Bug #70970 [Opn->Csd]: Segfault when combining error handler with output buffering

Edit report at https://bugs.php.net/bug.php?id=70970&edit=1 ID: 70970 Updated by: laruence@php.net Reported by: sebastian@php.net Summary: Segfault when combining error handler with output buffering -Status: Open +Status: Closed Type: Bug Package: Output Control Operating System: Linux PHP Version: 7.0Git-2015-11-25 (Git) Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=4a7e83f54aeb6d5464da6cc2b201ce47a23a88d9 Log: Fixed bug #70970 (Segfault when combining error handler with output buffering) Previous Comments: ------------------------------------------------------------------------ [2015-11-25 13:30:04] sebastian@php.net Description: ------------ While researching the changes made to output buffering in PHP 7 for a book I am working on with Arne Blankerts and Stefan Priebsch, Arne discovered the segfault shown below. Of course, the code shown does not make any sense. Yet it should not lead to a segfault in PHP. Test script: --------------- <?php function exception_error_handler($severity, $message, $file, $line) { throw new ErrorException($message, 0, $severity, $file, $line); } set_error_handler('exception_error_handler'); function obHandler($buffer, $phase = null) { try { ob_start(); } catch (\Throwable $e) { return (string) $e; } return $buffer; } ob_start('obHandler'); print 'test'; Actual result: -------------- #0 0x0000000000985e06 in zend_fcall_info_args_clear (fci=0x7372656c, free_mem=1) at /usr/local/src/php/src/Zend/zend_API.c:3427 #1 0x0000000000986368 in zend_fcall_info_argv (fci=0x7372656c, argc=0, argv=0x7fffffffbcc0) at /usr/local/src/php/src/Zend/zend_API.c:3534 #2 0x000000000098653d in zend_fcall_info_argn (fci=0x7372656c, argc=0) at /usr/local/src/php/src/Zend/zend_API.c:3556 #3 0x0000000000903731 in php_output_handler_op (handler=0x7fffee46a2a0, context=0x7fffffffbe30) at /usr/local/src/php/src/main/output.c:977 #4 0x0000000000903ef7 in php_output_stack_pop (flags=1) at /usr/local/src/php/src/main/output.c:1221 #5 0x0000000000901fd9 in php_output_end_all () at /usr/local/src/php/src/main/output.c:341 #6 0x00000000008e9682 in php_request_shutdown (dummy=0x0) at /usr/local/src/php/src/main/main.c:1777 #7 0x0000000000a37286 in do_cli (argc=2, argv=0x1357390) at /usr/local/src/php/src/sapi/cli/php_cli.c:1142 #8 0x0000000000a3796e in main (argc=2, argv=0x1357390) at /usr/local/src/php/src/sapi/cli/php_cli.c:1345 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=70970&edit=1