Bug #71436 [Com]: Segfault in AppendIterator with empty generator

From: Date: Tue, 10 Apr 2018 08:08:33 +0000
Subject: Bug #71436 [Com]: Segfault in AppendIterator with empty generator
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-214674@lists.php.net to get a copy of this message
Edit report at https://bugs.php.net/bug.php?id=71436&edit=1

 ID:                 71436
 Comment by:         sahli at gyselroth dot com
 Reported by:        matej21 at matej21 dot cz
 Summary:            Segfault in AppendIterator with empty generator
 Status:             Assigned
 Type:               Bug
 Package:            SPL related
 PHP Version:        7.0.2
 Assigned To:        nikic
 Block user comment: N
 Private report:     N

 New Comment:

Same here, PHP 7.2.0, AppendIterator is pretty much unusable because of this behaviour.


Previous Comments:
------------------------------------------------------------------------
[2017-04-15 20:38:53] matej21 at matej21 dot cz

first rewind is invoked by spl_append_it_next_iterator(), second one is invoked by
spl_iterator_apply(). 

so maybe some flag telling that append iterator is already rewinded would solve it?

------------------------------------------------------------------------
[2017-03-02 16:08:10] tom60 at op dot pl

Possibly related:

-------------------------------------------------------
#0  zend_mm_alloc_small (size=56, bin_num=6, heap=0x7f8c9de00040) at
/src/php-7.1.2/Zend/zend_alloc.c:1261
#1  _emalloc_56 () at /src/php-7.1.2/Zend/zend_alloc.c:2336
#2  0x000000000080d7a0 in _array_init (arg=arg@entry=0x7ffffdaf06f0, size=size@entry=0) at
/src/php-7.1.2/Zend/zend_API.c:1060
#3  0x0000000000824f31 in zend_fetch_debug_backtrace
(return_value=return_value@entry=0x7ffffdaf0780, skip_last=skip_last@entry=0,
options=options@entry=0, 
    limit=limit@entry=0) at /src/php-7.1.2/Zend/zend_builtin_functions.c:2612
#4  0x000000000082bb0f in zend_default_exception_new_ex (class_type=0x2015d80, skip_top_traces=0) at
/src/php-7.1.2/Zend/zend_exceptions.c:216
#5  0x000000000080df3b in _object_and_properties_init (arg=arg@entry=0x7ffffdaf07f0,
class_type=class_type@entry=0x2015d80, properties=properties@entry=0x0)
    at /src/php-7.1.2/Zend/zend_API.c:1302
#6  0x000000000080e047 in _object_init_ex (arg=arg@entry=0x7ffffdaf07f0,
class_type=class_type@entry=0x2015d80)
    at /src/php-7.1.2/Zend/zend_API.c:1310
#7  0x0000000000438429 in zend_throw_exception (exception_ce=0x2015d80, exception_ce@entry=0x0,
message=message@entry=0xdf6b78 "Cannot traverse an already closed generator", 
    code=code@entry=0) at /src/php-7.1.2/Zend/zend_exceptions.c:922
#8  0x00000000008365ee in zend_generator_get_iterator (ce=<optimized out>,
object=0x7f8c9de13980, by_ref=<optimized out>)
    at /src/php-7.1.2/Zend/zend_generators.c:1186
#9  0x00000000006e59c5 in spl_iterator_apply (obj=<optimized out>, apply_func=0x6df320
<spl_iterator_to_values_apply>, puser=puser@entry=0x7f8c9de13920)
    at /src/php-7.1.2/ext/spl/spl_iterators.c:3495
#10 0x00000000006e5af5 in zif_iterator_to_array (execute_data=<optimized out>,
return_value=0x7f8c9de13920)
    at /src/php-7.1.2/ext/spl/spl_iterators.c:3590
#11 0x00000000008aa572 in ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_USED_HANDLER () at
/src/php-7.1.2/Zend/zend_vm_execute.h:876
#12 0x000000000085215b in execute_ex (ex=<optimized out>) at
/src/php-7.1.2/Zend/zend_vm_execute.h:429
#13 0x0000000000836c32 in zend_generator_resume (orig_generator=0x7f8c9de00040) at
/src/php-7.1.2/Zend/zend_generators.c:817
#14 0x00000000008696b9 in ZEND_FE_FETCH_R_SPEC_VAR_HANDLER () at
/src/php-7.1.2/Zend/zend_vm_execute.h:16816
#15 0x000000000085215b in execute_ex (ex=<optimized out>) at
/src/php-7.1.2/Zend/zend_vm_execute.h:429
#16 0x0000000000836c32 in zend_generator_resume (orig_generator=0x7f8c9de00040) at
/src/php-7.1.2/Zend/zend_generators.c:817
#17 0x00000000008696b9 in ZEND_FE_FETCH_R_SPEC_VAR_HANDLER () at
/src/php-7.1.2/Zend/zend_vm_execute.h:16816
#18 0x000000000085215b in execute_ex (ex=<optimized out>) at
/src/php-7.1.2/Zend/zend_vm_execute.h:429
#19 0x00000000008ad410 in zend_execute (op_array=0x7f8c9de7d000, op_array@entry=0x7f8c9d089d00,
return_value=return_value@entry=0x7f8c9de13500)
    at /src/php-7.1.2/Zend/zend_vm_execute.h:474
#20 0x000000000080b834 in zend_execute_scripts (type=type@entry=8, retval=0x7f8c9de13500,
retval@entry=0x0, file_count=file_count@entry=3)
    at /src/php-7.1.2/Zend/zend.c:1475
#21 0x00000000007abfb0 in php_execute_script (primary_file=0x7ffffdaf3060) at
/src/php-7.1.2/main/main.c:2537
#22 0x00000000008af59a in do_cli (argc=-1646264256, argv=0x0) at
/src/php-7.1.2/sapi/cli/php_cli.c:993
#23 0x000000000043a36c in main (argc=-1646264256, argv=0x0) at
/src/php-7.1.2/sapi/cli/php_cli.c:1381

------------------------------------------------------------------------
[2016-07-28 23:59:57] nikic@php.net

Related To: Bug #72692

------------------------------------------------------------------------
[2016-07-28 23:32:21] brian dot carpenter at gmail dot com

This crash is present in 5.6.24.

------------------------------------------------------------------------
[2016-03-24 16:54:12] savageman86 at gmail dot com

Same bug on 5.5.9

------------------------------------------------------------------------


The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at

    https://bugs.php.net/bug.php?id=71436


--
Edit this bug report at https://bugs.php.net/bug.php?id=71436&edit=1


Thread (11 messages)

« previous php.bugs (#214674) next »