Edit report at https://bugs.php.net/bug.php?id=78379&edit=1
ID: 78379
Updated by: dmitry@php.net
Reported by: tstarling@php.net
Summary: Cast to object confuses GC, causes crash
-Status: Re-Opened
+Status: Closed
Type: Bug
Package: Reproducible crash
Operating System: Linux
PHP Version: 7.2Git-2019-08-06 (Git)
-Assigned To:
+Assigned To: dmitry
Block user comment: N
Private report: N
New Comment:
Should be fixed now.
Previous Comments:
------------------------------------------------------------------------
[2019-08-09 03:33:37] tstarling@php.net
I guess it's good enough. The trace output is certainly better than it was.
I did start work on a patch which tries to make property tables be children of objects. The problem
I ran into is making sure property tables are not directly destroyed by the garbage collector, since
zend_object_std_dtor() etc. doesn't check if the property array has already been destroyed
before destroying it, leading to an assertion failure. Maybe it is a thing to try against master
rather than in a bugfix for all branches.
------------------------------------------------------------------------
[2019-08-08 14:18:44] dmitry@php.net
Proposed patches https://gist.github.com/dstogov/43a992d481f65ac16c454e1a292be38e
seem to fix the second problem
------------------------------------------------------------------------
[2019-08-08 08:03:25] dmitry@php.net
The committed patch https://github.com/php/php-src/commit/358379be22c4e20f4942737e0e90422977355c63
doesn't fix the second problem.
------------------------------------------------------------------------
[2019-08-08 07:09:12] dmitry@php.net
Automatic comment on behalf of dmitry@zend.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=358379be22c4e20f4942737e0e90422977355c63
Log: Fixed bug #78379 (Cast to object confuses GC, causes crash)
------------------------------------------------------------------------
[2019-08-08 03:13:37] tstarling@php.net
Your patch prevents the array being freed, but it doesn't stop its reference count from going
negative, since gc_mark_grey() is still the same, and it won't collect cycles that include the
shared array as part of the loop. Both issues can be seen in this test case:
class E {}
function f() {
$e1 = new E;
$e2 = new E;
$a = ['e2' => $e2];
$e1->a = (object)$a;
$e2->e1 = $e1;
$e2->a = (object)$a;
}
f();
gc_collect_cycles();
echo "End\n";
With ZEND_GC_DEBUG=2 you can see it report rc=-1 for object(E)#2, then it says there is
"Nothing to free".
It's just a memory leak rather than a crash, but I'm considering doing a patch of my own
along the lines of the third paragraph of the bug description, so we can see if that looks better.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=78379
--
Edit this bug report at https://bugs.php.net/bug.php?id=78379&edit=1