Bug #72829 [NEW]: SegFault When Leaving a Loop that Creates an Array of Objects

From: Chad dot Sikorra at gmail dot com Operating system: Ubuntu 16.04 PHP version: 7.1.0beta2 Package: Reproducible crash Bug Type: Bug Bug description:SegFault When Leaving a Loop that Creates an Array of Objects Description: ------------ Just starting with PHP 7.1 beta2 (this did not happen in beta1), some tests for a library I maintain started to segfault in the same exact location. I narrowed the spot down to a loop that creates an array of objects. However, it isn't a specific part of my code causing the segfault, as it happens just as the loop exits and before my method returns. The loop it fails directly after: https://github.com/ldaptools/ldaptools/blob/master/src/LdapTools/Schema/Parser/SchemaYamlParser.php#L111 The backtrace: Program received signal SIGSEGV, Segmentation fault. 0x0000000000898ac3 in zval_addref_p (pz=0x7fffec1f7ca0) at /home/chad/trace/php-src/Zend/zend_types.h:829 829 return ++GC_REFCOUNT(Z_COUNTED_P(pz)); (gdb) bt #0 0x0000000000898ac3 in zval_addref_p (pz=0x7fffec1f7ca0) at /home/chad/trace/php-src/Zend/zend_types.h:829 #1 0x00000000008aab6f in zif_array_column (execute_data=0x7fffec616dd0, return_value=0x7fffec616d40) at /home/chad/trace/php-src/ext/standard/array.c:3607 #2 0x0000000000a76ae1 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at /home/chad/trace/php-src/Zend/zend_vm_execute.h:876 #3 0x0000000000a758c6 in execute_ex (ex=0x7fffec616570) at /home/chad/trace/php-src/Zend/zend_vm_execute.h:429 #4 0x00000000009faa6a in zend_call_function (fci=0x7fffffff9e70, fci_cache=0x7fffffff9e40) at /home/chad/trace/php-src/Zend/zend_execute_API.c:837 #5 0x00000000008b8b41 in zif_call_user_func_array (execute_data=0x7fffec616500, return_value=0x7fffec616480) at /home/chad/trace/php-src/ext/standard/basic_functions.c:4844 #6 0x0000000000a76ae1 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at /home/chad/trace/php-src/Zend/zend_vm_execute.h:876 #7 0x0000000000a758c6 in execute_ex (ex=0x7fffec6160b0) at /home/chad/trace/php-src/Zend/zend_vm_execute.h:429 #8 0x00000000009faa6a in zend_call_function (fci=0x7fffffffa120, fci_cache=0x7fffffffa0f0) at /home/chad/trace/php-src/Zend/zend_execute_API.c:837 #9 0x00000000008b8b41 in zif_call_user_func_array (execute_data=0x7fffec616040, return_value=0x7fffec616010) at /home/chad/trace/php-src/ext/standard/basic_functions.c:4844 #10 0x0000000000a76ae1 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at /home/chad/trace/php-src/Zend/zend_vm_execute.h:876 #11 0x0000000000a758c6 in execute_ex (ex=0x7fffec615f00) at /home/chad/trace/php-src/Zend/zend_vm_execute.h:429 #12 0x00000000009faa6a in zend_call_function (fci=0x7fffffffa410, fci_cache=0x7fffffffa3e0) at /home/chad/trace/php-src/Zend/zend_execute_API.c:837 #13 0x0000000000838b0b in zim_reflection_method_invokeArgs (execute_data=0x7fffec615e90, return_value=0x7fffffffa480) at /home/chad/trace/php-src/ext/reflection/php_reflection.c:3379 #14 0x0000000000a76f71 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /home/chad/trace/php-src/Zend/zend_vm_execute.h:970 #15 0x0000000000a758c6 in execute_ex (ex=0x7fffec614030) at /home/chad/trace/php-src/Zend/zend_vm_execute.h:429 #16 0x0000000000a759d7 in zend_execute (op_array=0x7fffec686000, return_value=0x0) at /home/chad/trace/php-src/Zend/zend_vm_execute.h:474 #17 0x0000000000a12cd4 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/chad/trace/php-src/Zend/zend.c:1447 #18 0x0000000000979191 in php_execute_script (primary_file=0x7fffffffcb40) at /home/chad/trace/php-src/main/main.c:2533 #19 0x0000000000afaa8a in do_cli (argc=4, argv=0x1460700) at /home/chad/trace/php-src/sapi/cli/php_cli.c:990 #20 0x0000000000afbc5d in main (argc=4, argv=0x1460700) at /home/chad/trace/php-src/sapi/cli/php_cli.c:1378 -- Edit bug report at https://bugs.php.net/bug.php?id=72829&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72829&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72829&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72829&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72829&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72829&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72829&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72829&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72829&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72829&r=support Expected behavior: https://bugs.php.net/fix.php?id=72829&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72829&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72829&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72829&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72829&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72829&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72829&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72829&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72829&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72829&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72829&r=mysqlcfg