Bug #70970 [NEW]: Segfault when combining error handler with output buffering

From: sebastian Operating system: Linux PHP version: 7.0Git-2015-11-25 (Git) Package: Output Control Bug Type: Bug Bug description:Segfault when combining error handler with output buffering Description: ------------ While researching the changes made to output buffering in PHP 7 for a book I am working on with Arne Blankerts and Stefan Priebsch, Arne discovered the segfault shown below. Of course, the code shown does not make any sense. Yet it should not lead to a segfault in PHP. Test script: --------------- <?php function exception_error_handler($severity, $message, $file, $line) { throw new ErrorException($message, 0, $severity, $file, $line); } set_error_handler('exception_error_handler'); function obHandler($buffer, $phase = null) { try { ob_start(); } catch (\Throwable $e) { return (string) $e; } return $buffer; } ob_start('obHandler'); print 'test'; Actual result: -------------- #0 0x0000000000985e06 in zend_fcall_info_args_clear (fci=0x7372656c, free_mem=1) at /usr/local/src/php/src/Zend/zend_API.c:3427 #1 0x0000000000986368 in zend_fcall_info_argv (fci=0x7372656c, argc=0, argv=0x7fffffffbcc0) at /usr/local/src/php/src/Zend/zend_API.c:3534 #2 0x000000000098653d in zend_fcall_info_argn (fci=0x7372656c, argc=0) at /usr/local/src/php/src/Zend/zend_API.c:3556 #3 0x0000000000903731 in php_output_handler_op (handler=0x7fffee46a2a0, context=0x7fffffffbe30) at /usr/local/src/php/src/main/output.c:977 #4 0x0000000000903ef7 in php_output_stack_pop (flags=1) at /usr/local/src/php/src/main/output.c:1221 #5 0x0000000000901fd9 in php_output_end_all () at /usr/local/src/php/src/main/output.c:341 #6 0x00000000008e9682 in php_request_shutdown (dummy=0x0) at /usr/local/src/php/src/main/main.c:1777 #7 0x0000000000a37286 in do_cli (argc=2, argv=0x1357390) at /usr/local/src/php/src/sapi/cli/php_cli.c:1142 #8 0x0000000000a3796e in main (argc=2, argv=0x1357390) at /usr/local/src/php/src/sapi/cli/php_cli.c:1345 -- Edit bug report at https://bugs.php.net/bug.php?id=70970&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70970&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70970&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70970&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70970&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70970&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70970&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70970&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70970&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70970&r=support Expected behavior: https://bugs.php.net/fix.php?id=70970&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70970&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70970&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70970&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70970&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70970&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70970&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70970&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70970&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70970&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70970&r=mysqlcfg