Bug #76590 [NEW]: Using persistent strings as HashTable keys causes heap corruption

From: dktapps at pmmp dot io Operating system: * PHP version: 7.3.0alpha3 Package: Reproducible crash Bug Type: Bug Bug description:Using persistent strings as HashTable keys causes heap corruption Description: ------------ While attempting to update ext/pthreads (Using the master branch of https://github.com/krakjoe/pthreads) for PHP 7.3.0 alphas, I encountered a range of heap corruption issues. After extensive debugging, I discovered these issues were not caused by pthreads itself. These issues were caused by this commit: https://github.com/php/php-src/commit/5eb1f92f31cafc48384f9096012f421b37f6d425 To be specific, using persistent strings as hashtable keys now causes issues with heap corruption in "zend_array_destroy()" because it now assumes that keys are always non-persistent. pthreads then suffered from issues due to using persistent strings as htable keys for object property tables. I have not further investigated the range of things that this affected. Test script: --------------- <?php $worker = new Worker(); $worker->start(); $worker->stack(new Threaded); $worker->shutdown(); ?> Expected result: ---------------- no output Actual result: -------------- zend_mm_heap corrupted or if in debug mode: Assertion failed: !(zval_gc_flags((s)->gc.u.type_info) & (1<<7)), file c:\php-sdk\php\vc15\x64\php-src\zend\zend_string.h, line 290 -- Edit bug report at https://bugs.php.net/bug.php?id=76590&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76590&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76590&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76590&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=76590&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=76590&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=76590&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=76590&r=needscript Try newer version: https://bugs.php.net/fix.php?id=76590&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=76590&r=support Expected behavior: https://bugs.php.net/fix.php?id=76590&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=76590&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=76590&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=76590&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76590&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=76590&r=dst IIS Stability: https://bugs.php.net/fix.php?id=76590&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=76590&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=76590&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=76590&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=76590&r=mysqlcfg