Bug #71815 [Opn->Dup]: Segfault after 65536 empty array references
Edit report at https://bugs.php.net/bug.php?id=71815&edit=1
ID: 71815
Updated by: nikic@php.net
Reported by: mihor dot cz at gmail dot com
Summary: Segfault after 65536 empty array references
-Status: Open
+Status: Duplicate
Type: Bug
Package: Reproducible crash
Operating System: CentOS 7.2.1511
PHP Version: 7.0.4
Block user comment: N
Private report: N
New Comment:
This has the same root cause as https://bugs.php.net/bug.php?id=71539, namely the
RHS of a ref assignment reallocating the array, while the LHS still holds a reference into it. We
haven't found a good way to fix it yet.
Previous Comments:
------------------------------------------------------------------------
[2016-03-13 18:38:30] mihor dot cz at gmail dot com
Description:
------------
Hello PHP team,
I managed to pin-point one problem with PHP 7.0.4 (But I think that this problem is at least from
7.0.0)
I don't think that there is more to explain than simple code below.
Originally I found this problem in our large PHP code and it disappeared every time I turned off
Opcache, but after pin-pointing and extracting problem into code below: Opcache is no longer needed
to segfault (so I guess that opcache is maybe little more sensitive to this kind of bad PHP code
abuse)
My system spec:
PHP version: 7.0.4
OS: CentOS 7.2.1511
RAM: 128 GB
CPU: 2 x Intel(R) Xeon(R) CPU E5-2667 v3 @ 3.20GHz
PHP config:
Memory limit: 16 GB
Test script:
---------------
<?php
$desc = array();
for ($i = 65535; $i > 0; $i--)
{
$desc[$i] = &$desc[$i - 1];
}
echo "still ok\n";
$desc = array();
for ($i = 65536; $i > 0; $i--)
{
$desc[$i] = &$desc[$i - 1];
}
echo "not ok";
Expected result:
----------------
still ok
not ok
Actual result:
--------------
still ok
Segmentation fault
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71815&edit=1
Thread (2 messages)