Bug #72854 [Fbk->Opn]: PHP Crashes on duplicate destructor call

Edit report at https://bugs.php.net/bug.php?id=72854&edit=1 ID: 72854 User updated by: php at abiusx dot com Reported by: php at abiusx dot com Summary: PHP Crashes on duplicate destructor call -Status: Feedback +Status: Open Type: Bug Package: Class/Object related Operating System: Mac OS X, Linux PHP Version: 7.0.9 Block user comment: N Private report: N New Comment: It needs to run on concolic mode, I gave you access to the private Github repo, please give the analyzer a try. Use the following: php main.php -f wordpress/index.php --concolic --strict -v 10 Previous Comments: ------------------------------------------------------------------------ [2016-08-16 15:12:48] nikic@php.net I tried running the command from the README php main.php -f wordpress/index.php -v 10 --strict && cat output.txt on wordpress-4.1 and I do not observe a crash. ------------------------------------------------------------------------ [2016-08-16 15:12:34] php at abiusx dot com I am aware of what you said, and I plan on doing a thorough investigation on this issue. I have faced it over and over in my line of work, both on OS X and on Ubuntu. The backtrace is 600mb, which is not very useful. Plus, it ends up in system malloc, which is another useless clue. I have made several attempts at making a short example that reproduces the crash, but have been unable to do so. At this point, this bug just serves as an entry point for myself to do further research and find the problem. ------------------------------------------------------------------------ [2016-08-16 15:09:58] requinix@php.net Running that php-emul stuff is a bit much for us to do. Some short repro code would be great - may be hard for you to come up with though. I know you said you haven't been able to run it though a debug version yet, but without the code then we'll need a backtrace (see http://bugs.php.net/bugs-generating-backtrace.php). ------------------------------------------------------------------------ [2016-08-16 14:47:39] php at abiusx dot com Description: ------------ I have a very complicated code that runs for 4 minutes. The important thing the code does, is it makes deep copies of data structures in PHP, does something, and discards the deep copy. Many times when this happens, PHP segfaults (typically with memory violation) when the destructor of a deep copied object is called, and a resource is involved in that object. Examples are wp-db and phpmailer classes in Wordpress, both of which segfault PHP on their destructor. I still haven't had the chance to run PHP's debug version on it to figure out the details, but now I'm sure the bug is there (and has been since PHP 7.0.0, also tested on PHP 5.4 and it persists). Test script: --------------- github.com/abiusx/php-emul concolic mode on Wordpress and Joomla causes the crash. The crash is not stack related, it is also deterministic. Expected result: ---------------- No crash Actual result: -------------- Segfault (memory violation) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=72854&edit=1