Bug #78436 [Opn->Ver]: SEGV in complicated recursive reference object.

Edit report at https://bugs.php.net/bug.php?id=78436&edit=1 ID: 78436 Updated by: nikic@php.net Reported by: zeriyoshi at gmail dot com Summary: SEGV in complicated recursive reference object. -Status: Open +Status: Verified Type: Bug Package: *General Issues Operating System: Linux PHP Version: 7.4.0beta2 Block user comment: N Private report: N New Comment: ==11171== Invalid read of size 4 ==11171== at 0x92DDE6: zend_gc_delref (zend_types.h:1035) ==11171== by 0x92E139: i_zval_ptr_dtor (zend_variables.h:43) ==11171== by 0x92E35B: zval_ptr_dtor (zend_variables.c:84) ==11171== by 0x6D0857: spl_ptr_heap_pqueue_elem_dtor (spl_heap.c:111) ==11171== by 0x6D14FE: spl_ptr_heap_destroy (spl_heap.c:356) ==11171== by 0x6D15A6: spl_heap_object_free_storage (spl_heap.c:377) ==11171== by 0x98B49C: zend_objects_store_del (zend_objects_API.c:194) ==11171== by 0x92E1C6: rc_dtor_func (zend_variables.c:57) ==11171== by 0x98357D: i_zval_ptr_dtor (zend_variables.h:44) ==11171== by 0x983985: zend_object_std_dtor (zend_objects.c:70) ==11171== by 0x98B49C: zend_objects_store_del (zend_objects_API.c:194) ==11171== by 0x92E1C6: rc_dtor_func (zend_variables.c:57) ==11171== Address 0x12552bd0 is 0 bytes inside a block of size 56 free'd ==11171== at 0x4C30D3B: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==11171== by 0x8F70AF: _efree_custom (zend_alloc.c:2411) ==11171== by 0x8F71F0: _efree (zend_alloc.c:2531) ==11171== by 0x94A834: zend_array_destroy (zend_hash.c:1637) ==11171== by 0x92E1C6: rc_dtor_func (zend_variables.c:57) ==11171== by 0x9453D3: i_zval_ptr_dtor (zend_variables.h:44) ==11171== by 0x94A6FC: zend_array_destroy (zend_hash.c:1615) ==11171== by 0x92E1C6: rc_dtor_func (zend_variables.c:57) ==11171== by 0x9453D3: i_zval_ptr_dtor (zend_variables.h:44) ==11171== by 0x94A6CA: zend_array_destroy (zend_hash.c:1611) ==11171== by 0x92E1C6: rc_dtor_func (zend_variables.c:57) ==11171== by 0x9453D3: i_zval_ptr_dtor (zend_variables.h:44) ==11171== Block was alloc'd at ==11171== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==11171== by 0x8F80F0: __zend_malloc (zend_alloc.c:2961) ==11171== by 0x8F7048: _malloc_custom (zend_alloc.c:2402) ==11171== by 0x8F7176: _emalloc (zend_alloc.c:2521) ==11171== by 0x945C94: _zend_new_array (zend_hash.c:256) ==11171== by 0xA02FB1: ZEND_INIT_ARRAY_SPEC_CV_UNUSED_HANDLER (zend_vm_execute.h:46146) ==11171== by 0xA0E9AA: execute_ex (zend_vm_execute.h:57221) ==11171== by 0xA0EF21: zend_execute (zend_vm_execute.h:57553) ==11171== by 0x9328BA: zend_execute_scripts (zend.c:1663) ==11171== by 0x893110: php_execute_script (main.c:2619) ==11171== by 0xA11B2D: do_cli (php_cli.c:962) ==11171== by 0xA12C96: main (php_cli.c:1352) ==11171== php: /home/nikic/php-7.4/Zend/zend_types.h:1035: zend_gc_delref: Assertion `p->refcount > 0' failed. ==11171== ==11171== Process terminating with default action of signal 6 (SIGABRT) ==11171== at 0xA127E97: raise (raise.c:51) ==11171== by 0xA129800: abort (abort.c:79) ==11171== by 0xA119399: __assert_fail_base (assert.c:92) ==11171== by 0xA119411: __assert_fail (assert.c:101) ==11171== by 0x92DE0A: zend_gc_delref (zend_types.h:1035) ==11171== by 0x92E139: i_zval_ptr_dtor (zend_variables.h:43) ==11171== by 0x92E35B: zval_ptr_dtor (zend_variables.c:84) ==11171== by 0x6D0857: spl_ptr_heap_pqueue_elem_dtor (spl_heap.c:111) ==11171== by 0x6D14FE: spl_ptr_heap_destroy (spl_heap.c:356) ==11171== by 0x6D15A6: spl_heap_object_free_storage (spl_heap.c:377) ==11171== by 0x98B49C: zend_objects_store_del (zend_objects_API.c:194) ==11171== by 0x92E1C6: rc_dtor_func (zend_variables.c:57) Possibly a GC issue in