Bug #76337 [Opn]: segfault when opcache enabled + extension use zend_register_class_alias

Edit report at https://bugs.php.net/bug.php?id=76337&edit=1 ID: 76337 User updated by: xKhorasan+php at gmail dot com Reported by: xKhorasan+php at gmail dot com Summary: segfault when opcache enabled + extension use zend_register_class_alias Status: Open Type: Bug Package: opcache Operating System: Linux (CentOS6) PHP Version: 7.2.5 Block user comment: N Private report: N New Comment: Note that this does not occur in PHP 7.1 (confirmed with 7.1.17) Previous Comments: ------------------------------------------------------------------------ [2018-05-13 23:45:59] xKhorasan+php at gmail dot com Description: ------------ configure option: --with-config-file-path=/etc/ --with-config-file-scan-dir=/etc/php.d/ change to php.ini: added lines below > zend_extension=/usr/local/lib/php/extensions/no-debug-non-zts-20170718/opcache.so > opcache.enable_cli=1 > extension=couchbase.so steps to reproduce: 1. download this file: https://gist.github.com/xKerman/a987581d3d137644460dd15c1d25c612 2: run command: docker build -t php/bug-report . 3: run command in docker container: ``` $ docker run --rm -it php/bug-report bash [root@236b3ee9e1ec /]# php -v ``` gdb backtrace: ``` [root@236b3ee9e1ec /]# ulimit -c unlimited [root@236b3ee9e1ec /]# php -v [cb,WARN] (pcbc/ext L:426) igbinary serializer is not found PHP 7.2.5 (cli) (built: May 11 2018 21:40:50) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies with Zend OPcache v7.2.5, Copyright (c) 1999-2018, by Zend Technologies Segmentation fault (core dumped) [root@236b3ee9e1ec /]# gdb php -c core (gdb) bt #0 zend_string_release (ht=0x2fbbb50) at /php-7.2.5/Zend/zend_string.h:289 #1 zend_hash_destroy (ht=0x2fbbb50) at /php-7.2.5/Zend/zend_hash.c:1247 #2 0x0000000000726f91 in zend_shutdown () at /php-7.2.5/Zend/zend.c:911 #3 0x00000000006c581a in php_module_shutdown () at /php-7.2.5/main/main.c:2453 #4 0x00000000007d7225 in main (argc=2, argv=0x2fbb7a0) at /php-7.2.5/sapi/cli/php_cli.c:1419 (gdb) frame 2 #2 0x0000000000726f91 in zend_shutdown () at /php-7.2.5/Zend/zend.c:911 911 zend_hash_destroy(GLOBAL_CLASS_TABLE); ``` Some extesion, e.g. couchbase, calls zend_register_class_alias(). https://github.com/couchbase/php-couchbase/blob/48d7f6626461c0941c4637dd93810f7556b9a387/src/couchbase/search/facet.c#L29 zend_register_class_alias() add alias name to CG(class_table), bug does not intern the class alias name string. https://github.com/php/php-src/blob/php-7.2.5/Zend/zend_API.c#L2774-L2795 Compared to zend_regiser_class_alias(), other CG(class_table) update operations, like zend_register_internal_class(), does intern string class name. https://github.com/php/php-src/blob/php-7.2.5/Zend/zend_API.c#L2720 So, CG(class_table) contains interned class name string and not interned clas name string, if extension use zend_resiger_class_alias(). And it seems that this causes segmentation fault on zend_shutdown(). Expected result: ---------------- php -v return exit code 0 Actual result: -------------- segmentation fault occur: ``` [root@236b3ee9e1ec /]# php -v [cb,WARN] (pcbc/ext L:426) igbinary serializer is not found PHP 7.2.5 (cli) (built: May 11 2018 21:40:50) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies with Zend OPcache v7.2.5, Copyright (c) 1999-2018, by Zend Technologies Segmentation fault ``` ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76337&edit=1