Bug #72598 [Opn->Ana]: Reference is lost after array_slice()
Edit report at https://bugs.php.net/bug.php?id=72598&edit=1
ID: 72598
Updated by: bwoebi@php.net
Reported by: dominikschilling+php at gmail dot com
Summary: Reference is lost after array_slice()
-Status: Open
+Status: Analyzed
Type: Bug
Package: Scripting Engine problem
PHP Version: 7.1Git-2016-07-14 (Git)
Block user comment: N
Private report: N
New Comment:
(That it needs two iterations is another bug in array_slice).
The general issue here is the refcount of the reference being 1, as &$this doesn't make
$this a reference; it merely fetches the $this value (due to some optimization) and references that
value, resulting in a reference of refcount 1...
I have no idea how to fix that without leaking the reference or storing it on the object and
checking for it in each dtor...
Simpler repro:
function ref(&$ref) {}
new class {
function __construct() {
$args = [&$this];
for ($i = 0; $i < 2; $i++) {
$a = array_slice($args, 0, 1);
call_user_func_array('ref', $a);
}
}
};
Previous Comments:
------------------------------------------------------------------------
[2016-07-14 15:45:36] dominikschilling+php at gmail dot com
Description:
------------
I noticed a weird issue when running the unit tests of WordPress with PHP 7.1.0.
Our ticket: https://core.trac.wordpress.org/ticket/37295
The failing test: https://travis-ci.org/aaronjorbin/develop.wordpress/jobs/142322444#L387-L396
It looks like array_slice() is removing the reference of a variable under certain conditions. The
test script is a short form of what WordPress is doing here.
Test script:
---------------
<?php
global $wp_filter;
$wp_filter[ 'pre_get_posts' ][ 9 ][ 1 ] = [ 'function' =>
'function_which_expects_a_reference', 'accepted_args' => 1 ];
$wp_filter[ 'pre_get_posts' ][ 9 ][ 2 ] = [ 'function' =>
'function_which_expects_a_reference', 'accepted_args' => 1 ];
class FooBar {
function __construct() {
do_action_ref_array( 'pre_get_posts', [ &$this ] );
}
}
function do_action_ref_array( $tag, $args ) {
global $wp_filter;
reset( $wp_filter[ $tag ] );
do {
foreach ( current( $wp_filter[ $tag ] ) as $the_ ) {
$a = array_slice( $args, 0, (int) $the_['accepted_args'] );
xdebug_debug_zval( 'a' );
call_user_func_array( $the_['function'], $a );
}
} while ( next( $wp_filter[ $tag ] ) !== false );
}
function function_which_expects_a_reference( &$variable ) {}
new FooBar();
Expected result:
----------------
a: (refcount=1, is_ref=0)=array (0 => (refcount=3, is_ref=1)=class FooBar { })
a: (refcount=1, is_ref=0)=array (0 => (refcount=3, is_ref=1)=class FooBar { })
Actual result:
--------------
a: (refcount=1, is_ref=0)=array (0 => (refcount=1, is_ref=1)=class FooBar { })
a: (refcount=1, is_ref=0)=array (0 => (refcount=4, is_ref=0)=class FooBar { })
PHP Warning: Parameter 1 to function_which_expects_a_reference() expected to be a reference, value
given in /php71.php on line 21
PHP Stack trace:
PHP 1. {main}() /php71.php:0
PHP 2. FooBar->__construct() /php71.php:28
PHP 3. do_action_ref_array() /php71.php:8
Warning: Parameter 1 to function_which_expects_a_reference() expected to be a reference, value given
in /php71.php on line 21
Call Stack:
0.0006 361384 1. {main}() /php71.php:0
0.0030 362576 2. FooBar->__construct() /php71.php:28
0.0030 362976 3. do_action_ref_array() /php71.php:8
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72598&edit=1
Thread (10 messages)