Bug #62210 [Csd->ReO]: Exceptions can leak temporary variables

Edit report at https://bugs.php.net/bug.php?id=62210&edit=1 ID: 62210 Updated by: dmitry@php.net Reported by: nikic@php.net Summary: Exceptions can leak temporary variables -Status: Closed +Status: Re-Opened Type: Bug Package: Scripting Engine problem PHP Version: Irrelevant Assigned To: dmitry Block user comment: N Private report: N New Comment: The fix was reverted. Previous Comments: ------------------------------------------------------------------------ [2015-07-07 23:36:51] ab@php.net Automatic comment on behalf of dmitry@zend.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=5ee841325901a4b040cfea56292a24702fe224d9 Log: Fixed bug #62210 (Exceptions can leak temporary variables. As a part of the fix serious refactoring was done. op_array-&gt;brk_cont_array was removed, and replaced with more general and speed efficient op_array-&gt;T_liveliness. ZEND_GOTO opcode is always replaced by ZEND_JMP at compile time). (Bob, Dmitry, Laruence) ------------------------------------------------------------------------ [2015-07-07 12:42:11] dmitry@php.net Automatic comment on behalf of dmitry@zend.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=5ee841325901a4b040cfea56292a24702fe224d9 Log: Fixed bug #62210 (Exceptions can leak temporary variables. As a part of the fix serious refactoring was done. op_array-&gt;brk_cont_array was removed, and replaced with more general and speed efficient op_array-&gt;T_liveliness. ZEND_GOTO opcode is always replaced by ZEND_JMP at compile time). (Bob, Dmitry, Laruence) ------------------------------------------------------------------------ [2012-06-25 08:12:35] dmitry@php.net I confirm the bug, but I don't see a simple way to fix it. In general, it's possible to extend zend_op_array with information about ranges of temporary variables livenes, but overhead is going to be too high. ------------------------------------------------------------------------ [2012-06-02 00:46:39] nikic@php.net Description: ------------ The script <?php function throwException() { throw new Exception } function doSomething() { [] + throwException(); } try { doSomething(); } catch (Exception $e) { } leaks /home/nikic/dev/php-src/Zend/zend_vm_execute.h(25625) : Freeing 0xB77ABA44 (44 bytes), script=- /home/nikic/dev/php-src/Zend/zend_API.c(982) : Actual location (location was relayed) === Total 1 memory leaks detected === This generally always happens whenever an exception is thrown while evaluation an expression which contains (non-scalar) temporary variables. In the above case the array hash table is leaked. The reason is that the FREE opcode for the temporary variable is never executed due to the exception. Exceptions only free temporary loop variables. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=62210&edit=1