Bug #72411 [Com]: PHP segfaults when there are too many elements added to a linked list

Edit report at https://bugs.php.net/bug.php?id=72411&edit=1 ID: 72411 Comment by: brunocassol at gmail dot com Reported by: pwmosquito at gmail dot com Summary: PHP segfaults when there are too many elements added to a linked list Status: Duplicate Type: Bug Package: Reproducible crash Operating System: All PHP Version: Irrelevant Block user comment: N Private report: N New Comment: Well I can bikeshed this. Full strace output: http://pastebin.com/Nnyufi3R Last lines: mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f139ea46000 munmap(0x7f139ea46000, 2097152) = 0 mmap(NULL, 4190208, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f139e847000 munmap(0x7f139e847000, 1806336) = 0 munmap(0x7f139ec00000, 286720) = 0 madvise(0x7f139ea00000, 2097152, MADV_HUGEPAGE) = 0 mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f139e800000 madvise(0x7f139e800000, 2097152, MADV_HUGEPAGE) = 0 mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f139e600000 madvise(0x7f139e600000, 2097152, MADV_HUGEPAGE) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x7ffdfe29cf78} --- +++ killed by SIGSEGV (core dumped) +++ Segmentation fault (core dumped) Previous Comments: ------------------------------------------------------------------------ [2016-06-15 13:42:44] nikic@php.net Duplicate of bug #68606. ------------------------------------------------------------------------ [2016-06-15 11:31:10] pwmosquito at gmail dot com Description: ------------ OSes: OSX (version 10.11.5), Ubuntu 14.04.3 LTS, CentOS release 6.5 (Final) PHP versions: 5.5, 5.6, 7.0 When implementing a simple singly linked list in PHP I get a segfault if I try to add too many items to the list. To define too many: the sample code attached could cope with 29,000 items on my machine but segfaults with 30,000 items. The interesting part is that if I first remove the items from the list, eg. with $this->head = $this->head->getNext() (method excluded from the sample code for brevity) then everything works as expected and I can add items to the list till it fill up and I get "Fatal error: Uncaught RuntimeException: Stack overflow.", which is expected. If I add __destruct() { $this->head = null; } to LinkedList and set a breakpoint there it will segfault when I execute that line. Test script: --------------- <?php class Node { private $next; public function setNext(Node $node = null) { $this->next = $node; return $this; } } class LinkedList { private $head; public function addNode() { $this->head = (new Node())->setNext($this->head); } } $ll = new LinkedList(); for ($i = 0; $i < 100000; $i++) { $ll->addNode(); } Expected result: ---------------- no output Actual result: -------------- 'php test.php' terminated by signal SIGSEGV (Address boundary error) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72411&edit=1