Bug #76446 [Ana]: zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc.

Edit report at https://bugs.php.net/bug.php?id=76446&edit=1 ID: 76446 Updated by: cmb@php.net Reported by: spam2 at rhsoft dot net Summary: zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc. Status: Analyzed Type: Bug Package: Reproducible crash PHP Version: master-Git-2018-06-11 (Git) Block user comment: N Private report: N New Comment: > I think for now we should just mark ROPE_END as having > side-effects with a FIXME that this may be improved. I'd very much appreciate to have *some* fix for this nasty *abort* in 7.3.0alpha2, if possible; otherwise we might hamper further testing of other stuff. Your suggestion seems to be rather innocuous – to my knowledge, it would just mean to move a single line, and to loose a somwehat rare and minor optimization. Previous Comments: ------------------------------------------------------------------------ [2018-06-12 20:19:43] nikic@php.net > about the original problem, a simple fix is make ROPE_END as side-affect instrction, however I > am still thinking maybe we should remove the whole ROPE_INIT/ADD/END all-togther We already do that is we can. However, in this case we are not able to prove that the ROPE_ADD will not generate an error (e.g. array to string conversion warning). As such, in this case we can only determine that the ROPE_END is dead, but not the ROPE_ADD. Our options are to either a) just don't DCE ropes, b) only DCE them if they are dead in their entirety, or c) DCE as much dead suffix as we can, but making sure to terminate with ROPE_END+FREE if the rope does not become empty through this. I think for now we should just mark ROPE_END as having side-effects with a FIXME that this may be improved. ------------------------------------------------------------------------ [2018-06-12 13:08:57] spam2 at rhsoft dot net BTW: would it be possible to extend the "zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc" at least with the path to the script/include and if possible method/function/line strace, gdb, valgrind - no chance to find out where it is triggered and besides the bug i would like to remove the dead code anyways ------------------------------------------------------------------------ [2018-06-12 12:57:07] laruence@php.net this one has been fixed https://bugs.php.net/bug.php?id=76463 about the original problem, a simple fix is make ROPE_END as side-affect instrction, however I am still thinking maybe we should remove the whole ROPE_INIT/ADD/END all-togther ------------------------------------------------------------------------ [2018-06-12 11:53:08] spam2 at rhsoft dot net - $old_data = isset($old_data) ? (array)$old_data : []; + $old_data = []; is silencing that ones: In function cl_podcast_eintraege::edit (before dfa): var 11 (TMP) has array key type but not value type var 12 (TMP) has array key type but not value type var 14 (TMP) has array key type but not value type var 15 (CV $old_data) has array key type but not value type ------------------------------------------------------------------------ [2018-06-12 11:45:15] spam2 at rhsoft dot net in the current case there are additional outputs which maybe are helpful for you guys In function cl_podcast_eintraege::edit (before dfa): var 11 (TMP) has array key type but not value type var 12 (TMP) has array key type but not value type var 14 (TMP) has array key type but not value type var 15 (CV $old_data) has array key type but not value type In function cl_podcast_eintraege::edit (after sccp): var 11 (TMP) has array key type but not value type var 12 (TMP) has array key type but not value type var 14 (TMP) has array key type but not value type var 15 (CV $old_data) has array key type but not value type In function cl_podcast_eintraege::edit (after calls): var 11 (TMP) has array key type but not value type var 12 (TMP) has array key type but not value type var 14 (TMP) has array key type but not value type var 15 (CV $old_data) has array key type but not value type In function cl_podcast_eintraege::edit (after dce): var 11 (TMP) has array key type but not value type var 12 (TMP) has array key type but not value type var 14 (TMP) has array key type but not value type var 15 (CV $old_data) has array key type but not value type In function cl_podcast_eintraege::edit (after dfa): var 11 (TMP) has array key type but not value type var 12 (TMP) has array key type but not value type var 14 (TMP) has array key type but not value type var 15 (CV $old_data) has array key type but not value type php: /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc.u.type_info) & (1<<6))' failed. Program received signal SIGABRT, Aborted. 0x00007ffff68e2660 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: dnf debuginfo-install bzip2-libs-1.0.6-24.fc27.x86_64 cyrus-sasl-lib-2.1.26-34.fc27.x86_64 expat-2.2.5-1.fc27.x86_64 fontconfig-2.12.6-4.fc27.x86_64 freetype-2.8-8.fc27.x86_64 gd-2.2.5-3.fc27.x86_64 jbigkit-libs-2.1-8.fc27.x86_64 keyutils-libs-1.5.10-3.fc27.x86_64 krb5-libs-1.15.2-9.fc27.x86_64 libX11-1.6.5-4.fc27.x86_64 libXau-1.0.8-9.fc27.x86_64 libXpm-3.5.12-4.fc27.x86_64 libcom_err-1.43.5-2.fc27.x86_64 libcrypt-nss-2.26-28.fc27.x86_64 libcurl-7.55.1-12.fc27.x86_64 libgcc-7.3.1-5.fc27.x86_64 libgomp-7.3.1-5.fc27.x86_64 libicu-57.1-9.fc27.x86_64 libidn2-2.0.5-1.fc27.x86_64 libjpeg-turbo-1.5.3-1.fc27.x86_64 libnghttp2-1.31.1-1.fc27.x86_64 libpng-1.6.31-1.fc27.x86_64 libpsl-0.18.0-3.fc27.x86_64 libselinux-2.7-3.fc27.x86_64 libssh2-1.8.0-5.fc27.x86_64 libstdc++-7.3.1-5.fc27.x86_64 libtidy-5.4.0-3.fc27.x86_64 libtiff-4.0.9-10.fc27.x86_64 libunistring-0.9.10-1.fc27.x86_64 libwebp-1.0.0-1.fc27.x86_64 libxcb-1.12-5.fc27.x86_64 libxml2-2.9.7-1.fc2! 7.x86_64 libzip-1.3.2-1.fc27.x86_64 nspr-4.19.0-1.fc27.x86_64 nss-3.37.3-1.0.fc27.x86_64 nss-softokn-freebl-3.37.3-1.0.fc27.x86_64 nss-util-3.37.3-1.0.fc27.x86_64 openldap-2.4.45-4.fc27.x86_64 openssl-libs-1.1.0h-3.fc27.x86_64 pcre2-10.31-4.fc27.x86_64 systemd-libs-234-11.git5f8984e.fc27.x86_64 xz-libs-5.2.3-4.fc27.x86_64 (gdb) f 4 #4 0x000055555588a52e in zend_string_destroy (str=0x7fffe3c7e6e0, __zend_filename=0x5555559ce4a8 "/home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_vm_execute.h", __zend_lineno=12424) at /home/builduser/rpmbuild/BUILD/php-7.3.0/Zend/zend_variables.c:73 73 ZEND_ASSERT(!ZSTR_IS_INTERNED(str)); (gdb) p (char*)str->val $1 = 0x7fffe3c7e6f8 "http://localhost" ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=76446 -- Edit this bug report at https://bugs.php.net/bug.php?id=76446&edit=1