Bug #70987 [NEW]: static::class within Closure::call() causes segfault

From: ajf at ajf dot me Operating system: OS X 10.11 PHP version: 7.0.0RC8 Package: Reproducible crash Bug Type: Bug Bug description:static::class within Closure::call() causes segfault Description: ------------ Specific to Closure::call(). Using Closure::bindTo() and then calling the resulting closure does not produce the same issue. Issue does not occur when using some other return value. Issue is not specific to returning static::class, can also happen if assigned to a variable. Issue exists in all versions of PHP 7 so far: https://3v4l.org/8vZhA. I've personally reproduced this issue on the current PHP master and PHP-7.0 branch. Test script: --------------- <?php class foo {} $bar = function () { return static::class; }; var_dump($bar->call(new foo)); ?> Expected result: ---------------- string(3) "foo" Actual result: -------------- Segmentation fault valgrind backtrace: ==76755== Invalid read of size 8 ==76755== at 0x1003A5983: ZEND_FETCH_CLASS_NAME_SPEC_HANDLER (in sapi/cli/php) ==76755== by 0x1003391C3: execute_ex (in sapi/cli/php) ==76755== by 0x1002B4DDD: zend_call_function (in sapi/cli/php) ==76755== by 0x1003143A5: zim_Closure_call (in sapi/cli/php) ==76755== by 0x100364136: ZEND_DO_FCALL_SPEC_HANDLER (in sapi/cli/php) ==76755== by 0x1003391C3: execute_ex (in sapi/cli/php) ==76755== by 0x10033932F: zend_execute (in sapi/cli/php) ==76755== by 0x1002B6125: zend_eval_stringl (in sapi/cli/php) ==76755== by 0x1002B63A0: zend_eval_stringl_ex (in sapi/cli/php) ==76755== by 0x1002B6442: zend_eval_string_ex (in sapi/cli/php) ==76755== by 0x1003CC905: do_cli (in sapi/cli/php) ==76755== by 0x1003CB60D: main (in sapi/cli/php) ==76755== Address 0x8 is not stack'd, malloc'd or (recently) free'd ==76755== ==76755== ==76755== Process terminating with default action of signal 11 (SIGSEGV) ==76755== Access not within mapped region at address 0x8 ==76755== at 0x1003A5983: ZEND_FETCH_CLASS_NAME_SPEC_HANDLER (in sapi/cli/php) ==76755== by 0x1003391C3: execute_ex (in sapi/cli/php) ==76755== by 0x1002B4DDD: zend_call_function (in sapi/cli/php) ==76755== by 0x1003143A5: zim_Closure_call (in sapi/cli/php) ==76755== by 0x100364136: ZEND_DO_FCALL_SPEC_HANDLER (in sapi/cli/php) ==76755== by 0x1003391C3: execute_ex (in sapi/cli/php) ==76755== by 0x10033932F: zend_execute (in sapi/cli/php) ==76755== by 0x1002B6125: zend_eval_stringl (in sapi/cli/php) ==76755== by 0x1002B63A0: zend_eval_stringl_ex (in sapi/cli/php) ==76755== by 0x1002B6442: zend_eval_string_ex (in sapi/cli/php) ==76755== by 0x1003CC905: do_cli (in sapi/cli/php) ==76755== by 0x1003CB60D: main (in sapi/cli/php) -- Edit bug report at https://bugs.php.net/bug.php?id=70987&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=70987&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=70987&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=70987&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=70987&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=70987&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=70987&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=70987&r=needscript Try newer version: https://bugs.php.net/fix.php?id=70987&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=70987&r=support Expected behavior: https://bugs.php.net/fix.php?id=70987&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=70987&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=70987&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=70987&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=70987&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=70987&r=dst IIS Stability: https://bugs.php.net/fix.php?id=70987&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=70987&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=70987&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=70987&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=70987&r=mysqlcfg