Bug #78436 [NEW]: SEGV in complicated recursive reference object.

From: zeriyoshi at gmail dot com Operating system: Linux PHP version: 7.4.0beta2 Package: *General Issues Bug Type: Bug Bug description:SEGV in complicated recursive reference object. Description: ------------ In php 7.4 beta, if an object has a complex recursive reference, it will crash in the shutdown handler. gdb backtrace: (gdb) backtrace #0 0x00005562abaa13c2 in zend_mm_alloc_small (heap=0x7f6f72800040, bin_num=11, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1246 #1 0x00005562abaa1669 in zend_mm_alloc_heap (heap=0x7f6f72800040, size=120, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1317 #2 0x00005562abaa44fc in _emalloc (size=88, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:2524 #3 0x00005562abb3ba54 in zend_objects_new (ce=0x7f6f72805e40) at /usr/src/php/Zend/zend_objects.c:196 #4 0x00005562abaed7ce in _object_and_properties_init (arg=0x7f6f72814520, class_type=0x7f6f72805e40, properties=0x0) at /usr/src/php/Zend/zend_API.c:1397 #5 0x00005562abaed8ae in object_init_ex (arg=0x7f6f72814520, class_type=0x7f6f72805e40) at /usr/src/php/Zend/zend_API.c:1420 #6 0x00005562abb70bc5 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /usr/src/php/Zend/zend_vm_execute.h:9191 #7 0x00005562abbc9aef in execute_ex (ex=0x7f6f72814020) --Type <RET> for more, q to quit, c to continue without paging-- cute.h:54223 #8 0x00005562abbcd0e7 in zend_execute (op_array=0x7f6f72876600, return_value=0x0) at /usr/src/php/Zend/zend_vm_execute.h:57553 #9 0x00005562abae611c in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php/Zend/zend.c:1663 #10 0x00005562aba2c8ec in php_execute_script (primary_file=0x7fff2f92c190) at /usr/src/php/main/main.c:2619 #11 0x00005562abbcfdc6 in do_cli (argc=2, argv=0x7f6f72e58d00) at /usr/src/php/sapi/cli/php_cli.c:962 #12 0x00005562abbd10e3 in main (argc=2, argv=0x7f6f72e58d00) at /usr/src/php/sapi/cli/php_cli.c:1352 Test script: --------------- https://github.com/zeriyoshi/php74segv Actual result: -------------- (gdb) backtrace #0 0x00005562abaa13c2 in zend_mm_alloc_small (heap=0x7f6f72800040, bin_num=11, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1246 #1 0x00005562abaa1669 in zend_mm_alloc_heap (heap=0x7f6f72800040, size=120, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1317 #2 0x00005562abaa44fc in _emalloc (size=88, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:2524 #3 0x00005562abb3ba54 in zend_objects_new (ce=0x7f6f72805e40) at /usr/src/php/Zend/zend_objects.c:196 #4 0x00005562abaed7ce in _object_and_properties_init (arg=0x7f6f72814520, class_type=0x7f6f72805e40, properties=0x0) at /usr/src/php/Zend/zend_API.c:1397 #5 0x00005562abaed8ae in object_init_ex (arg=0x7f6f72814520, class_type=0x7f6f72805e40) at /usr/src/php/Zend/zend_API.c:1420 #6 0x00005562abb70bc5 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /usr/src/php/Zend/zend_vm_execute.h:9191 #7 0x00005562abbc9aef in execute_ex (ex=0x7f6f72814020) --Type <RET> for more, q to quit, c to continue without paging-- cute.h:54223 #8 0x00005562abbcd0e7 in zend_execute (op_array=0x7f6f72876600, return_value=0x0) at /usr/src/php/Zend/zend_vm_execute.h:57553 #9 0x00005562abae611c in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php/Zend/zend.c:1663 #10 0x00005562aba2c8ec in php_execute_script (primary_file=0x7fff2f92c190) at /usr/src/php/main/main.c:2619 #11 0x00005562abbcfdc6 in do_cli (argc=2, argv=0x7f6f72e58d00) at /usr/src/php/sapi/cli/php_cli.c:962 #12 0x00005562abbd10e3 in main (argc=2, argv=0x7f6f72e58d00) at /usr/src/php/sapi/cli/php_cli.c:1352 -- Edit bug report at https://bugs.php.net/bug.php?id=78436&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78436&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78436&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78436&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78436&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78436&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78436&r=support Expected behavior: https://bugs.php.net/fix.php?id=78436&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78436&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78436&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78436&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78436&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78436&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78436&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78436&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78436&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78436&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78436&r=mysqlcfg