFFE: zend_execute (zend_vm_execute.h:434) ==5934== by 0xF46C5B: zend_execute_scripts (zend.c:1389) ==5934== by 0xE48EBB: php_execute_script (main.c:2479) ==5934== by 0x114D47A: do_cli (php_cli.c:967) ==5934== by 0x114EEE9: main (php_cli.c:1334) ==5934== ==5934== Invalid read of size 8 ==5934== at 0x10B3D30: ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER (zend_vm_execute.h:23952) ==5934== by 0x100E4E5: execute_ex (zend_vm_execute.h:394) ==5934== by 0x100EFFE: zend_execute (zend_vm_execute.h:434) ==5934== by 0xF46C5B: zend_execute_scripts (zend.c:1389) ==5934== by 0xE48EBB: php_execute_script (main.c:2479) ==5934== by 0x114D47A: do_cli (php_cli.c:967) ==5934== by 0x114EEE9: main (php_cli.c:1334) ==5934== Address 0x11d52e78 is 24 bytes inside a block of size 40 free'd ==5934== at 0x4C27C24: free (vg_replace_malloc.c:473) ==5934== by 0xEECE24: _efree (zend_alloc.c:2222) ==5934== by 0xFF31A2: zend_objects_store_del (zend_objects_API.c:205) ==5934== by 0xF40F2D: _zval_dtor_func_for_ptr (zend_variables.c:116) ==5934== by 0x10F25B2: zend_assign_to_variable (zend_execute.h:104) ==5934== by 0x10F25B2: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:33656) ==5934== by 0x100E4E5: execute_ex (zend_vm_execute.h:394) ==5934== by 0x100EFFE: zend_execute (zend_vm_execute.h:434) ==5934== by 0xF46C5B: zend_execute_scripts (zend.c:1389) ==5934== by 0xE48EBB: php_execute_script (main.c:2479) ==5934== by 0x114D47A: do_cli (php_cli.c:967) ==5934== by 0x114EEE9: main (php_cli.c:1334) ==5934== ==5934== Invalid read of size 8 ==5934== at 0xFEED8F: zend_std_get_method (zend_object_handlers.c:1068) ==5934== by 0x10B3D71: ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER (zend_vm_execute.h:23952) ==5934== by 0x100E4E5: execute_ex (zend_vm_execute.h:394) ==5934== by 0x100EFFE: zend_execute (zend_vm_execute.h:434) ==5934== by 0xF46C5B: zend_execute_scripts (zend.c:1389) ==5934== by 0xE48EBB: php_execute_script (main.c:2479) ==5934== by 0x114D47A: do_cli (php_cli.c:967) ==5934== by 0x114EEE9: main (php_cli.c:1334) ==5934== Address 0x11d52e70 is 16 bytes inside a block of size 40 free'd ==5934== at 0x4C27C24: free (vg_replace_malloc.c:473) ==5934== by 0xEECE24: _efree (zend_alloc.c:2222) ==5934== by 0xFF31A2: zend_objects_store_del (zend_objects_API.c:205) ==5934== by 0xF40F2D: _zval_dtor_func_for_ptr (zend_variables.c:116) ==5934== by 0x10F25B2: zend_assign_to_variable (zend_execute.h:104) ==5934== by 0x10F25B2: ZEND_ASSIGN_SPEC_CV_VAR_HANDLER (zend_vm_execute.h:33656) ==5934== by 0x100E4E5: execute_ex (zend_vm_execute.h:394) ==5934== by 0x100EFFE: zend_execute (zend_vm_execute.h:434) ==5934== by 0xF46C5B: zend_execute_scripts (zend.c:1389) ==5934== by 0xE48EBB: php_execute_script (main.c:2479) ==5934== by 0x114D47A: do_cli (php_cli.c:967) ==5934== by 0x114EEE9: main (php_cli.c:1334) ==5934== ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69700&edit=1