spl_ptr_heap. Previous Comments: ------------------------------------------------------------------------ [2019-08-21 13:29:12] zeriyoshi at gmail dot com Description: ------------ In php 7.4 beta, if an object has a complex recursive reference, it will crash in the shutdown handler. gdb backtrace: (gdb) backtrace #0 0x00005562abaa13c2 in zend_mm_alloc_small (heap=0x7f6f72800040, bin_num=11, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1246 #1 0x00005562abaa1669 in zend_mm_alloc_heap (heap=0x7f6f72800040, size=120, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1317 #2 0x00005562abaa44fc in _emalloc (size=88, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:2524 #3 0x00005562abb3ba54 in zend_objects_new (ce=0x7f6f72805e40) at /usr/src/php/Zend/zend_objects.c:196 #4 0x00005562abaed7ce in _object_and_properties_init (arg=0x7f6f72814520, class_type=0x7f6f72805e40, properties=0x0) at /usr/src/php/Zend/zend_API.c:1397 #5 0x00005562abaed8ae in object_init_ex (arg=0x7f6f72814520, class_type=0x7f6f72805e40) at /usr/src/php/Zend/zend_API.c:1420 #6 0x00005562abb70bc5 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /usr/src/php/Zend/zend_vm_execute.h:9191 #7 0x00005562abbc9aef in execute_ex (ex=0x7f6f72814020) --Type <RET> for more, q to quit, c to continue without paging-- cute.h:54223 #8 0x00005562abbcd0e7 in zend_execute (op_array=0x7f6f72876600, return_value=0x0) at /usr/src/php/Zend/zend_vm_execute.h:57553 #9 0x00005562abae611c in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php/Zend/zend.c:1663 #10 0x00005562aba2c8ec in php_execute_script (primary_file=0x7fff2f92c190) at /usr/src/php/main/main.c:2619 #11 0x00005562abbcfdc6 in do_cli (argc=2, argv=0x7f6f72e58d00) at /usr/src/php/sapi/cli/php_cli.c:962 #12 0x00005562abbd10e3 in main (argc=2, argv=0x7f6f72e58d00) at /usr/src/php/sapi/cli/php_cli.c:1352 Test script: --------------- https://github.com/zeriyoshi/php74segv Actual result: -------------- (gdb) backtrace #0 0x00005562abaa13c2 in zend_mm_alloc_small (heap=0x7f6f72800040, bin_num=11, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1246 #1 0x00005562abaa1669 in zend_mm_alloc_heap (heap=0x7f6f72800040, size=120, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:1317 #2 0x00005562abaa44fc in _emalloc (size=88, __zend_filename=0x5562ac358cb0 "/usr/src/php/Zend/zend_objects.c", __zend_lineno=196, __zend_orig_filename=0x0, __zend_orig_lineno=0) at /usr/src/php/Zend/zend_alloc.c:2524 #3 0x00005562abb3ba54 in zend_objects_new (ce=0x7f6f72805e40) at /usr/src/php/Zend/zend_objects.c:196 #4 0x00005562abaed7ce in _object_and_properties_init (arg=0x7f6f72814520, class_type=0x7f6f72805e40, properties=0x0) at /usr/src/php/Zend/zend_API.c:1397 #5 0x00005562abaed8ae in object_init_ex (arg=0x7f6f72814520, class_type=0x7f6f72805e40) at /usr/src/php/Zend/zend_API.c:1420 #6 0x00005562abb70bc5 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /usr/src/php/Zend/zend_vm_execute.h:9191 #7 0x00005562abbc9aef in execute_ex (ex=0x7f6f72814020) --Type <RET> for more, q to quit, c to continue without paging-- cute.h:54223 #8 0x00005562abbcd0e7 in zend_execute (op_array=0x7f6f72876600, return_value=0x0) at /usr/src/php/Zend/zend_vm_execute.h:57553 #9 0x00005562abae611c in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php/Zend/zend.c:1663 #10 0x00005562aba2c8ec in php_execute_script (primary_file=0x7fff2f92c190) at /usr/src/php/main/main.c:2619 #11 0x00005562abbcfdc6 in do_cli (argc=2, argv=0x7f6f72e58d00) at /usr/src/php/sapi/cli/php_cli.c:962 #12 0x00005562abbd10e3 in main (argc=2, argv=0x7f6f72e58d00) at /usr/src/php/sapi/cli/php_cli.c:1352 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78436&edit=1