Bug #73896 [NEW]: spl_autoload() crashes when calls magic _call()

From: dmitry Operating system: * PHP version: 7.0Git-2017-01-09 (Git) Package: SPL related Bug Type: Bug Bug description:spl_autoload() crashes when calls magic _call() Description: ------------ The following script crashes on second attempt to call spl_autoload(), because the first attempt destroyed trampoline function. Test script: --------------- <?php class Registrator { public static function call($callable, array $args) { return call_user_func_array($callable, [$args]); } } class teLoader { public function __construct() { Registrator::call('spl_autoload_register', [$this, 'autoload']); } public function __call($method, $args) { $this->doSomething(); } protected function autoload($class) { die("Protected autoload() called!\n"); } public function doSomething() { throw new teException(); } } $teLoader = new teLoader(); try { new teChild(); } catch (Throwable $e) { echo "Exception: ", $e->getMessage() , "\n"; } ?> Expected result: ---------------- Exception: Class 'teException' not found Actual result: -------------- ==4663== Process terminating with default action of signal 11 (SIGSEGV): dumping core ==4663== Access not within mapped region at address 0x5 ==4663== at 0x866E114: ZEND_CALL_TRAMPOLINE_SPEC_HANDLER (zend_vm_execute.h:1974) ==4663== by 0x866A63A: execute_ex (zend_vm_execute.h:429) ==4663== by 0x860C079: zend_call_function (zend_execute_API.c:828) ==4663== by 0x863DD4B: zend_call_method (zend_interfaces.c:101) ==4663== by 0x8462C20: zif_spl_autoload_call (php_spl.c:408) ==4663== by 0x860C10E: zend_call_function (zend_execute_API.c:842) ==4663== by 0x860C611: zend_lookup_class_ex (zend_execute_API.c:1001) ==4663== by 0x860CF62: zend_fetch_class_by_name (zend_execute_API.c:1436) ==4663== by 0x866FF76: ZEND_NEW_SPEC_CONST_HANDLER (zend_vm_execute.h:3193) ==4663== by 0x866A63A: execute_ex (zend_vm_execute.h:429) ==4663== by 0x860C079: zend_call_function (zend_execute_API.c:828) ==4663== by 0x863DD4B: zend_call_method (zend_interfaces.c:101) -- Edit bug report at https://bugs.php.net/bug.php?id=73896&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=73896&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=73896&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=73896&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=73896&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=73896&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=73896&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=73896&r=needscript Try newer version: https://bugs.php.net/fix.php?id=73896&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=73896&r=support Expected behavior: https://bugs.php.net/fix.php?id=73896&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=73896&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=73896&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=73896&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=73896&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=73896&r=dst IIS Stability: https://bugs.php.net/fix.php?id=73896&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=73896&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=73896&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=73896&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=73896&r=mysqlcfg