Bug #78010 [Com]: Segmentation fault during GC

Edit report at https://bugs.php.net/bug.php?id=78010&edit=1 ID: 78010 Comment by: grzegorz129 at gmail dot com Reported by: valera dot ymnik at gmail dot com Summary: Segmentation fault during GC Status: Verified Type: Bug Package: Reproducible crash Operating System: Debian 9 && Ubuntu 18.04 PHP Version: 7.3.5 Block user comment: N Private report: N New Comment: After some more testing this bug seems to be introduced in 7.3.0 (or during it's stabilization period). The 7.2.20 runs my short example without a problem while 7.3.0 crashes with a SIGSEGV. While I'm unable to run the whole suite on 3v4l (since it uses substantial amount of resources after all) I also verified all three master branches (normal/jit/opcache) and all of them are crashing in the same way. Previous Comments: ------------------------------------------------------------------------ [2019-07-13 00:00:05] grzegorz129 at gmail dot com I simplified the reproducer and added some comments: <?php //gc_disable(); class foo { public function __construct() { $this->x = $this; for ($i = 0; $i < 898; $i++) { //Will not trigger with <898 $obj = [new stdClass, new stdClass]; //This must have at least 2 elements $this->y[] = $obj; } } } for ($i = 0; $i < 2; ++$i) { //This must run >=2 (increasing the number of elements in the array *2 will not do) $x = []; //This must be reset foreach (array_fill(0, 389, 'x') as &$params) { //Will not trigger <389 $x[] = new foo; } } echo "Completed\n"; Valgring output: https://zerobin.net/?ca2ef1bcab5e1b03#qc85nUSpB0Yp7oK4Bvd1hSOV3B9kybe34XmH6wvZE6o= ------------------------------------------------------------------------ [2019-07-12 20:50:21] grzegorz129 at gmail dot com Maybe stating the obvious but putting gc_disable() at the beginning of the script makes the code complete. Also tested on 7.4alpha3 - the same result. ------------------------------------------------------------------------ [2019-07-12 18:50:46] nikic@php.net Related To: Bug #78280 ------------------------------------------------------------------------ [2019-07-12 16:11:17] kolja dot zuelsdorf at deinhandy dot de We have this issue under strong suspicion to break one of our core business processes and wonder why it was not addressed in the last bugfix releases. Is there anything we can do to help mitigate the issue? So far we are running said process on an old (7.1) version. Furthermore, I've confirmed that the same thing happens on 7.3.6 and 7.3.7 too. ------------------------------------------------------------------------ [2019-05-14 12:43:51] nikic@php.net First valgrind warning: ==21347== Invalid read of size 4 ==21347== at 0x94623D: zend_gc_collect_cycles (zend_gc.c:1529) ==21347== by 0x9436EA: gc_possible_root_when_full (zend_gc.c:579) ==21347== by 0x943996: gc_possible_root (zend_gc.c:629) ==21347== by 0x970CF4: zend_assign_to_variable (zend_execute.h:146) ==21347== by 0x9E99E5: ZEND_ASSIGN_SPEC_CV_VAR_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:48960) ==21347== by 0x9FBA14: execute_ex (zend_vm_execute.h:65005) ==21347== by 0x9FC649: zend_execute (zend_vm_execute.h:65726) ==21347== by 0x908A98: zend_execute_scripts (zend.c:1661) ==21347== by 0x8518DA: php_execute_script (main.c:2676) ==21347== by 0x9FF646: do_cli (php_cli.c:985) ==21347== by 0xA00965: main (php_cli.c:1375) ==21347== Address 0x2661b414 is 4 bytes inside a block of size 40 free'd ==21347== at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==21347== by 0x8C7FC4: _efree (zend_alloc.c:2497) ==21347== by 0x96619B: zend_objects_store_del (zend_objects_API.c:198) ==21347== by 0x902E4E: rc_dtor_func (zend_variables.c:57) ==21347== by 0x91C30D: i_zval_ptr_dtor (zend_variables.h:44) ==21347== by 0x921881: zend_array_destroy (zend_hash.c:1589) ==21347== by 0x95DBA1: zend_object_std_dtor (zend_objects.c:53) ==21347== by 0x966137: zend_objects_store_del (zend_objects_API.c:194) ==21347== by 0x902E4E: rc_dtor_func (zend_variables.c:57) ==21347== by 0x91C30D: i_zval_ptr_dtor (zend_variables.h:44) ==21347== by 0x921881: zend_array_destroy (zend_hash.c:1589) ==21347== by 0x902E4E: rc_dtor_func (zend_variables.c:57) ==21347== Block was alloc'd at ==21347== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==21347== by 0x8C8F07: __zend_malloc (zend_alloc.c:2889) ==21347== by 0x8C7E9C: _emalloc (zend_alloc.c:2483) ==21347== by 0x95E27A: zend_objects_new (zend_objects.c:195) ==21347== by 0x90FFCE: _object_and_properties_init (zend_API.c:1356) ==21347== by 0x9100AE: object_init_ex (zend_API.c:1379) ==21347== by 0x992655: ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (zend_vm_execute.h:9173) ==21347== by 0x9F7273: execute_ex (zend_vm_execute.h:60503) ==21347== by 0x9FC649: zend_execute (zend_vm_execute.h:65726) ==21347== by 0x908A98: zend_execute_scripts (zend.c:1661) ==21347== by 0x8518DA: php_execute_script (main.c:2676) ==21347== by 0x9FF646: do_cli (php_cli.c:985) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=78010 -- Edit this bug report at https://bugs.php.net/bug.php?id=78010&edit=1